feat(governance): add mirror-reusable.yml — consolidate 289-repo mirror.yml drift

[hyperpolymath]

Summary

Extends the reusable-workflow pattern from #168 (governance-reusable + deno-ci-reusable) and #174 (rust-ci-reusable + elixir-ci-reusable) to the mirror.yml template.

Estate audit picked this as the highest-leverage next foundational reusable across 5 candidates (codeql, secret-scanner, hypatia-scan, mirror, scorecard).

Drift survey

gh api /search/code paginated against org:hyperpolymath, then blob-SHA grouped:

Template	Deployments	Sampled	Unique SHAs	Top-SHA share
mirror.yml	289	100	76 (76%)	16% — long tail
codeql.yml	263	100	70 (70%)	32%
secret-scanner.yml	281	100	55 (55%)	47%
scorecard.yml	258	258 (full)	46 (18%)	39%
hypatia-scan.yml	255	200	31 (15.5%)	50%

(scorecard + hypatia-scan are already mostly converged → low leverage now.)

mirror.yml ranks first on drift × deployments (76% × 289 ≈ 220) and was verified to have low feature variance: all 4 top-SHA variants sampled (covering 29/100 sampled repos: bgp-backbone-lab, ipfs-overlay, kaldor-iiot, vcs-ircd) carried the same 7 forge jobs (gitlab, bitbucket, codeberg, sourcehut, disroot, gitea, radicle). Drift is action-SHA / whitespace churn — not feature variance — exactly the shape that consolidates cleanly behind one workflow_call reusable.

Design

• No per-call inputs other than runs-on — per-repo forge selection already externalised to Actions vars vars._MIRROR_ENABLED == 'true', so the reusable mirrors the gating pattern verbatim.
• secrets: inherit required at the call site — the per-forge SSH keys (GITLAB_SSH_KEY, BITBUCKET_SSH_KEY, CODEBERG_SSH_KEY, SOURCEHUT_SSH_KEY, DISROOT_SSH_KEY, GITEA_SSH_KEY) and RADICLE_KEY flow through implicitly. Without secrets: inherit the inner secrets.X references evaluate to empty (silent push failure on each enabled forge).
• vars.GITEA_HOST consumed verbatim from the caller repo's Actions vars — same as the canonical mirror.yml.
• All actions SHA-pinned; SPDX header present; top-level permissions: contents: read; passes the workflow-lint job in governance-reusable.yml.

No filtering logic, so no regression-test file (cf. scripts/tests/apply-baseline-test.sh for the governance/baseline path that needs one).

Caller wrapper shape (post-merge)

```yaml

SPDX-License-Identifier: PMPL-1.0-or-later

name: Mirror to Git Forges
on:
push:
branches: [main]
workflow_dispatch:
permissions:
contents: read
jobs:
mirror:
uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@
secrets: inherit
```

~10 lines per repo, replacing ~145 lines.

Rollout plan (downstream wrapper sweep)

NOT started in this PR — owner-gated, same as #174's rust-ci sweep (which capped at 82 PRs).

Numbers (from the 100-repo SHA-sample, extrapolated to 289):

• 289 repos total deployments to convert
• ~85% trivially convertible (forge set matches canonical 7-forge list; SHA-pinned actions only differ in pin SHA / whitespace). One mechanical wrapper PR per repo, same shape as the refactor(governance): subsume language-policy.yml + add deno-ci-reusable (semantics-level fix for estate-template drift) #168 wrappers (absolute-zero#41, tma-mark2#41).
• ~10-15% need careful review — long-tail SHAs may include legitimate custom forges or local additions. Surface a per-repo diff during sweep; defer non-canonical variants to a follow-up.
• Sweep order: pin wrappers to this PR's HEAD SHA while owner-gated; rebase to merged-main SHA in the wave's final batch (same protocol as the rust-ci sweep).

Pattern hardening (no per-PR action required)

• Same workflow_call shape as refactor(governance): subsume language-policy.yml + add deno-ci-reusable (semantics-level fix for estate-template drift) #168 / feat(governance): add rust-ci-reusable + elixir-ci-reusable workflows #174 — no new infrastructure.
• Independent of feat(governance): add rust-ci-reusable + elixir-ci-reusable workflows #174 (rust-ci-reusable.yml) and fix(baseline): file_pattern glob matching + jq scoping bugs #180 (apply-baseline.sh glob fix) — no conflicts; can land in any order.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 118 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence