fix(ci): replace fake goto-bus-stop/setup-zig SHA pin

[hyperpolymath]

Summary

The pin goto-bus-stop/setup-zig@7ab2955eb728f5440978d7b4f723a50dea1f3608 at .github/workflows/e2e.yml:42 is fabricated. gh api repos/goto-bus-stop/setup-zig/commits/7ab2955... → 422 "No commit found for SHA".

The fake SHA's first 16 hex chars collide with v2.2.0's real SHA 7ab2955eb728f5440978d5824358023be3a2802d, but the rest is fabricated — a partial collision that would slip past visual review.

Replaced with verified v2.2.1 pin abea47f85e598557f500fa1fd2ab7464fcb39406.

Provenance

• Propagated from rsr-template-repo's e2e.yml template (commented stub, uncommented when concretising here)
• Template fixed upstream: fix(template): replace 4 fake action SHA pins in e2e.yml rsr-template-repo#81 (merged)
• Discovered while wiring CI for snifs: ci+test: wire build-mode invariant gate, harden crash_oob, remove stale wasm snifs#30
• 3 of 3 fan-out PRs (alongside odds-and-sods-package-manager#39 and proven#93)

Test plan

• The setup-zig line uses abea47f85e... (v2.2.1)
• gh api repos/goto-bus-stop/setup-zig/commits/abea47f85e598557f500fa1fd2ab7464fcb39406 returns 200
• The e2e workflow's Zig setup step actually resolves on next run

[github-actions]

🔍 Hypatia Security Scan

Findings: 297 issues detected

Severity	Count
🔴 Critical	214
🟠 High	11
🟡 Medium	72

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "unknown",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "unknown",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dependabot-automerge.yml",
    "type": "unknown",
    "file": "dependabot-automerge.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence