From 9c11ffa55ab1fb4b7fa13341fa516889ac3fbc2e Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 28 Aug 2026 20:08:02 +0100
Subject: [PATCH 1/2] fix(governance): provide lock verifier to consumers

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/governance-reusable.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml
index 284b11e0..95f8cb13 100644
--- a/.github/workflows/governance-reusable.yml
+++ b/.github/workflows/governance-reusable.yml
@@ -1048,7 +1048,9 @@ jobs:
           repository: hyperpolymath/standards
           ref: main
           path: .standards-dupkey
-          sparse-checkout: scripts/check-workflow-duplicate-keys.sh
+          sparse-checkout: |
+            scripts/check-workflow-duplicate-keys.sh
+            scripts/update-actions-lock.sh
           sparse-checkout-cone-mode: false
         # ⚠ Not fatal if the file is absent. This checkout is pinned to
         # standards@main, so during a rename of the script the fetch finds
@@ -1084,6 +1086,11 @@ jobs:
             exit 1
           fi
           cp "$SCRIPT" "$RUNNER_TEMP/dupkeys.sh"
+          # The lockfile gate below runs in a consumer checkout, where the
+          # standards helper is not present. Preserve the canonical helper
+          # before removing this sparse standards checkout.
+          cp .standards-dupkey/scripts/update-actions-lock.sh \
+             "$RUNNER_TEMP/update-actions-lock.sh"
           rm -rf .standards-dupkey
           bash "$RUNNER_TEMP/dupkeys.sh" .github/workflows
 
@@ -1125,7 +1132,7 @@ jobs:
             # external analysers and GitHub's sha_pinning_required setting do
             # not infer direct pins from actions.lock.
             gh extension install github/gh-actions-lock
-            bash scripts/update-actions-lock.sh --verify-local
+            bash "$RUNNER_TEMP/update-actions-lock.sh" --verify-local
             unpinned=$(grep -rnE --include='*.yml' --include='*.yaml' \
               "^[[:space:]]+uses:" .github/workflows/ | \
               grep -v "@[a-f0-9]\{40\}" | \

From b6835b8ce568925cb6f305f967e2b4bf0f1d08d1 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 29 Aug 2026 02:08:32 +0100
Subject: [PATCH 2/2] fix(governance): fail clearly when verifier is
 unavailable

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .github/workflows/governance-reusable.yml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml
index 95f8cb13..f467a11f 100644
--- a/.github/workflows/governance-reusable.yml
+++ b/.github/workflows/governance-reusable.yml
@@ -1089,8 +1089,17 @@ jobs:
           # The lockfile gate below runs in a consumer checkout, where the
           # standards helper is not present. Preserve the canonical helper
           # before removing this sparse standards checkout.
-          cp .standards-dupkey/scripts/update-actions-lock.sh \
-             "$RUNNER_TEMP/update-actions-lock.sh"
+          LOCK_SCRIPT=".standards-dupkey/scripts/update-actions-lock.sh"
+          if [ ! -f "$LOCK_SCRIPT" ] && [ -f scripts/update-actions-lock.sh ]; then
+            LOCK_SCRIPT="scripts/update-actions-lock.sh"
+            echo "Using this repository's own actions-lock verifier (standards self-lint)."
+          fi
+          if [ ! -f "$LOCK_SCRIPT" ]; then
+            echo "::error::actions-lock verifier not found — neither fetched from" \
+                 "standards@main nor present locally."
+            exit 1
+          fi
+          cp "$LOCK_SCRIPT" "$RUNNER_TEMP/update-actions-lock.sh"
           rm -rf .standards-dupkey
           bash "$RUNNER_TEMP/dupkeys.sh" .github/workflows