From 9e09346de2ac654986733568cd7a9b7c6992ac08 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 27 Oct 2026 02:27:02 +0000
Subject: [PATCH] =?UTF-8?q?ci(hypatia):=20re-sync=20the=20scan=20to=20the?=
 =?UTF-8?q?=20template=20=E2=80=94=20token,=20Dependabot=20scope,=207c10e5?=
 =?UTF-8?q?d=20(Hypatia=20findings,=20part=202)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Takes rsr-template-repo's hypatia-scan.yml as merged in #258 and #261,
byte-identical:

- The scan step gets GITHUB_TOKEN (github.token, scoped to that step), so
  Hypatia's API-backed rules run again instead of returning [] silently.
- The job gains vulnerability-alerts: read for the Dependabot rules.
- The scanner pin moves from d73f76b to 7c10e5d. That version accepts
  LICENSE.adoc and REUSE LICENSES/ (hypatia#963) and no longer requires
  0-AI-MANIFEST.a2ml (hypatia#960).
- The cache key follows HYPATIA_SHA, so a pin bump rebuilds the scanner.
- upload-sarif moves to codeql-action v4.39.1, as the template pins it.

actions.lock is updated to match: hypatia-scan.yml now pins codeql-action
at 9b32540 (v4.39.1), and that pin gets its dependency entry. The v4.38.0
entry stays because the standards reusable workflows still use it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P4yFkxW5Heb8p2YW7ZYs9F
---
 .github/workflows/actions.lock     |  7 ++++++-
 .github/workflows/hypatia-scan.yml | 14 +++++++++++---
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 02efe52..8061b53 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -15,7 +15,7 @@ workflows:
         - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
-        - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63'
+        - 'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370'
     '.github/workflows/label-triage.yml': []
     '.github/workflows/labels.yml': []
     '.github/workflows/mirror.yml':
@@ -93,6 +93,11 @@ dependencies:
         commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
         owner_id: 47606891
         repo_id: 331103973
+    'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370':
+        ref: 'v4.39.1'
+        commit: 'sha1-9b3254085494b55a0f7c4c2b3d2d52cc712ce370'
+        owner_id: 9919
+        repo_id: 259445878
     'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63':
         ref: 'v4.38.0'
         commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index a3ff99d..25a0e82 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -30,8 +30,9 @@ jobs:
     permissions:
       contents: read
       security-events: write
+      vulnerability-alerts: read # Dependabot alerts, for Hypatia's DA rules
     env:
-      HYPATIA_SHA: 'd73f76b5cb7a35e1aa1024c916aee7cb4f9b141e'
+      HYPATIA_SHA: '7c10e5d712af7178f8c175e10a21c5216216c198'
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -53,7 +54,7 @@ jobs:
             ~/hypatia
             ~/.hex
             ~/.mix
-          key: hypatia-sarif-${{ runner.os }}-otp28-elx1194-d73f76b5cb7a35e1aa1024c916aee7cb4f9b141e
+          key: hypatia-sarif-${{ runner.os }}-otp28-elx1194-${{ env.HYPATIA_SHA }}
 
       - name: Build pinned Hypatia scanner
         run: |
@@ -76,6 +77,13 @@ jobs:
 
       - name: Run Hypatia JSON and SARIF analysis
         id: scan
+        env:
+          # The API-backed rules (code-scanning, Dependabot, secret-scanning,
+          # branch-protection, baseline-health) return no findings without a
+          # token. Scoped to this step. The job token reaches code-scanning
+          # (security-events) and Dependabot (vulnerability-alerts) alerts;
+          # it cannot read secret-scanning alerts, which need an App or PAT.
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia-findings.json
@@ -95,7 +103,7 @@ jobs:
 
       - name: Upload Hypatia SARIF to GitHub Code Scanning
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: hypatia.sarif
           category: hypatia