[hyperpolymath]

Summary

This moves the template's pinned Hypatia commit from 7c10e5d (#261) to be98f74, the merge commit of hyperpolymath/hypatia#970. It brings in four scanner changes:

• Secret-scanning alerts: fetches follow pagination, time out after 30 s per request, and report an error instead of a truncated list.
• SC-010 (local Scorecard licence check): accepts LICENSE.adoc and REUSE LICENSES/, so it agrees with root hygiene. Before, one scan could report both "licence present" and "No LICENSE file found".
• REUSE LICENSES/: a file counts only if its name is an SPDX identifier (vendored list, SPDX 3.29.0) or a LicenseRef- id. A stray LICENSES/notes.txt no longer passes.
• RE001: now scoped to credentials exposed to code the job cannot vouch for (fix(rules): scope RE001 to credentials exposed to code the job cannot vouch for hypatia#966).

Changes

• .github/workflows/hypatia-scan.yml: HYPATIA_SHA. The cache key follows it.
• .github/workflows/static-analysis-gate.yml: the escript cache key and the fetch.
• .github/workflows/dogfood-gate.yml: the checkout ref and the oracle cache key.

7c10e5d appeared nowhere else in the repository.

RSR Quality Checklist

Required

• Tests pass: this PR's own Hypatia Security Scan, static-analysis-gate and dogfood-gate runs exercise the new pin. Those are the checks that matter here.
• Code is formatted (pin values only; no structural change)
• Linter is clean (all three workflows still parse)
• No banned language patterns
• No unsafe blocks without // SAFETY: comments
• No banned functions
• SPDX licence headers present (unchanged files)
• No secrets, credentials, or .env files included

As Applicable

None apply: this is a pin bump with no change to state, integrations, architecture or dependencies.

Testing

• Every 7c10e5d occurrence is replaced (grep finds none left), and the three workflows parse.
• The new scanner's REUSE and licence behaviour is unit-tested in fix: paginate and time-bound secret-scanning fetches; SC-010 accepts LICENSE.adoc hypatia#970: 84 of 84 pass locally, and CI there was green before merge.
• I could not run the full scan locally, because hex.pm is unreachable from this environment. The scan runs on this PR are the end-to-end check.

Downstream: repositories synced from the template, including echo-types since hyperpolymath/echo-types#356, keep 7c10e5d until they re-sync.

---

Generated by Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T02:54:45.638873Z	b2a1151	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.