Repository navigation
fix(ci): pass hypatia-ref aa34a4c to the standards scanner reusables - #940
Merged
Merged
Conversation
Governance's Validate Hypatia Baseline and the Hypatia Security Scan build the scanner at the reusables' default hypatia-ref, 51ab649. That commit's ActionsLock parser accepts only v0.0.2, so this repo's tool-owned v0.0.3 actions.lock fails closed as two high invalid_actions_lock findings on every run. Pass hypatia-ref aa34a4c (main after #938, which adds v0.0.3 support) as an input. The `uses:` refs are unchanged, so actions.lock is untouched. This is the value standards#1315 moves the defaults to; drop the input once the standards callers are re-pinned past that PR. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly and concisely identifies the main change: passing the pinned hypatia-ref to the standards scanner reusable workflows. |
| Description check | |
The description directly explains the CI issue, the two-file change, the pinned revision, verification steps, and the remaining findings. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
hyperpolymath
marked this pull request as ready for review
October 20, 2026 12:32
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
5 of 6 tasks
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
hyperpolymath
pushed a commit
that referenced
this pull request
Oct 20, 2026
Brings in #938 (ActionsLock v0.0.3 per-dependency hostname), #939 (security-status checks out the workflow file before its self-check) and #940 (hypatia-ref aa34a4c passed to the standards scanner reusables). Conflicts: - lib/rules/actions_lock.ex: this branch and #938 each added v0.0.3 hostname handling; the textual merge kept both, leaving this branch's clauses unreachable behind #938's. #938's parser is taken whole (it checks the hostname grammar, the version and duplicates), and this branch's one other addition, workflow_refs/2 (PI004 per workflow), is re-applied on top. - test/rules/actions_lock_test.exs: a hostname line in a v0.0.2 lock is {:hostname_not_in_version, "v0.0.2"} under #938, not :malformed_dependency_entry. - .github/workflows/hypatia-scan.yml: #940's `with: hypatia-ref` input and this branch's secrets comment, both kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8
hyperpolymath
added a commit
that referenced
this pull request
Oct 20, 2026
…credential (#942) ## Summary PR 2 of the baseline-gate stack, stacked on #940. WH013 ("permission-starved write") fired whenever a workflow writes and the file grants no `contents: write`. That grant only governs `GITHUB_TOKEN`, so it fired on jobs that write with **their own credential**. Measured false positives: | Repo / file | Credential | Before | After | |---|---|---|---| | hypatia `estate-rescan.yml` | `HYPATIA_DISPATCH_PAT` in a clone URL, pushing to verisimdb-data | high | none | | hypatia `inbox-steward-intake.yml` | `actions/checkout` `token: FARM_PAT` | high (masked) | **warn** `unmask-credentialed-write` | | standards `github-backup-mirror-reusable.yml` | `BACKUP_MIRROR_TOKEN` PAT push to the backup repo | high | none | | echidna | — | none | none | Changes: - Writes are judged per job (`extract_job_blocks/1`). A file the extractor can't split falls back to whole-file judgment, as before. - A job is **credentialed** when `token:`, `GH_TOKEN:` or `GITHUB_TOKEN:` is set to a secret other than `secrets.GITHUB_TOKEN`, or to a step-minted `steps.<id>.outputs.token` (GitHub App). `own_credential_job?/1` is public and has unit asserts. - Starvation and its masked `:high` arm consider only `GITHUB_TOKEN` jobs. A PAT in one job never excuses a `GITHUB_TOKEN` push in another; there is a test for that. - A credentialed write that is **masked** (`2>/dev/null`, `|| true`, `|| echo`) is still reported, at `:warn` with its own recipe. A credential that expires or loses scope fails silently, but no grant is missing. The remaining inbox-steward warn is a real defect, fixed in the next PR of the stack. ## Type of change - [x] 🐛 Bug fix: a false-positive class across the estate. It also leaves one true positive (masking), correctly worded. ## How has this been verified? `mix deps.get` can't reach hex.pm from this session, so I compiled `actions_lock.ex` and `workflow_hardening.ex` standalone with Elixir 1.14 and ran `test/workflow_hardening_test.exs` under ExUnit (seed 0): - Before the change: **56/56** pass. - After, with 5 new tests: **61/61** pass. - Control: the 5 new tests against the **old** module give 3 failures (the PAT-clone, PAT-masked and `own_credential_job?