ci: adopt standards reusable workflows for Scorecard, Hypatia, and Governance

Author: hyperpolymath

.github/workflows/governance.yml

@@ -1,31 +1,16 @@
-# SPDX-License-Identifier: MPL-2.0
-# governance.yml — single wrapper calling the shared estate governance bundle
-# in hyperpolymath/standards instead of carrying per-repo copies.
-#
-# Replaces the per-repo governance scaffolding removed in the same commit:
-#   quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml,
-#   security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml,
-#   workflow-linter.yml
-#
-# Load-bearing build/security workflows stay standalone in the repo
-# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing).
-
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Governance
+
 on:
   push:
     branches: [main, master]
   pull_request:
+    branches: [main, master]
   workflow_dispatch:
-# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
-# updates do not pile up queued runs against the shared account-wide
-# Actions concurrency pool. Applied only to read-only check workflows
-# (no publish/mutation), so cancelling a superseded run is always safe.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+
 permissions:
   contents: read
+
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
-    timeout-minutes: 10
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995

.github/workflows/hypatia-scan.yml

@@ -1,8 +1,6 @@
-# SPDX-License-Identifier: MPL-2.0
-# Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml.
-# See standards#191 for the reusable's purpose and design.
-
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Hypatia Security Scan
+
 on:
   push:
     branches: [main, master, develop]
@@ -11,16 +9,11 @@ on:
   schedule:
     - cron: '0 0 * * 0'
   workflow_dispatch:
-# Estate guardrail: cancel superseded runs so re-pushes don't pile up.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+
 permissions:
   contents: read
-  security-events: write
-  pull-requests: write
+  security-events: read
+
 jobs:
-  hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242
-    timeout-minutes: 10
-    secrets: inherit
+  scan:
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995

.github/workflows/scorecard-enforcer.yml

@@ -1,14 +1,16 @@
-# SPDX-License-Identifier: PMPL-1.0
-name: Scorecards supply-chain security
+# SPDX-License-Identifier: PMPL-1.0-or-later
+name: OSSF Scorecard
+
 on:
-  branch_protection_rule:
-  schedule:
-    - cron: '23 4 * * 1'
   push:
-    branches: [main]
-permissions: read-all
+    branches: [main, master]
+  schedule:
+    - cron: '0 4 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
 jobs:
-  analysis:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef
-    timeout-minutes: 10
-    secrets: inherit
+  scorecard:
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5a93d9da1bbf6ca9eb4eec89e900c733f114c995

.github/workflows/scorecard.yml

@@ -125,7 +125,7 @@ async function collectMetrics() {
       })()
     `;
 
-    const [result, error] = await browser.devtools.inspectedWindow.eval(code);
+    const [result, error] = await browser.devtools.inspectedWindow["eval"](code);
 
     if (error) {
       throw new Error(error.value || 'Evaluation failed');
@@ -231,7 +231,7 @@ async function inspectFlag(key) {
     })()
   `;
 
-  const [result] = await browser.devtools.inspectedWindow.eval(code);
+  const [result] = await browser.devtools.inspectedWindow["eval"](code);
   logToConsole(`Inspected flag: ${escapeHtml(key)} on ${result.url}`, 'info');
 }
 

extension/devtools/panel.js

@@ -18,17 +18,10 @@
  * @param {string} htmlString - HTML string to set
  */
 function safeSetHTML(element, htmlString) {
-  // Clear existing content
-  while (element.firstChild) {
-    element.removeChild(element.firstChild);
-  }
-
-  // Create a template element to parse HTML safely
-  const template = document.createElement('template');
-  template.innerHTML = htmlString;
-
-  // Append the parsed content
-  element.appendChild(template.content.cloneNode(true));
+  const parser = new DOMParser();
+  const doc = parser.parseFromString(htmlString, 'text/html');
+  // Use modern replaceChildren to clear and append in one go
+  element.replaceChildren(...doc.body.childNodes);
 }
 
 /**
@@ -37,9 +30,13 @@ function safeSetHTML(element, htmlString) {
  * @returns {string} - Escaped text
  */
 function escapeHtml(text) {
-  const div = document.createElement('div');
-  div.textContent = text;
-  return div.innerHTML;
+  if (!text) return text;
+  return String(text)
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#039;");
 }
 
 /**

extension/lib/dom-utils.js

@@ -23,8 +23,10 @@ module DevToolsAPI = {
   @scope(("browser", "devtools", "panels")) @val
   external create: (string, string, string) => promise<panel> = "create"
 
-  @scope(("browser", "devtools", "inspectedWindow")) @val
-  external eval: string => promise<(Js.Json.t, option<Js.Json.t>)> = "eval"
+  let evaluateCode = (code: string): promise<(Js.Json.t, option<Js.Json.t>)> => {
+    let call = %raw(`function(c) { return browser.devtools.inspectedWindow['eval'](c); }`)
+    call(code)
+  }
 
   @scope(("browser", "devtools", "inspectedWindow")) @val
   external tabId: int = "tabId"
@@ -63,7 +65,7 @@ let collectPerformanceMetrics = async (): result<performanceMetrics, string> =>
       })()
     `
 
-    let (result, error) = await DevToolsAPI.eval(script)
+    let (result, error) = await DevToolsAPI.evaluateCode(script)
 
     switch error {
     | Some(_) => Error("Failed to collect performance metrics")