CI: Hypatia scan fails — reusable pins an unresolvable actions/cache SHA (fix lives in hyperpolymath/standards)

[hyperpolymath]

Symptom

The scan / Hypatia Neurosymbolic Analysis check fails on every PR (seen on #53, #54, #55) within ~2–3s:

##[error]Unable to resolve action `actions/cache@d4373f267a887d77f9eb0683a479ec60b1fe5b2b`, unable to find version `d4373f267a887d77f9eb0683a479ec60b1fe5b2b`

It is not caused by any repo content — it fails identically on main, and PRs that touch only Lean/Rust/docs still trip it. It is a broken action pin.

Root cause (out of this repo)

This repo's .github/workflows/hypatia-scan.yml is a one-line wrapper that calls a reusable:

jobs:
  scan:
    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910

The unresolvable actions/cache@d4373f26… pin lives inside that reusable, in hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml. The wrapper here is otherwise correct.

Fix (apply in hyperpolymath/standards)

Re-pin actions/cache to the SHA already used consistently across the estate (echo-types, januskey, nextgen-languages all use it and pass CI):

- uses: actions/cache@d4373f267a887d77f9eb0683a479ec60b1fe5b2b
+ uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5

Impact

Estate-wide: every repo that consumes the Hypatia reusable fails this check until the pin is fixed in standards. One re-pin clears them all.

Scope note

The fix cannot be made from a session scoped to this repo — hyperpolymath/standards must be in scope (or fixed directly there). This issue tracks the dependency so the JtV-side failure is explained and the remedy is one copy-paste away.

[hyperpolymath]

Update (2026-06-21): the stale pin now also fails the governance Workflow Staleness gate

The same stale standards pin (@5a93d9d57cc0) now trips a second gate — governance / Check Workflow Staleness — which was green on earlier PRs today and flipped once standards advanced:

governance-reusable.yml / hypatia-scan-reusable.yml / scorecard-reusable.yml pin 5a93d9d57cc0
  is not a recognised ancestor of standards HEAD (09e7023d2468). ... Pin a published standards commit.

So this is now estate-wide and fails on main too (not PR-specific). Two distinct gates (Hypatia + Staleness) share this one root cause.

In-repo remediation (this repo, in scope)

Re-pin the three wrapper workflows from @5a93d9d57cc04de4002d6d0ecd336fc7a8698910 to a current standards commit. Per the check, standards HEAD is 09e7023d24682621bea4e11965a1ef5e87d86c3b; note mirror.yml already pins a newer e6b2884722350515934d443daf23442f2195796f:

• .github/workflows/hypatia-scan.yml
• .github/workflows/governance.yml
• .github/workflows/scorecard.yml

(There is no scorecard-enforcer.yml in this repo, so that clause of the error is N/A here.)

Re-pinning to current standards HEAD should clear the staleness gate, and may also clear the Hypatia actions/cache failure if the broken cache pin was fixed upstream between 5a93d9d and 09e7023 — verifying that needs read access to hyperpolymath/standards (out of this session's scope). I can do the in-repo re-pin on request.

---

Generated by Claude Code