Repository navigation
fix(ci): adopt the template's inline hypatia-scan.yml - #35
Merged
Merged
Conversation
Estate Rules is red on main at the verdict-grid lane suite: "cannot locate Hypatia path conversion". The suite's tests/workflows/workflow_evidence_test.sh comes from the template and reads the inline jq step that makes finding paths repo-relative. This repository had kept a one-job caller of the standards reusable workflow, so the step was not there. The mint failure earlier in the same job hid this until #28. hypatia-scan.yml is now rsr-template-repo main (0208563) byte for byte. It builds the same Hypatia pin as before (be98f74), uploads the SARIF and the hypatia-scan-findings artifact that fork-governance.yml and verdict-grid-publish.yml already read, and gates on zero critical findings. The other workflows and .github/workflows/README.adoc already describe this inline job. actions.lock: the hypatia-scan.yml entry is the template lock's entry for the same file; every dependency record it names was already in this lock, and the standards@46ee183 record stays for its other users. Checked locally: scripts/check-lock-sync.sh, standards close-lock.sh --check (closed, no dangling edges), tests/workflows/ workflow_evidence_test.sh, scripts/check-workflow-edges.sh, check_lock_sync_test.sh and governance_policy_test.sh all pass. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6 Signed-off-by: Claude <noreply@anthropic.com>
|
🟠 indeterminate · the verdict grid could not be rendered · The renderer pinned in metadatastician/standards@8e48b1caade0 was missing or did not match its recorded sha256. Orange means the evidence for this lane was unavailable, not that the repository passed. |
hyperpolymath
marked this pull request as ready for review
November 10, 2026 19:23
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Contributor
|
Caution Review failedThe pull request is closed. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Estate Rules is red on
main(run 42879373951) at the verdict-grid lane suite:FAIL: cannot locate Hypatia path conversion.tests/workflows/workflow_evidence_test.shcomes from the template. It reads the inlinejq --arg ws "$GITHUB_WORKSPACE/"step that makes Hypatia's finding paths repo-relative. This repository had kept a one-job caller ofmetadatastician/standards/.github/workflows/hypatia-scan-reusable.yml, so the step was not there. The mint failure earlier in the same job hid this until #28.As the owner chose, this PR adopts the template's inline workflow.
Changes
.github/workflows/hypatia-scan.yml: nowrsr-template-repomain(0208563) byte for byte.be98f74).hypatia) and thehypatia-scan-findingsartifact thatfork-governance.ymlandverdict-grid-publish.ymlalready read..github/workflows/README.adocalready describe this inline job..github/workflows/actions.lock: thehypatia-scan.ymlentry is the template lock's entry for the same file. Every dependency record it names was already in this lock. Thestandards@46ee183record stays for its other users.RSR Quality Checklist
Required
unsafeblocks without// SAFETY:comments.envfiles includedAs Applicable
Testing
Run locally on this branch:
scripts/check-lock-sync.sh: pass (0 dangling edges, every workflow has a lock key).scripts/close-lock.sh --check .github/workflowsatd3e4b48: closed, no dangling edges.tests/workflows/workflow_evidence_test.sh: pass (it failed with the old caller).scripts/check-workflow-edges.sh: all workflow edges resolve.tests/workflows/check_lock_sync_test.shandtests/workflows/governance_policy_test.sh: pass.The lock entry was copied from the template's tool-written lock for the same file, not generated here: this session has no
gh actions-lock.Lock Sync GateandActions lockfile verifyin CI are the authority on it.Hosted proof of the scan itself comes from this PR's
Hypatia Security Scanrun.Screenshots
Not applicable.
Generated by Claude Code