[damaz91]

Description

Hardens .github/workflows/governance.yml for pull_request_target security best practices and pins the central reusable governance workflow to the hardened revision merged in Universal-Commerce-Protocol/.github#84 (97682ca4ad40b4321d60bb58c869e12f19a8bcae):

• Pin reusable governance workflow to hardened commit SHA: Updates uses: to Universal-Commerce-Protocol/.github/.github/workflows/reusable-governance.yml@97682ca4ad40b4321d60bb58c869e12f19a8bcae # main (which removes the unused PR checkout step, eliminates inline expression interpolation via run_governance_gate.py, and checks out central scripts and rules from Universal-Commerce-Protocol/.github at ref: main with persist-credentials: false).
• Least-privilege permissions: Adds top-level permissions: {} and drops contents: read and pull-requests: read from the governance job, leaving only statuses: write to post the Governance / Approvals commit status.
• Protected base branch filtering & Zizmor annotations: Restricts pull_request_target to main and release/** base branches, adds the Apache 2.0 copyright header, and annotates on: # zizmor: ignore[dangerous-triggers] with rationale comments.

Category (Required)

Please select one or more categories that apply to this change.

• Core Protocol: Changes to the base communication layer, global context, or breaking refactors. (Requires Technical Council approval)
• Governance/Contributing: Updates to GOVERNANCE.md, CONTRIBUTING.md, or CODEOWNERS. (Requires Governance Council approval)
• Capability: New schemas (Discovery, Cart, etc.) or extensions. (Requires Maintainer approval)
• Documentation: Updates to README, or documentations regarding schema or capabilities. (Requires Maintainer approval)
• Infrastructure: CI/CD, Linters, or build scripts. (Requires DevOps Maintainer approval)
• Maintenance: Version bumps, lockfile updates, or minor bug fixes. (Requires DevOps Maintainer approval)
• SDK: Language-specific SDK updates and releases. (Requires DevOps Maintainer approval)
• Samples / Conformance: Maintaining samples and the conformance suite. (Requires Maintainer approval)
• UCP Schema: Changes to the ucp-schema tool (resolver, linter, validator). (Requires Maintainer approval)
• Community Health (.github): Updates to templates, workflows, or org-level configs. (Requires DevOps Maintainer approval)

Related Issues

Depends on Universal-Commerce-Protocol/.github#84

Checklist

• I have followed the Contributing Guide (including Conventional Commits title requirements and ! for breaking changes).
• I have updated the documentation (if applicable).
• My changes pass all local linting and formatting checks.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• (For Core/Capability) I have included/updated the relevant JSON schemas.
• I have regenerated Python Pydantic models by running generate_models.sh under python_sdk.

Screenshots / Logs (if applicable)

Verified locally with check_copyright.py and zizmor 1.25.2 --persona=pedantic (0 findings).