fix(governance-reusable): pin standards self-checkout to main (workflow_sha was caller-SHA)

[hyperpolymath]

Summary

• governance-reusable.yml:155 used ref: ${{ github.workflow_sha }} for the inner actions/checkout of hyperpolymath/standards into .standards-checkout/.
• In a reusable workflow, github.workflow_sha resolves to the caller repo's commit SHA, not the SHA of the reusable workflow file in this repo. The fetch therefore asks the standards repo for a SHA that lives in the caller — exit code 128 after three retries.
• Net effect: governance / Language / package anti-pattern policy (and any other job in the same workflow that depends on .standards-checkout/) fails on every governance run across the estate.
• Pin ref: main instead. Caller repos already pin the reusable's YAML by SHA, so script-version drift is bounded to standards/main between the YAML pin and the script pin — acceptable because these scripts are read-only governance checks and standards/main is protected.

Evidence

From gossamer#59 governance run (https://github.com/hyperpolymath/gossamer/actions/runs/26459402802):

[command]/usr/bin/git -c protocol.version=2 fetch ... origin 67241f8b650db4feb70b5f2d23342c20bae4b0c4
The process '/usr/bin/git' failed with exit code 128
Waiting 10 seconds before trying again
... (×3) ...

• gh api repos/hyperpolymath/standards/commits/67241f8b6... → 422 No commit found for SHA.
• gh api repos/hyperpolymath/gossamer/commits/67241f8b6... → exists; it is the PR-merge commit for gossamer#59 (Merge 5b35d61f... into dd3a50a...).

This is exactly the symptom the estate has been observing as "Governance / governance / Language / package anti-pattern policy — Failing after 40s" across every open PR.

Why this is the right fix

• The original intent (per the comment block) was "use the same SHA actually loaded for the reusable", but Actions doesn't surface that to a reusable workflow — github.workflow_sha is documented as the trigger commit of the caller, and no github.action_* context applies to reusable workflows.
• Passing inputs.standards_ref was considered but rejected: every wrapper across the estate would need to thread it through, and the default would be main anyway.
• main is protected and rebases are not part of normal flow here, so the failure mode "standards/main is gone" is not realistic.

Test plan

• CI on this PR exercises the same job and should now pass.
• After merge, retry a representative stuck PR (gossamer#56) and confirm governance / Language / package anti-pattern policy resolves to SUCCESS.
• Hypatia detection rules to flag this anti-pattern (reusable workflow using github.workflow_sha as ref: for actions/checkout of a non-caller repo) will follow in a separate PR.

Related

• Cascades into ~hundreds of stuck PRs across the estate (CHANGELOG seeding, scorecard wrappers, etc.). Once this lands, the queue drains.
• Separately: at least one repo (.git-private-farm) also has a GitHub Actions spending-limit block that owner needs to clear in Settings → Billing & plans — out of scope for this PR.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 123 issues detected

Severity	Count
🔴 Critical	65
🟠 High	48
🟡 Medium	10

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/changelog-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "changelog-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "elixir-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "elixir-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "rust-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "rust-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence