Repository navigation
ci(hypatia): re-sync the scan to the template — token, Dependabot scope, 7c10e5d (Hypatia findings, part 2) - #356
Merged
Conversation
…pe, 7c10e5d (Hypatia findings, part 2) Takes rsr-template-repo's hypatia-scan.yml as merged in #258 and #261, byte-identical: - The scan step gets GITHUB_TOKEN (github.token, scoped to that step), so Hypatia's API-backed rules run again instead of returning [] silently. - The job gains vulnerability-alerts: read for the Dependabot rules. - The scanner pin moves from d73f76b to 7c10e5d. That version accepts LICENSE.adoc and REUSE LICENSES/ (hypatia#963) and no longer requires 0-AI-MANIFEST.a2ml (hypatia#960). - The cache key follows HYPATIA_SHA, so a pin bump rebuilds the scanner. - upload-sarif moves to codeql-action v4.39.1, as the template pins it. actions.lock is updated to match: hypatia-scan.yml now pins codeql-action at 9b32540 (v4.39.1), and that pin gets its dependency entry. The v4.38.0 entry stays because the standards reusable workflows still use it. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01P4yFkxW5Heb8p2YW7ZYs9F
Contributor
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Scan permissions and pinned versions .github/workflows/hypatia-scan.yml |
The workflow grants read access to Dependabot vulnerability alerts and passes github.token to the scan step. It updates the Hypatia commit and cache key, and changes the SARIF upload action pin from v4.38.0 to v4.39.1. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Possibly related issues
- Estate CI repair: the six diseases (lock edges, standards pins, canon pins, UUIDv8, archetype bugs, actions policy), the proven protocol, and the measured who-still-has-what reposystem#319: The workflow pin updates relate to the issue’s stale-pins objective. The available change summary does not show that it resolves the wider synchronisation issue.
Possibly related PRs
- hyperpolymath/echo-types#354: Both PRs update
.github/workflows/hypatia-scan.ymlas part of synchronising the Hypatia workflow with its template.
Merge Risk: 
9e093
-
The workflow permissions and action pins are consistent, with no concrete merge-blocking risk identified.
Pre-merge checks: 
-
Check name Status Explanation Title check The title clearly identifies the CI workflow, the Hypatia scan, and the main synchronisation changes. It is specific and related to the pull request. Description check The description directly explains the Hypatia workflow updates, token permissions, pin changes, cache behaviour, lock-file update, scope limits, and verification. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
|
Add Carrot credits or activate Agent usage billing to use Autofix |
8 tasks done
hyperpolymath
added a commit
to hyperpolymath/rsr-template-repo
that referenced
this pull request
Oct 27, 2026
#262) ## Summary This moves the template's pinned Hypatia commit from `7c10e5d` (#261) to `be98f74`, the merge commit of hyperpolymath/hypatia#970. It brings in four scanner changes: - **Secret-scanning alerts:** fetches follow pagination, time out after 30 s per request, and report an error instead of a truncated list. - **SC-010 (local Scorecard licence check):** accepts `LICENSE.adoc` and REUSE `LICENSES/`, so it agrees with root hygiene. Before, one scan could report both "licence present" and "No LICENSE file found". - **REUSE `LICENSES/`:** a file counts only if its name is an SPDX identifier (vendored list, SPDX 3.29.0) or a `LicenseRef-` id. A stray `LICENSES/notes.txt` no longer passes. - **RE001:** now scoped to credentials exposed to code the job cannot vouch for (hyperpolymath/hypatia#966). ## Changes - `.github/workflows/hypatia-scan.yml`: `HYPATIA_SHA`. The cache key follows it. - `.github/workflows/static-analysis-gate.yml`: the escript cache key and the fetch. - `.github/workflows/dogfood-gate.yml`: the checkout `ref` and the oracle cache key. `7c10e5d` appeared nowhere else in the repository. ## RSR Quality Checklist ### Required - [x] Tests pass: this PR's own `Hypatia Security Scan`, `static-analysis-gate` and `dogfood-gate` runs exercise the new pin. Those are the checks that matter here. - [x] Code is formatted (pin values only; no structural change) - [x] Linter is clean (all three workflows still parse) - [x] No banned language patterns - [x] No `unsafe` blocks without `// SAFETY:` comments - [x] No banned functions - [x] SPDX licence headers present (unchanged files) - [x] No secrets, credentials, or `.env` files included ### As Applicable None apply: this is a pin bump with no change to state, integrations, architecture or dependencies. ## Testing - Every `7c10e5d` occurrence is replaced (`grep` finds none left), and the three workflows parse. - The new scanner's REUSE and licence behaviour is unit-tested in hyperpolymath/hypatia#970: 84 of 84 pass locally, and CI there was green before merge. - I could not run the full scan locally, because hex.pm is unreachable from this environment. The scan runs on this PR are the end-to-end check. **Downstream:** repositories synced from the template, including echo-types since hyperpolymath/echo-types#356, keep `7c10e5d` until they re-sync. --- _Generated by [Claude Code](https://claude.ai/code/session_01P4yFkxW5Heb8p2YW7ZYs9F)_ Co-authored-by: Claude <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part 2 of fixing the Hypatia findings on echo-types. Part 1 (#354) took the template's
hypatia-scan.ymlas it stood then. That version silently dropped every API-backed rule, because it passed the scanner no token. The fix went into the template first (hyperpolymath/rsr-template-repo#258 and #261). This PR takes the merged result, byte-identical.GITHUB_TOKEN: ${{ github.token }}, scoped to that step[]without a token. It isgithub.token, notsecrets.*, so RE001 stays clear.vulnerability-alerts: readon the jobsecurity-events: writecovers only code scanning.HYPATIA_SHAd73f76b→7c10e5dLICENSE.adocand REUSELICENSES/(hyperpolymath/hypatia#963). It no longer demands0-AI-MANIFEST.a2ml(hyperpolymath/hypatia#960).…-${{ env.HYPATIA_SHA }}upload-sarifmoves to codeql-action v4.39.1 (9b32540)actions.lockis updated to match.hypatia-scan.ymlnow lists codeql-action at9b32540, and that pin has its dependency entry. The v4.38.0 entry stays, because themetadatastician/standardsreusable workflows still pin it.What this does not cover
GITHUB_TOKENpermission can read them, so the per-repo scan never sees them. The workflow comment says so. They will come from a separate, private estate-wide sweep with a dedicated read-only token, not from this repository.Verification
hypatia-scan.ymliscmp-identical torsr-template-repo@4f4536e. That file passed GitHub-workflow schema validation and the template's CI in docs(proof-debt): refresh stale variance bullet — resolved by wired EchoVariance (#243) #258 and proof(entropy): entropy-blind-parametric — parametric-distribution non-distinguishing #261.actions.lockparses, and itshypatia-scan.ymllist now names exactly the four pins the workflow uses.gh actions-lockhere. The lock edit mirrors the format that tool writes, and this PR's CI run is the check that matters.Generated by Claude Code