chore(ci): prune CI noise — single governance wrapper (#59)

[hyperpolymath]

Closes #59.

What

Replaces 8 per-repo governance workflow copies with one wrapper (governance.yml) that calls the shared reusable bundle in hyperpolymath/standards (companion PR hyperpolymath/standards#81).

Deleted (now provided by the shared bundle, consolidated to 6 jobs):
quality, guix-nix-policy, npm-bun-blocker, ts-blocker, security-policy, rsr-antipattern, wellknown-enforcement, workflow-linter

Kept standalone:

• Load-bearing: rust-ci, codeql, dependabot-automerge, release
• Repo-specific gates: dogfood-gate, static-analysis-gate
• Security/plumbing (side-effecting or no PR noise): secret-scanner, hypatia-scan, scorecard, scorecard-enforcer, mirror, instant-sync, boj-build, casket-pages, rhodibot

Net: 23 → 15 workflows. Per-PR governance check surface goes from ~8 separate workflows down to 1 wrapper.

Acceptance (issue #59)

• Required-check count documented: main has no branch protection → 0 required status checks. Nothing currently blocks PRs; the issue's "drop required checks" premise was already satisfied at zero. The real problem was visual/CI-minute noise, addressed here.
• Optional-check noise visible but not blocking: governance still runs (push to main + PR + dispatch) as one non-blocking wrapper; load-bearing build/security remain individually visible.

Ordering

Depends on hyperpolymath/standards#81 — merge that first; the governance job resolves @main and goes green once the reusable workflow exists. Until then the wrapper is the only governance entry and is non-blocking (no branch protection).

Follow-up (out of scope here)

Rolling this caller out estate-wide, and an optional decision to enable branch protection requiring just rust-ci + codeql, are separate items.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 21 issues detected

Severity	Count
🔴 Critical	2
🟠 High	8
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Required file missing",
    "type": "missing",
    "file": "SECURITY.md",
    "action": "create",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action Swatinem/rust-cache@v2 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-toolchain@master needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action Swatinem/rust-cache@v2 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Required file missing (condition: public_repo)",
    "type": "missing_requirement",
    "file": "SECURITY.md",
    "action": "create",
    "rule_module": "cicd_rules",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence