Repository navigation
ci(hypatia): bump the pinned scanner to 7c10e5d in all three workflows - #261
Merged
Merged
Conversation
d73f76b predates hypatia#960 (repo deed accepted as the AI manifest) and hypatia#963 (LICENSE.adoc and REUSE LICENSES/ accepted as the licence). Under it the template raised a critical "Required file missing: LICENSE" and a high 0-AI-MANIFEST finding, failing the zero-critical gate. The same SHA is pinned in hypatia-scan.yml, static-analysis-gate.yml and dogfood-gate.yml; all three move together. hypatia-scan.yml's cache key reads HYPATIA_SHA, so it follows automatically; the other two carry the SHA in their keys and are updated in place. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P4yFkxW5Heb8p2YW7ZYs9F
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 12 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
hyperpolymath
marked this pull request as ready for review
October 27, 2026 02:19
hyperpolymath
enabled auto-merge (squash)
October 27, 2026 02:19
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
hyperpolymath
disabled auto-merge
October 27, 2026 02:21
hyperpolymath
enabled auto-merge (squash)
October 27, 2026 02:21
8 tasks done
hyperpolymath
added a commit
that referenced
this pull request
Oct 27, 2026
#262) ## Summary This moves the template's pinned Hypatia commit from `7c10e5d` (#261) to `be98f74`, the merge commit of hyperpolymath/hypatia#970. It brings in four scanner changes: - **Secret-scanning alerts:** fetches follow pagination, time out after 30 s per request, and report an error instead of a truncated list. - **SC-010 (local Scorecard licence check):** accepts `LICENSE.adoc` and REUSE `LICENSES/`, so it agrees with root hygiene. Before, one scan could report both "licence present" and "No LICENSE file found". - **REUSE `LICENSES/`:** a file counts only if its name is an SPDX identifier (vendored list, SPDX 3.29.0) or a `LicenseRef-` id. A stray `LICENSES/notes.txt` no longer passes. - **RE001:** now scoped to credentials exposed to code the job cannot vouch for (hyperpolymath/hypatia#966). ## Changes - `.github/workflows/hypatia-scan.yml`: `HYPATIA_SHA`. The cache key follows it. - `.github/workflows/static-analysis-gate.yml`: the escript cache key and the fetch. - `.github/workflows/dogfood-gate.yml`: the checkout `ref` and the oracle cache key. `7c10e5d` appeared nowhere else in the repository. ## RSR Quality Checklist ### Required - [x] Tests pass: this PR's own `Hypatia Security Scan`, `static-analysis-gate` and `dogfood-gate` runs exercise the new pin. Those are the checks that matter here. - [x] Code is formatted (pin values only; no structural change) - [x] Linter is clean (all three workflows still parse) - [x] No banned language patterns - [x] No `unsafe` blocks without `// SAFETY:` comments - [x] No banned functions - [x] SPDX licence headers present (unchanged files) - [x] No secrets, credentials, or `.env` files included ### As Applicable None apply: this is a pin bump with no change to state, integrations, architecture or dependencies. ## Testing - Every `7c10e5d` occurrence is replaced (`grep` finds none left), and the three workflows parse. - The new scanner's REUSE and licence behaviour is unit-tested in hyperpolymath/hypatia#970: 84 of 84 pass locally, and CI there was green before merge. - I could not run the full scan locally, because hex.pm is unreachable from this environment. The scan runs on this PR are the end-to-end check. **Downstream:** repositories synced from the template, including echo-types since hyperpolymath/echo-types#356, keep `7c10e5d` until they re-sync. --- _Generated by [Claude Code](https://claude.ai/code/session_01P4yFkxW5Heb8p2YW7ZYs9F)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The template pins Hypatia at
d73f76b. That version predates two fixes:<repo>_chora.deedas the AI manifest hypatia#960: accepts the repo deed<repo>_chora.deedas the AI manifest.LICENSE.adocand REUSELICENSES/as the licence.Under the old pin the template raised a critical "Required file missing: LICENSE" and a high
0-AI-MANIFESTfinding, so the zero-critical gate in the Hypatia Security Scan and the Static Analysis Gate failed. This was the bump promised in #258.Changes
d73f76bto Hypatiamainat7c10e5d, which includes #960, #963 and #969.hypatia-scan.yml(HYPATIA_SHA),static-analysis-gate.ymlanddogfood-gate.yml.hypatia-scan.yml's cache key readsHYPATIA_SHAsince fix(ci): give the Hypatia scan a token; accept LICENSE.adoc in the OpenSSF check #258, so it follows on its own.Testing
7c10e5d: I ran the rule against this repo's root and it returns no findings. Atd73f76bit returned the critical and the high.actions.lockis unaffected, because this SHA is a git ref, not an action pin.Follow-up
hyperpolymath/hypatia#970 (open) makes SC-010, a Low-severity finding that doesn't block, accept
LICENSE.adoc. It also adds pagination and a timeout to the secret-scanning sweep. Once it merges, a second small bump picks it up.Generated by Claude Code