fix(governance): make ratchets and lock checks fail honestly

[hyperpolymath]

What changed

• grandfather unchanged anonymous Hypatia baseline entries by full JSON-value multiset comparison
• fail new, modified, or duplicated anonymous entries
• allow documentation additions and deletions as debt reduction
• make standards exercise the pull request copy of its exemption-ratchet script while consumers continue using standards main
• accept gh actions-lock output only when its authoritative valid field is true, while preserving every advisory in the log
• fail closed on invalid, malformed, or contradictory action-lock output

Controls

Exemption ratchet:

• 44 unchanged legacy anonymous entries pass
• new, duplicated, and same-size modified anonymous entries fail
• adding documentation and deleting legacy debt pass
• all 14 targeted cases pass

Action lock:

• actual standards lock verifies as valid with advisories and restores workflow bytes
• wrong reusable refs, non-stale invalid findings, malformed output, valid false with no findings, and failed refreshes all fail
• all 9 targeted controls pass

Secret scans, Bash syntax, ShellCheck, and diff checks pass. Actionlint adds no diagnostic beyond the pre-existing job.workflow_sha and quoting findings already present on main.

[coderabbitai]

Warning

Review limit reached

Next included review available in 18 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ff3a8903-4b52-4c0f-aaef-7af8960435a2

📥 Commits

Reviewing files that changed from the base of the PR and between b5e96ee and 2a55bea.

📒 Files selected for processing (6)

• .github/workflows/governance-reusable.yml
• docs/EXEMPTION-MECHANISMS.adoc
• scripts/check-exemption-ratchet.sh
• scripts/tests/actions-lock-update-test.sh
• scripts/tests/exemption-ratchet-test.sh
• scripts/update-actions-lock.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud