ci: unbreak standards' own secret scanning; SPDX + pin pages.yml

.github/workflows/pages.yml

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 name: GitHub Pages (Ddraig SSG)
 on:
   push:
@@ -18,9 +19,9 @@ jobs:
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
       - name: Checkout Site
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Checkout Ddraig SSG
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg
@@ -37,7 +38,7 @@ jobs:
           fi
           ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: '_site'
   deploy:
@@ -50,4 +51,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/secret-scanner.yml

@@ -18,5 +18,14 @@ jobs:
     # The reusable's gitleaks job no longer requests elevated permissions
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@891b1ed6164478616cb3375f328c6487ccb13f80
+    # Local relative path, not an external SHA pin — this is the repo that
+    # *owns* the reusable, so it must scan itself with the current version
+    # (same pattern as governance.yml). The previous pin
+    # @891b1ed6164478616cb3375f328c6487ccb13f80 (2026-07-06) predated #500 and
+    # still requested `pull-requests: write` + `actions: read`; a called
+    # workflow cannot exceed its caller's grant, and this caller grants only
+    # `contents: read`, so every run died at startup_failure — standards' own
+    # secret scanning had not executed since that pin landed. A local path
+    # cannot re-stale, so this class of breakage cannot recur here.
+    uses: ./.github/workflows/secret-scanner-reusable.yml
     secrets: inherit

.github/workflows/spark-theatre-gate.yml

@@ -64,7 +64,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Scan for SPARK proof theatre
         env: