From b4f099ac00eb388a0f2118530f8bbd3e49a19345 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 19 Sep 2026 19:22:43 +0000
Subject: [PATCH] =?UTF-8?q?fix(ci):=20call=20the=20estate=20reusables=20by?=
 =?UTF-8?q?=20their=20real=20ref=20=E2=80=94=20these=20never=20parsed?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The six workflows used `uses: ../…/x-reusable.yml`, which GitHub Actions rejects at parse
time: the runs are dead (0 jobs) and named by path rather than by their declared name.
The ref becomes the pinned cross-repo form, and each caller now grants the permissions its
callee declares — without that the repair only moves the failure from parse time to run
time.

Refs hyperpolymath/standards#808.
---
 .github/workflows/codeql.yml         | 6 +++++-
 .github/workflows/governance.yml     | 5 ++++-
 .github/workflows/hypatia-scan.yml   | 6 +++++-
 .github/workflows/mirror.yml         | 5 ++++-
 .github/workflows/scorecard.yml      | 5 ++++-
 .github/workflows/secret-scanner.yml | 2 +-
 6 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d63f446..215fb76 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,6 +18,10 @@ permissions:
 
 jobs:
   analyze-js:
-    uses: ../../.github/workflows/codeql-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     with:
       language: javascript-typescript
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 64ce492..bd68b4c 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -24,4 +24,7 @@ permissions:
 
 jobs:
   governance:
-    uses: ../../.github/workflows/governance-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 4bc2b38..fbd8812 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -17,5 +17,9 @@ permissions:
 
 jobs:
   scan:
-    uses: ../../.github/workflows/hypatia-scan-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index f8cab98..639988a 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -11,5 +11,8 @@ permissions:
 
 jobs:
   mirror:
-    uses: ../../.github/workflows/mirror-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 7a3b590..31924ff 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -20,5 +20,8 @@ permissions:
 
 jobs:
   scorecard:
-    uses: ../../.github/workflows/scorecard-reusable.yml
+    permissions:
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index b3cca40..682b409 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -17,5 +17,5 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: ../../.github/workflows/secret-scanner-reusable.yml
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit