Repository navigation
fix: Hypatia high-finding remediation, drop vacuous rust-ci, fix CLADE identity - #47
Conversation
… identity Hypatia triage (8 high dedupe to 4 real): - build/setup.sh DELETED: orphaned rsr-template residue (self-describes as the template's setup script, nothing references it) carrying 3 curl|sh download-and-execute sites (CWE-494) - instant-sync.yml: gate the dispatch step on FARM_DISPATCH_TOKEN presence via step-level env (job-level secret if: is a parse killer) - scorecard.yml: grant the reusable job security-events/id-token write; a reusable needing more perms than the caller is a startup_failure - src/interface/ffi/src/main.zig @ptrCast/@aligncast: ACCEPTED, not changed — idiomatic opaque-handle pattern at the C ABI boundary rust-ci.yml DELETED: vacuous green — no Cargo.toml exists anywhere, so it passed by building nothing (and its standards reusable is currently enforcement-dead anyway). CLADE.a2ml: canonical-name/prefixed-name/forges were still the rsr-template's (template-self-name leak). Set to haec; the uuid remains the template's with a TODO — a real one must come from gv-clade-index, not be invented here. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedRemediates Hypatia high findings by removing orphaned setup scripts, adding secret presence gates, and setting scorecard permissions, alongside removing the vacuous rust-ci workflow and fixing CLADE identity. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 7 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
Completes the CLADE.a2ml identity fix from #47: the registry already holds haec's deterministic-v5 entry (`90db7939-1d8d-5fec-9dbf-f2674b7818f5`), so the template's UUID placeholder can go. Clade reclassification `rm` → `fv` (secondary `nl`) is proposed in hyperpolymath/gv-clade-index#58 — the UUID is name-derived and independent of that decision; the clade/prefixed fields here follow whatever the registry rules. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Hypatia triage (the 8 highs deduplicate to 4 real issues)
build/setup.shcurl|sh ×3 (CWE-494)instant-sync.ymlsecret without presence gateFARM_DISPATCH_TOKEN(stepenv:— a job-level secretif:is a parse-time startup_failure)scorecard.ymlmissing job permissionssecurity-events/id-tokenwrite; requesting more than the caller grants is a startup_failurepermissions:addedmain.zig@ptrCast/@alignCastHandle⇄HandleState); the cast is the mechanism, not a defectThe 61 mediums are dominated (42) by
unpinned_actionnoise from the workflow_audit rule not knowing the actions.lock model — a Hypatia-side follow-up, not repo defects.Also
rust-ci.ymldeleted: vacuous green — there is noCargo.tomlanywhere in the repo, so it passed by building nothing (no-fake-gates doctrine).CLADE.a2ml:canonical-name/prefixed-name/[forges]still declaredrsr-template-repo(template-self-name leak). Nowhaec.uuidis still the template's — left with a TODO because a real entry must be assigned fromgv-clade-index; inventing one would corrupt the registry. Owner action required.🤖 Generated with Claude Code