fix(ci): restore reachable standards workflow pins

[hyperpolymath]

Replace the unreachable standards reusable-workflow commit 7fdc2705df74b4e352d2a1cde3e87a5923fdf329 with reachable standards main commit 092dedada188f56c5915f74a5fd40aac093742c3. The old SHA is an intermediate commit from squash-merged standards PR #596: it exists, but GitHub rejects it for cross-repository reusable workflows before creating jobs. This restores Hypatia/SARIF and the other affected workflows without weakening SHA pinning or branch protection. Estate incident: 251 active workflow files across 70 repositories in hyperpolymath and metadatastician.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: cbbb36ca-e950-421d-8e6c-3d4849aa01a3

📥 Commits

Reviewing files that changed from the base of the PR and between 5873c19 and e73b931.

📒 Files selected for processing (5)

• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/mirror.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (14)

• GitHub Check: scan / shell-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: rust-ci / Detect Cargo.toml
• GitHub Check: scan / rust-secrets
• GitHub Check: E2E — Full Pipeline + Integration
• GitHub Check: Bench — Type System Performance
• GitHub Check: Groove manifest check
• GitHub Check: Validate A2ML manifests
• GitHub Check: Validate eclexiaiser manifest
• GitHub Check: analyze (actions, none)
• GitHub Check: Aspect — Safety Invariants
• GitHub Check: Validate K9 contracts
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: idris2 --check (ABI proof modules)

🔇 Additional comments (5)

.github/workflows/governance.yml (1)

34-34: LGTM!

.github/workflows/hypatia-scan.yml (1)

28-28: LGTM!

.github/workflows/mirror.yml (1)

14-14: LGTM!

.github/workflows/scorecard.yml (1)

13-13: LGTM!

.github/workflows/secret-scanner.yml (1)

25-25: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the pinned versions of shared governance, scanning, mirroring, supply-chain security, and secret-scanning workflows.
  • Workflow triggers, permissions, concurrency settings, and other behaviour remain unchanged.

Walkthrough

Five GitHub Actions workflows now pin their reusable workflow references to commit 092dedada188f56c5915f74a5fd40aac093742c3. Workflow logic, triggers, permissions, and concurrency settings remain unchanged.

Changes

Reusable workflow pin updates

Layer / File(s)	Summary
Update reusable workflow pins .github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/mirror.yml, .github/workflows/scorecard.yml, .github/workflows/secret-scanner.yml	The reusable workflow references now use commit 092dedada188f56c5915f74a5fd40aac093742c3 instead of 7fdc2705df74b4e352d2a1cde3e87a5923fdf329.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to e73b9

This restores the reusable workflow references to a reachable pinned standards commit without changing workflow logic, triggers, permissions, or concurrency settings. No current merge-blocking risk is identified.

Poem

A rabbit checks each workflow pin
Five fresh hashes now settle in
Governance, scans, and mirrors align
Scorecards follow the same sign
Secret checks hop along the line

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the workflow pin change and its reason, but it omits the required Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections.	Use the repository template. Add the required headings, list the affected workflow changes, complete the RSR Quality Checklist, describe testing or state why it was not run, and add screenshots or terminal output if applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: restoring reachable pinned standards workflows in CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}