From 95249e88ac4a6304f30a696a787b81ab855e2db7 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 12 Aug 2026 01:10:24 +0100
Subject: [PATCH] fix(ci): resolve Scorecard startup_failure and zero-job
 workflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes for issue #693:

1. scorecard.yml: Add missing actions: read to job-level permissions block
   and update SHA from bd0df9e to d7c2271

2. clusterfuzzlite.yml: Fix workflow_dispatch: null → workflow_dispatch:
   and quote cron expression: 0 2 * * 0 → '0 2 * * 0'

3. security-policy.yml: Fix workflow_dispatch: null → workflow_dispatch:
   and quote cron expressions: 0 2 * * * → '0 2 * * *', 0 3 * * 1 → '0 3 * * 1'

4. Update all reusable workflow SHA pins to current:
   - governance-reusable: bd0df9e → 7fdc270
   - hypatia-scan-reusable: bd0df9e → 7fdc270
   - mirror-reusable: bd0df9e → 7fdc270
   - secret-scanner-reusable: bd0df9e → db12a6a

5. Fix workflow_dispatch: null in merge-orchestrate.yml, quality.yml,
   release.yml, tests.yml, verify-proofs.yml

6. Quote unquoted cron expressions in merge-orchestrate.yml, tests.yml,
   verify-proofs.yml

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
---
 .github/workflows/clusterfuzzlite.yml   | 4 ++--
 .github/workflows/governance.yml        | 2 +-
 .github/workflows/hypatia-scan.yml      | 2 +-
 .github/workflows/merge-orchestrate.yml | 4 ++--
 .github/workflows/mirror.yml            | 2 +-
 .github/workflows/quality.yml           | 2 +-
 .github/workflows/release.yml           | 2 +-
 .github/workflows/scorecard.yml         | 3 ++-
 .github/workflows/secret-scanner.yml    | 2 +-
 .github/workflows/security-policy.yml   | 6 +++---
 .github/workflows/tests.yml             | 4 ++--
 .github/workflows/verify-proofs.yml     | 4 ++--
 12 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/clusterfuzzlite.yml b/.github/workflows/clusterfuzzlite.yml
index cddb050f..e96eb825 100644
--- a/.github/workflows/clusterfuzzlite.yml
+++ b/.github/workflows/clusterfuzzlite.yml
@@ -12,8 +12,8 @@ on:
     - crates/**
     - fuzz/**
   schedule:
-  - cron: 0 2 * * 0
-  workflow_dispatch: null
+  - cron: '0 2 * * 0'
+  workflow_dispatch:
 
 permissions: read-all
 
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index f8287c85..9311164e 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -16,4 +16,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 712a0eb8..22dab2ba 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -21,5 +21,5 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit
diff --git a/.github/workflows/merge-orchestrate.yml b/.github/workflows/merge-orchestrate.yml
index cc5b1586..b20748fb 100644
--- a/.github/workflows/merge-orchestrate.yml
+++ b/.github/workflows/merge-orchestrate.yml
@@ -16,10 +16,10 @@
 name: Merge Orchestrate (scheduled)
 
 on:
-  workflow_dispatch: null
+  workflow_dispatch:
   schedule:
   # Hourly, offset off the top of the hour to dodge runner congestion.
-  - cron: 17 * * * *
+  - cron: '17 * * * *'
 
 concurrency:
   group: ${{ github.workflow }}
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index a4020d7d..8385e690 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -14,5 +14,5 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 093aefcb..12cb18d2 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -8,7 +8,7 @@ name: Docs & Code Quality
 on:
   push: null
   pull_request: null
-  workflow_dispatch: null
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ebf04a81..c7004384 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,7 @@ name: Release & Container
 
 on:
   push: null
-  workflow_dispatch: null
+  workflow_dispatch:
 
 permissions: read-all
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 55491e95..224445f2 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -18,8 +18,9 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
     permissions:
+      actions: read
       contents: read
       security-events: write
       id-token: write
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index d2053ce6..60e7f591 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -21,5 +21,5 @@ jobs:
       contents: read
       pull-requests: write
       actions: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a
     secrets: inherit
diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml
index 3d50375b..9499546a 100644
--- a/.github/workflows/security-policy.yml
+++ b/.github/workflows/security-policy.yml
@@ -15,9 +15,9 @@ on:
     - develop
     - main
   schedule:
-  - cron: 0 2 * * *
-  - cron: 0 3 * * 1
-  workflow_dispatch: null
+  - cron: '0 2 * * *'
+  - cron: '0 3 * * 1'
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 37641a33..934ef841 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -10,12 +10,12 @@ on:
     branches:
     - main
   pull_request: null
-  workflow_dispatch: null
+  workflow_dispatch:
   schedule:
   # Daily 03:00 UTC — covers Mondays too. The Monday-only `0 3 * * 1`
   # cron from the pre-consolidation tests was a subset of the daily one
   # and was dropped to stop running this workflow twice on Mondays.
-  - cron: 0 3 * * *
+  - cron: '0 3 * * *'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/verify-proofs.yml b/.github/workflows/verify-proofs.yml
index bfa58f35..d0f36b03 100644
--- a/.github/workflows/verify-proofs.yml
+++ b/.github/workflows/verify-proofs.yml
@@ -37,8 +37,8 @@ on:
   # 04:30, 05:00) were inherited from the pre-consolidation
   # verify-{idris,lean,tlaplus}.yml workflows and fired the now-merged
   # workflow three times every Monday. Collapsed to one.
-  - cron: 0 4 * * 1
-  workflow_dispatch: null
+  - cron: '0 4 * * 1'
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}