ci(governance): refresh stale standards reusables, drop retired scorecard-enforcer, add job timeouts - #22
Merged
Conversation
…card-enforcer; add job timeouts Fixes the pre-existing `governance / Check Workflow Staleness` failure (and the related Hypatia workflow_audit findings) flagged against the current standards baseline (SHA 5a93d9d). These live on main and block every PR; this is the separate refresh PR. - Remove retired .github/workflows/scorecard-enforcer.yml (superseded by scorecard.yml -> standards scorecard-reusable.yml). - Bump stale standards reusable pins to 5a93d9d57cc04de4002d6d0ecd336fc7a8698910: governance.yml (@main -> SHA), hypatia-scan.yml, scorecard.yml. The refreshed Scorecard reusable also resolves the "SARIF to Code Scanning" finding. - Add timeout-minutes to every job flagged by Hypatia workflow_audit: casket-pages (2), codeql, dependabot-automerge, dogfood-gate (6), instant-sync. Verified: governance/hypatia/scorecard reusables all exist at 5a93d9d in hyperpolymath/standards; edited workflows parse (dogfood-gate's pre-existing embedded python heredoc trips naive YAML parsers but is unchanged here and runs in CI). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR
hyperpolymath
marked this pull request as ready for review
June 21, 2026 02:10
This was referenced Jun 21, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The
governance / Check Workflow Stalenessgate (and related Hypatiaworkflow_auditfindings) are failing on every PR — including #21 — against the currenthyperpolymath/standardsbaseline (5a93d9d). This drift is pre-existing onmain, unrelated to any feature work. This is the separate refresh PR to clear it estate-wide.Changes
Remove retired workflow
.github/workflows/scorecard-enforcer.yml— the staleness check reports it as retired (superseded byscorecard.yml→ standardsscorecard-reusable.yml).Refresh stale standards-reusable pins →
5a93d9d57cc04de4002d6d0ecd336fc7a8698910governance.yml(@main→ SHA-pinned)hypatia-scan.yml(@915139d…→ SHA)scorecard.yml(@e0caf11…→ SHA) — the refreshed Scorecard reusable also resolves the "must not upload SARIF to Code Scanning" finding.secret-scanner.ymlandmirror.ymlwere not flagged stale and are left untouched.)Add
timeout-minutesto every job flagged by Hypatiaworkflow_auditcasket-pages.yml(2 jobs),codeql.yml,dependabot-automerge.yml,dogfood-gate.yml(6 jobs),instant-sync.yml.Verification
hyperpolymath/standards@5a93d9d:governance-reusable.yml,hypatia-scan-reusable.yml, andscorecard-reusable.ymlall exist there.dogfood-gate.ymltrips naive YAML parsers due to a pre-existing embeddedpython3heredoc — identical onmain, unchanged here, and it runs in CI; my diff to it is only the sixtimeout-minuteslines.)Impact
Unblocks #21 and all future PRs once merged. No application/Worker code touched — workflow CI hygiene only.
🤖 Generated with Claude Code
https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR
Generated by Claude Code