From 671e460897c5d5835bad27c0c004b42c88f88086 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 12:17:03 +0000 Subject: [PATCH] fix(ci): move the vetted hypatia-ref to aa34a4cc (v0.0.3 actions.lock support) The baseline job and the reusable scan both build Hypatia at the vetted default 51ab6496 (2026-10-01), whose actions.lock parser accepts only v0.0.2. `gh actions-lock` now writes v0.0.3, so the gate reports invalid_actions_lock (workflow_audit + workflow_hardening, high) with {:line, 4, {:unsupported_version, "v0.0.3"}} on main (run 39340237981) and on every open PR. The finding is not baselinable (#1239, #1305) and the lockfile is tool-owned, so the scanner pin is what has to move. aa34a4cc is hypatia main after hypatia#938, which adds v0.0.3 support including its one new field (the optional per-dependency `hostname`). Both defaults move together, as their descriptions require. Blast radius, measured by replaying validate-hypatia-baseline locally at 51ab6496 vs aa34a4cc: on standards, echidna and hypatia the bump only removes findings (invalid_actions_lock and the derived DependencyPinning); no new finding type or severity change. standards' gate goes from 2 kept findings to 0. Every emitted severity stays in hypatia-scan-reusable's accepted set. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01KUZiEB43T3E9fJAXqwbSDm --- .github/workflows/governance-reusable.yml | 2 +- .github/workflows/hypatia-scan-reusable.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml index b041be08d..6fd3393a0 100644 --- a/.github/workflows/governance-reusable.yml +++ b/.github/workflows/governance-reusable.yml @@ -14,7 +14,7 @@ on: default; a floating HEAD here broke every baseline caller when hypatia#895 changed the emitted severity of `warn` findings. type: string - default: 51ab6496bf47e30a0576d503df31fec30f3cfe56 + default: aa34a4cc6ba39d873710ff39763fdb9cde715f9d runs-on: description: Runner label for all governance jobs type: string diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml index 11cadf227..3485eeb56 100644 --- a/.github/workflows/hypatia-scan-reusable.yml +++ b/.github/workflows/hypatia-scan-reusable.yml @@ -20,7 +20,7 @@ on: the default is moved here. type: string required: false - default: 51ab6496bf47e30a0576d503df31fec30f3cfe56 + default: aa34a4cc6ba39d873710ff39763fdb9cde715f9d secrets: HYPATIA_SCAN_PAT: description: >-