fix(ci): close the governance gate — SPDX, permissions, SHA pins, reu…

fix(ci): close the governance gate — SPDX, permissions, SHA pins, reu… #149