` cases). The other two (`secrets.GITHUB_TOKEN` is not a credential; a PAT in one job doesn't excuse another job) hold on both, as they should. - `mix format --check-formatted` passes on both files. The formatter changed only the edited region. - I ran `wh013_permission_starved_write/1` against the real hypatia, standards and echidna trees with the old and new modules; that produced the table above. CI's `mix test` is the first full-suite run. ## Checklist - [ ] My commits are **signed**. The session's signing shim is platform-mediated. - [x] I ran the project's own checks/tests locally and they pass (scoped as above). - [x] New files carry the correct SPDX (none added). - [x] Docs are updated: the moduledoc for WH013 explains the credential rule. - [x] I have not introduced a soundness hole. The approximation errs toward silence only when a job sets a PAT and then writes with `GITHUB_TOKEN` anyway; this is documented on `own_credential_job?/1`. ## Notes for reviewers The gate on this PR still runs the pinned scanner (`aa34a4c` from #940), so this change won't show in its own baseline result. A final pin bump after the rule PRs merge picks it up. --- _Generated by [Claude Code](https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
This was referenced Oct 20, 2026
hyperpolymath
added a commit
that referenced
this pull request
Oct 20, 2026
## Summary This is the last step of the baseline-gate stack. `governance.yml` and `hypatia-scan.yml` pass `hypatia-ref: aa34a4c` (#940), which predates the rule fixes that clear this repo's own false positives. This PR moves both to **hypatia `main` at `23dc74d`**, which contains: - #938: ActionsLock accepts v0.0.3 locks (already in `aa34a4c`); - #942: WH013 judges writes per job and skips PAT/app-token writes. This clears `estate-rescan.yml`; `inbox-steward-intake.yml` was also repaired in #943; - #947: RE005 skips `trap` handlers, and job extraction survives comments between jobs. `uses:` refs are unchanged, so `actions.lock` is untouched. ## What this PR's governance run will show This PR's own `governance / Validate Hypatia Baseline` run is the measurement: it builds the scanner at `23dc74d`. The jump from `aa34a4c` also brings #931's new rules (WF026, WF027, PIN-003), which haven't been measured on this repo yet. hex.pm is blocked in my session, so I can't build the escript to pre-run them. **Expected remaining findings, by class:** - **RE001 (harden-runner):** most of the original 18 jobs, including the 2 dispatched label workflows, which must stay action-free. - These need an owner decision; the harden-runner steps were removed again in #948 because the lock has no record. - **WH013, RE004, RE005, `invalid_actions_lock`:** expected 0. I'll post the measured list here once the run completes. ## Type of change - [x] 🔧 Build / CI / tooling ## How has this been verified? - `actionlint` 1.7.7 is clean on both files. - `23dc74d` is `origin/main` at the time of writing. `git log aa34a4c..23dc74d` contains #942, #947, #945, #931, #941 and #936. ## Checklist - [ ] My commits are **signed**. The session's signing shim is platform-mediated. - [x] I ran the project's own checks/tests locally and they pass. - [x] New files carry the correct SPDX (none added). - [x] Docs are updated (the pin comment names what it carries). - [x] I have not introduced a soundness hole. --- _Generated by [Claude Code](https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR 1 of a stack that triages the 30 findings
governance / Validate Hypatia Baselinereports on every PR (e.g. #938 job 118601725176, #939 job 118615176756).The gate doesn't run this repo's scanner. It builds hypatia at the reusable's default
hypatia-ref,51ab649. That commit'sActionsLockparser accepts only v0.0.2, so this repo's tool-owned v0.0.3actions.lockfails closed as 2 high findings:The parser was already fixed by #938 (
aa34a4c). This PR passeshypatia-ref: aa34a4cc…to both standards reusables (governance.yml,hypatia-scan.yml).uses:refs are unchanged, soactions.lockis untouched.gh actions-lockrun), this input is redundant and should be dropped.Type of change
How has this been verified?
333b06a0declare ahypatia-refstring input (git show 333b06a0:.github/workflows/{governance,hypatia-scan}-reusable.yml).yqreadshypatia-ref: aa34a4cc…from both callers.actionlint1.7.7 is clean on both files, before and after.aa34a4cwas measured in standards#1315 by replaying the baseline step: on this repo it removes the 2invalid_actions_lockfindings and adds nothing. The gate stays red on this PR because of the 28 other findings. The stacked PRs fix those at their source:inbox-steward-intake.ymlrepair (masked pushes, and appended text that corrupts.hypatia-baseline.json);trapcleanup, plus two real masks removed;gh actions-lockrun.Checklist
Notes for reviewers
The pin now lives in two places (here and the standards default) until the re-pin. The comment in
governance.ymlsays when to drop it.Generated by Claude Code