From b4aa1677a80325b66b9164eb529ebf9b3b92763f Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 21 Jul 2026 04:59:47 +0100
Subject: [PATCH] ci: unbreak standards' own secret scanning; SPDX + pin
 pages.yml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

secret-scanner.yml was pinned to the reusable at @891b1ed6 (2026-07-06),
which is 21 commits behind #500 (08e2d246). At that pin the reusable's
gitleaks job still requests `pull-requests: write` + `actions: read`, but
this caller grants only `contents: read`. A called workflow cannot exceed
its caller's grant, so every run terminated at startup_failure — the last
six runs, including every push to main, all startup_failure. Standards'
own secret scanning has therefore not executed at all since that pin
landed, which is worse than a fake-green gate.

Switch to the local relative path `./.github/workflows/secret-scanner-reusable.yml`,
mirroring governance.yml. This repo owns the reusable, so it should always
scan itself with the current version; a local path also cannot re-stale,
so this class of breakage cannot recur here. The current reusable needs
only `contents: read`, so the existing grant is already correct.

pages.yml (added in #503) had no SPDX header — tripping the governance
"missing SPDX header" gate — and four unpinned tag refs, which the estate
Actions policy rejects at run creation. Add `MPL-2.0` (this repo's licence,
not AGPL) and pin all four to release SHAs, keeping the current majors:
checkout v7.0.0, upload-pages-artifact v5.0.0, deploy-pages v5.0.0.

spark-theatre-gate.yml: correct a mislabelled pin comment — SHA
9c091bb2 is v7.0.0, not v4. Cosmetic; no behavioural change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/pages.yml              |  9 +++++----
 .github/workflows/secret-scanner.yml     | 11 ++++++++++-
 .github/workflows/spark-theatre-gate.yml |  2 +-
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index f95bced7..19cf1670 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 name: GitHub Pages (Ddraig SSG)
 on:
   push:
@@ -18,9 +19,9 @@ jobs:
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
       - name: Checkout Site
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Checkout Ddraig SSG
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg
@@ -37,7 +38,7 @@ jobs:
           fi
           ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: '_site'
   deploy:
@@ -50,4 +51,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 1b1311cf..b968403e 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -18,5 +18,14 @@ jobs:
     # The reusable's gitleaks job no longer requests elevated permissions
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@891b1ed6164478616cb3375f328c6487ccb13f80
+    # Local relative path, not an external SHA pin — this is the repo that
+    # *owns* the reusable, so it must scan itself with the current version
+    # (same pattern as governance.yml). The previous pin
+    # @891b1ed6164478616cb3375f328c6487ccb13f80 (2026-07-06) predated #500 and
+    # still requested `pull-requests: write` + `actions: read`; a called
+    # workflow cannot exceed its caller's grant, and this caller grants only
+    # `contents: read`, so every run died at startup_failure — standards' own
+    # secret scanning had not executed since that pin landed. A local path
+    # cannot re-stale, so this class of breakage cannot recur here.
+    uses: ./.github/workflows/secret-scanner-reusable.yml
     secrets: inherit
diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml
index 8aa3b6f5..e305a541 100644
--- a/.github/workflows/spark-theatre-gate.yml
+++ b/.github/workflows/spark-theatre-gate.yml
@@ -64,7 +64,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan for SPARK proof theatre
         env: