Skip to content

fix(ci): checkout the event SHA in governance jobs (re-enable PR-time enforcement) #442

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 1 commit into from
Jun 27, 2026
Merged

fix(ci): checkout the event SHA in governance jobs (re-enable PR-time enforcement) #442

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
80 changes: 72 additions & 8 deletions .github/workflows/governance-reusable.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,15 @@ jobs:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
repository: ${{ github.repository }}
ref: ${{ github.ref }}
# Pin to the concrete event SHA (the PR merge commit on
# pull_request, the pushed commit on push). Do NOT use
# `ref: ${{ github.ref }}`: in a reusable workflow called from a
# pull_request, github.ref is the named merge ref
# `refs/pull/<n>/merge`, which actions/checkout cannot fetch
# ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
# governance jobs on every PR estate-wide. github.sha resolves to the
# same merge commit but is always fetchable.
ref: ${{ github.sha }}

# Estate language policy bans Python with no exceptions (CLAUDE.md
# Language Policy; SaltStack exception removed 2026-01-03). The
Expand Down Expand Up @@ -464,7 +472,15 @@ jobs:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
repository: ${{ github.repository }}
ref: ${{ github.ref }}
# Pin to the concrete event SHA (the PR merge commit on
# pull_request, the pushed commit on push). Do NOT use
# `ref: ${{ github.ref }}`: in a reusable workflow called from a
# pull_request, github.ref is the named merge ref
# `refs/pull/<n>/merge`, which actions/checkout cannot fetch
# ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
# governance jobs on every PR estate-wide. github.sha resolves to the
# same merge commit but is always fetchable.
ref: ${{ github.sha }}
- name: Enforce Guix primary / Nix fallback
run: |
HAS_GUIX=$(find . -name "*.scm" -o -name ".guix-channel" -o -name "guix.scm" 2>/dev/null | head -1)
Expand Down Expand Up @@ -492,7 +508,15 @@ jobs:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
repository: ${{ github.repository }}
ref: ${{ github.ref }}
# Pin to the concrete event SHA (the PR merge commit on
# pull_request, the pushed commit on push). Do NOT use
# `ref: ${{ github.ref }}`: in a reusable workflow called from a
# pull_request, github.ref is the named merge ref
# `refs/pull/<n>/merge`, which actions/checkout cannot fetch
# ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
# governance jobs on every PR estate-wide. github.sha resolves to the
# same merge commit but is always fetchable.
ref: ${{ github.sha }}
- name: Security checks
run: |
FAILED=false
Expand Down Expand Up @@ -723,7 +747,15 @@ jobs:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
repository: ${{ github.repository }}
ref: ${{ github.ref }}
# Pin to the concrete event SHA (the PR merge commit on
# pull_request, the pushed commit on push). Do NOT use
# `ref: ${{ github.ref }}`: in a reusable workflow called from a
# pull_request, github.ref is the named merge ref
# `refs/pull/<n>/merge`, which actions/checkout cannot fetch
# ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
# governance jobs on every PR estate-wide. github.sha resolves to the
# same merge commit but is always fetchable.
ref: ${{ github.sha }}
- name: Check file permissions
run: |
find . -type f -perm /111 -name "*.sh" | head -10 || true
Expand Down Expand Up @@ -772,7 +804,15 @@ jobs:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
repository: ${{ github.repository }}
ref: ${{ github.ref }}
# Pin to the concrete event SHA (the PR merge commit on
# pull_request, the pushed commit on push). Do NOT use
# `ref: ${{ github.ref }}`: in a reusable workflow called from a
# pull_request, github.ref is the named merge ref
# `refs/pull/<n>/merge`, which actions/checkout cannot fetch
# ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
# governance jobs on every PR estate-wide. github.sha resolves to the
# same merge commit but is always fetchable.
ref: ${{ github.sha }}
- name: RFC 9116 security.txt validation
run: |
SECTXT=""
Expand Down Expand Up @@ -830,7 +870,15 @@ jobs:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
repository: ${{ github.repository }}
ref: ${{ github.ref }}
# Pin to the concrete event SHA (the PR merge commit on
# pull_request, the pushed commit on push). Do NOT use
# `ref: ${{ github.ref }}`: in a reusable workflow called from a
# pull_request, github.ref is the named merge ref
# `refs/pull/<n>/merge`, which actions/checkout cannot fetch
# ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
# governance jobs on every PR estate-wide. github.sha resolves to the
# same merge commit but is always fetchable.
ref: ${{ github.sha }}
- name: Check SPDX headers + permissions
run: |
failed=0
Expand Down Expand Up @@ -874,7 +922,15 @@ jobs:
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
repository: ${{ github.repository }}
ref: ${{ github.ref }}
# Pin to the concrete event SHA (the PR merge commit on
# pull_request, the pushed commit on push). Do NOT use
# `ref: ${{ github.ref }}`: in a reusable workflow called from a
# pull_request, github.ref is the named merge ref
# `refs/pull/<n>/merge`, which actions/checkout cannot fetch
# ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
# governance jobs on every PR estate-wide. github.sha resolves to the
# same merge commit but is always fetchable.
ref: ${{ github.sha }}
path: caller
- name: Checkout standards (for the check script)
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
Expand All @@ -897,7 +953,15 @@ jobs:
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
repository: ${{ github.repository }}
ref: ${{ github.ref }}
# Pin to the concrete event SHA (the PR merge commit on
# pull_request, the pushed commit on push). Do NOT use
# `ref: ${{ github.ref }}`: in a reusable workflow called from a
# pull_request, github.ref is the named merge ref
# `refs/pull/<n>/merge`, which actions/checkout cannot fetch
# ("couldn't find remote ref refs/pull/<n>/merge") — it broke 8/10
# governance jobs on every PR estate-wide. github.sha resolves to the
# same merge commit but is always fetchable.
ref: ${{ github.sha }}
path: caller
- name: Checkout standards (for the check script)
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
Expand Down
Loading