ci(pipeline): re-pin ci-pipeline.yml to standards#989 squash SHA ed5e3f65

[hyperpolymath]

What

Re-pins this repository's standards-pipeline.yml caller from 2eb9bb19 to
f95130bb — the squash merge of hyperpolymath/standards#985.

Why

2eb9bb19 predates #985, which fixed the ci-pipeline detect gate. Every caller
still on the old pin runs the pre-fix gate. The workflow is pull_request-triggered
only, so the failure is latent: it does not manifest until the next PR is opened here.

What moves

Two lines, together:

Line	From	To
provenance comment	@ 2eb9bb19 — ci-pipeline.yml blob d2583657.	@ f95130bb — ci-pipeline.yml blob 8bcdeaf2.
uses: ref	...ci-pipeline.yml@2eb9bb19...	...ci-pipeline.yml@f95130bb...

A SHA bump that leaves the blob comment behind is a phantom pin — it names a tree
it can no longer be checked against — so both change or neither does.

Why f95130bb and not current main

main has since moved to d1bd7f42 (#988, a changelog fix). f95130bb was chosen
deliberately:

• ci-pipeline.yml is byte-identical at both — blob 8bcdeaf2 either way.
• f95130bb is the reviewed revision: the commit #985 was merged as.
• Its only failing checks are SonarCloud Code Analysis and the mirror trio
  (mirror-gitea, mirror-disroot, mirror-codeberg) — all four are listed in
  standards' own config/rulesets/gates.json under never_required_workflows.
  Nothing ci-pipeline-related is red there.

ci-pipeline.yml pins its own sub-reusables fully-qualified at 571cc734 rather than
./, so this pin selects only which ci-pipeline.yml is read — not its dependencies.

Verification

• Pre-flight refused to edit unless the exact pre-fix SHA and the expected
  provenance-comment shape were both present.
• Post-flight asserted exactly 2/2 changed lines, no residue of 2eb9bb19 or
  d2583657, and the new SHA present.
• Commit is SSH-signed (%G? = G).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 86b445d5-9a12-4716-aa66-f6e0b8cc76a1

📥 Commits

Reviewing files that changed from the base of the PR and between bde8614 and be2b085.

📒 Files selected for processing (1)

• .github/workflows/standards-pipeline.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (23)

• GitHub Check: pipeline / Secret scanning / shell-secrets
• GitHub Check: pipeline / Secret scanning / rust-secrets
• GitHub Check: pipeline / Secret scanning / gitleaks
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: pipeline / SAST (semgrep)
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: pipeline / Detect ecosystems
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Guix primary / Nix fallback policy
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Workflow security linter
• GitHub Check: scan / gitleaks
• GitHub Check: spark-theatre-gate / SPARK Theatre Gate
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / rust-secrets
• GitHub Check: build
• GitHub Check: lint-workflows
• GitHub Check: analyze (actions, none)
• GitHub Check: lint-workflows

🔇 Additional comments (1)

.github/workflows/standards-pipeline.yml (1)

36-36: LGTM!

Also applies to: 42-42

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the standards pipeline to use a newer, immutable workflow revision.
  • Updated the associated reference information for the revised workflow.
  • This keeps automated standards checks aligned with the selected workflow version and improves the reliability of future pipeline runs.

Walkthrough

The standards pipeline now invokes the shared CI workflow at commit ed5e3f651305dd1ce0d0b5d2d08b97a963634632. The accompanying comment references commit ed5e3f65 and blob ea87c43a.

Changes

Standards workflow update

Layer / File(s)	Summary
Update standards workflow pin .github/workflows/standards-pipeline.yml	The pipeline job uses the new immutable commit. The comment now references commit ed5e3f65 and blob ea87c43a.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to be2b0

The pin update is ready to merge with no identified correctness or availability risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the workflow pin update and names the target standards revision. It matches the main change.
Description check	✅ Passed	The description explains the workflow pin update, provenance comment, rationale, and verification. It is relevant, but it refers to the superseded SHA f95130bb rather than the final SHA ed5e3f65 shown…

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the pipeline line
A newer pin now holds it fine
The commit stays fixed and clear
The workflow follows without fear
The comment matches what is near}

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

⛔ Do not merge — superseded by hyperpolymath/standards#989

Converted to draft to keep it out of the merge queue. This is reversible:
gh pr ready <N> restores it.

This PR re-pins ci-pipeline.yml to f95130bb, which predates #989 and carries
both defects #989 cures. Measured, not assumed:

$ gh api repos/hyperpolymath/standards/contents/.github/workflows/ci-pipeline.yml \
    ?ref=f95130bbcbc8917bfec8f8875fa810ad93b08871 --jq .content | base64 -d \
  | grep -nE '^\s+ref:|exit 1|refused'
949:          ref: a2ff696a      # unfetchable abbreviated SHA — the ledger checkout fails
270:              exit 1         # detect's own hard refusal — two judges, not one
(refused: 0 occurrences — no `refused` output at this SHA)

Merging this would move the caller from a stale-but-latent 2eb9bb19 pin to a callee
where the exemption ledger fetch fails, is swallowed by continue-on-error, is
treated as empty, and then fails closed — while detect exits 1 regardless. The
refusing pilots go red again, for no gain, in either merge order.

Correct sequence: merge #989 first, then retarget this PR to #989's squash SHA
(tracked as the re-pin wave, one caller first so the squash SHA is exercised before
the other four follow).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

[coderabbitai]

✅ Coding Agent task started: View task and status

The task will inspect the CI failures, validate its fix, and commit the fix to this branch automatically.

Note: Fixing CI failures is a beta feature and may encounter errors. Expect some limitations and changes as we gather feedback and continue to improve it.