feat(governance): add rust-ci-reusable + elixir-ci-reusable workflows

[hyperpolymath]

Why — extends #168 to the next two template-drift bug classes

`#168` (merged) consolidated language-policy into governance-reusable and added deno-ci-reusable. That pattern — single source-of-truth reusable in standards consumed via a thin wrapper — kills the "every copy drifts independently" failure mode.

Estate audit done with `gh api search/code` (2026-05-26):

template	repos	unique SHAs	drift
`rust-ci.yml`	137	30	high
`elixir-ci.yml`	9	9	100%
`rescript-deno-ci.yml`	1+	2+	fixed in #168

`elixir-ci.yml` is especially bad — every copy is unique, and at least one (`bofig`) is YAML-broken with literal `npermissions:` lines from a botched estate sweep.

What changes

Two new reusable workflows in `.github/workflows/`:

`rust-ci-reusable.yml`

• Split jobs: `check` (cargo check + fmt + clippy) and `test` (cargo test). `test` `needs: check`.
• `if: hashFiles('Cargo.toml')` guard on every job so the wrapper is safe to add to non-Rust repos.
• Top-level + per-job `permissions: contents: read`.
• Opt-in inputs:
  • `enable_audit` (default false — `cargo install cargo-audit` adds ~3-4 min per run)
  • `enable_coverage` (default false — tarpaulin + codecov upload)
  • `clippy_args` / `test_args` / `check_args` — per-repo overrides
  • `runs-on`

`elixir-ci-reusable.yml`

• Two-cache layers (`deps` + `_build`), keyed by `elixir-version` + `mix.lock` hash.
• `mix deps.compile` step BEFORE `mix compile --warnings-as-errors` so transitive-dep warnings (e.g. rustler's `:json.decode` requiring Elixir 1.18, deprecated `use Bitwise`) don't fail the strict gate. Validated against tma-mark2 ci(antipattern): fix top-level dir + benchmark/lsp filename matching #41 in commit `fa32c4f`.
• Default `elixir-version: "1.17"` — the `1.15` default in the legacy template produced the `(Mix) … declared in its mix.exs file it supports only Elixir ~> 1.17` error tma-mark2 ci(antipattern): fix top-level dir + benchmark/lsp filename matching #41 lived.
• Opt-in inputs:
  • `enable_dialyzer` (default false — slow cold-cache)
  • `enable_credo` (default true)
  • `otp-version` / `elixir-version` overrides
• Guards every job on `hashFiles('mix.exs')`.

Downstream rollout

After merge, each of the 137 (Rust) / 9 (Elixir) repos can replace its local copy with a 5-line wrapper:

```yaml

.github/workflows/rust-ci.yml

name: Rust CI
on:
push: { branches: [main, master] }
pull_request:
permissions:
contents: read
jobs:
rust-ci:
uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main
```

Same shape as `governance.yml` → `governance-reusable.yml`, and the absolute-zero #41 + tma-mark2 #41 `deno-ci.yml` wrappers landed yesterday. Rollout can be fanned out per-repo.

Test plan

• CI green on this PR (the reusables are workflow_call-only; their content gets exercised via the next PR that adopts them).
• After merge, file 1-2 wrapper PRs against repos with known-red rust-ci CI as smoke tests (e.g., repos in the inbox triage that fail on `Workflow security linter` complaining about missing `permissions:`).
• Confirm `enable_audit: true` works on a repo that opts in.

[github-actions]

🔍 Hypatia Security Scan

Findings: 122 issues detected

Severity	Count
🔴 Critical	64
🟠 High	47
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "elixir-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "elixir-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "rust-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "rust-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence