ci(architecture-enforcement): hypatia-scan missing sibling-repo checkout #12

Problem

architecture-enforcement.yml's hypatia-scan job fails at the first run-step with:

##[error]An error occurred trying to start process '/usr/bin/bash' with working directory
'/home/runner/work/proven/proven/../hypatia/elixir-scanner'. No such file or directory

The workflow assumes a sibling-repo checkout layout (proven and hypatia checked out side-by-side under work/), but there's no actions/checkout step for hypatia — so the directory doesn't exist.

This has been failing on main since at least 2026-03-29 (entire workflow history on main is red on this job).

Proposed fix

Add a second checkout step before the Setup Elixir step:

- name: Checkout hypatia
  uses: actions/checkout@<sha> # v4
  with:
    repository: hyperpolymath/hypatia
    path: ../hypatia
    fetch-depth: 1

actions/checkout's path is relative to $GITHUB_WORKSPACE, so this lands hypatia at work/proven/../hypatia — exactly where the next steps expect it.

Caveat: actions/checkout strictly only allows checking out under GITHUB_WORKSPACE. If hypatia must live in a sibling directory, the workflow needs to either cd ..; git clone … manually OR change the working-directory references to a path inside GITHUB_WORKSPACE (e.g. hypatia/elixir-scanner).

Out of scope here

Whether the hypatia scanner should gate proven's CI at all is a separate question. The current rule is "block any critical/high finding"; if hypatia is in flux, this may want to be advisory rather than blocking.

Background

Surfaced while triaging the 6-week CI rot. See PR #10.