`.github/workflows/`

The jobs that run on every pull request and every push, and turn "we follow a standard" into a number a reviewer can see without trusting anyone.

What is in here

spec-guard.yml wires the compliance run: self-verify plus the coupling guards, on every pull request. gitleaks.yml scans for secrets on every push to the mainline. standards-update-watch.yml runs weekly and opens one issue when a newer standard exists - it never edits your recorded state, because deciding to move is yours.

The rule that is not stylistic

Every uses: names a full 40-character commit SHA, every runner a fixed version, every Node version exact.

- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
  with:
    node-version: "24.18.0"

A tag is mutable. @v4 today and @v4 next month can be different code, which means the pipeline guarding your repository can change under you with no diff to review. That is the supply-chain problem R21 exists to prevent, and tree-check fails on a loose pin rather than warning about it.

What does not go in here

Your build and test pipeline. It belongs beside these, not inside them. The standard asks that the guards run; it has no opinion about the rest.

Anything needing a secret to decide compliance. A gate a fork cannot run is a gate an outside contributor cannot satisfy, which quietly turns your project into one only maintainers can contribute to.

A job nobody can explain. When you add one, say in the pull request why the check earns its runtime. Unexplained jobs get skipped under deadline, and the skip is permanent.

Decisions behind it

They arrive live, not commented out. Shipping them inert is friendlier for exactly one pull request and produces repositories that carry the files and none of the enforcement, which from the outside is indistinguishable from compliance.
No exception for trusted publishers. "Trusted" describes an account, not a future commit.

What is inside

dashboard.yml - builds the dashboard on every push to main; publishes it only when the repository is public or the build is locked with a password, because Pages on a private repository is served publicly
gitleaks.yml - the secret-scan workflow template
spec-guard.yml - the CI workflow that wires self-verify + both guards - how R16's gate actually runs
standards-update-watch.yml - weekly notification that a newer standard exists - opens one issue per release, never edits the recorded state (ADR-025)