Repository navigation
Finish re-pin for 14 strict-ruleset consumers (need signed-commit propagation) #324
Description
Follow-up to the 2026-06-27 estate reusable re-pin sweep (hyperpolymath/hypatia#464). 327 consumers were re-pinned to standards HEAD d7c22711 and merged. These 14 could not be done from the cloud session — their repository rulesets require verified-signature commits (plus PR-only + code-scanning), and the agent proxy permits git (the only signed-commit path) for in-scope repos only, so the unsigned Contents-API write is rejected (Repository rule violations: commits must have verified signatures):
aggregate-library, epistemic-types, intsoc-transactor, JuliaKids.jl, k9-validate-action, laniakea, live-files, manifesto, network-ambulance, odds-and-sods-package-manager, rsr-template-repo, trope-particularity-workbench, typefix-zero, veridical-simulation-core
Completion
The .git-private-farm sha-bump-propagate.yml farm sweep GPG-signs its commits → satisfies these rulesets in one pass; it needs Actions billing restored first (hyperpolymath/.git-private-farm#98). Otherwise: a manual signed re-pin per repo (hypatia-scan / governance / scorecard reusables → @d7c22711, and drop any retired scorecard-enforcer.yml).
hyperpolymath/007(All-Rights-Reserved) is deliberately excluded per estate licence policy.
Refs: hyperpolymath/hypatia#464, hyperpolymath/.git-private-farm#98.
Activity
hyperpolymath commentedon Jul 20, 2026
The "drop any retired
scorecard-enforcer.yml" line here has a broader sibling worth folding in: consumer repos with an inlinescorecard.ymlthat uploads SARIF to code-scanning tripgovernance / Check Workflow Stalenessruleno_scorecard_sarif_code_scanning. Canonical fix (perrsr-template-repo) replaces the inline job with a call tostandards/.github/workflows/scorecard-reusable.yml@<sha>(+permissions: contents: read, security-events: write, id-token: write). Same signed-commit re-pin constraint as the 14 here.Retired
scorecard-enforcer.ymlstill present (2026-07-18 snapshot, re-verify with afind/grepsweep): live-files, manifesto, reasonably-good-token-vault. Recording as concrete targets.Provenance: session aa0b2861, estate CI/CD cleanup campaign.