fix(ci): repoint codeql-action at a SHA that exists

.github/funding.yml

@@ -0,0 +1,4 @@
+# Funding Configuration
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-custom-fields/displaying-a-sponsor-button-in-your-repository
+
+github: metadatastician

.github/workflows/boj-build.yml

@@ -17,4 +17,5 @@ jobs:
           curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
         continue-on-error: true
 permissions:
+  actions: read
   contents: read

.github/workflows/cargo-audit.yml

@@ -16,6 +16,7 @@ on:
     - cron: '0 6 * * 1'  # Weekly on Monday
 
 permissions: read-all
+  actions: read
 
 jobs:
   audit:

.github/workflows/casket-pages.yml

@@ -7,6 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write

.github/workflows/codeql.yml

@@ -18,6 +18,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
@@ -44,12 +45,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
+        uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
+        uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/dashboard-check.yml

@@ -13,6 +13,7 @@ on:
     branches: [main, master]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/dependabot-automerge.yml

@@ -41,6 +41,7 @@ on:
     types: [opened, reopened, synchronize]
 
 permissions:
+  actions: read
   contents: write        # needed to enable auto-merge
   pull-requests: write   # needed to approve
   # NB: keep narrow — do NOT add secrets: read or id-token: write here.

.github/workflows/dogfood-gate.yml

@@ -13,6 +13,7 @@ on:
     branches: [main, master]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/e2e.yml

@@ -9,6 +9,7 @@ on:
     branches: [main]
 
 permissions: read-all
+  actions: read
 
 jobs:
   rust-build-test:

.github/workflows/governance.yml

@@ -27,6 +27,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/hypatia-scan.yml

@@ -19,6 +19,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
   security-events: write
   pull-requests: write

.github/workflows/instant-sync.yml

@@ -9,6 +9,7 @@ on:
     types: [published]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/mirror.yml

@@ -7,6 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/pages.yml

@@ -5,6 +5,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write

.github/workflows/push-email-notify.yml

@@ -7,6 +7,7 @@ name: Push email notification
 on:
   push: {}
 permissions:
+  actions: read
   contents: read
 jobs:
   notify:

.github/workflows/rust-ci.yml

@@ -10,6 +10,7 @@ on:
   pull_request:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/scorecard.yml

@@ -9,6 +9,7 @@ on:
     branches: [main]
 
 permissions: read-all
+  actions: read
 
 jobs:
   analysis:

.github/workflows/secret-scanner.yml

@@ -11,6 +11,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/semgrep.yml

@@ -11,6 +11,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/workflow-linter.yml

@@ -11,6 +11,7 @@ on:
       - '.github/workflows/**'
 
 permissions: read-all
+  actions: read
 
 jobs:
   lint-workflows:

GOVERNANCE.md

@@ -0,0 +1,60 @@
+# Governance
+
+## Overview
+
+This project is governed by the following principles and structures to ensure transparent, inclusive, and effective decision-making.
+
+## Roles and Responsibilities
+
+### Maintainers
+
+Maintainers are responsible for:
+- Reviewing and merging pull requests
+- Managing releases and versioning
+- Ensuring code quality and standards
+- Triaging issues and bug reports
+- Community engagement and support
+
+### Contributors
+
+Contributors are expected to:
+- Follow the code of conduct
+- Submit well-documented pull requests
+- Write tests for new functionality
+- Maintain existing tests
+- Update documentation as needed
+
+## Decision Making
+
+### Minor Changes
+- Can be made by any maintainer
+- Include bug fixes, documentation updates, dependency updates
+
+### Major Changes
+- Require discussion in issues or pull requests
+- Include new features, architectural changes, API changes
+- Need approval from at least 2 maintainers
+
+### Breaking Changes
+- Require RFC (Request for Comments) process
+- Need approval from majority of maintainers
+- Must include migration guide
+
+## Code of Conduct
+
+All participants are expected to follow our Code of Conduct. Violations can be reported to the maintainers.
+
+## Communication
+
+- **Issues**: For bug reports and feature requests
+- **Discussions**: For questions and general discussion
+- **Pull Requests**: For code contributions
+
+## Licensing
+
+All contributions are made under the terms of the repository's LICENSE file.
+By submitting a pull request, you agree to license your contributions accordingly.
+
+---
+
+*Last updated: 2026-07-18*