Repository navigation
ci: fix hypatia-scan working-directory + retire banned Jekyll workflow #9
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| # Hypatia Neurosymbolic CI/CD Security Scan | |
| name: Hypatia Security Scan | |
| on: | |
| push: | |
| branches: [main, master, develop] | |
| pull_request: | |
| branches: [main, master] | |
| schedule: | |
| - cron: '0 0 * * 0' # Weekly on Sunday | |
| workflow_dispatch: | |
| permissions: read-all | |
| jobs: | |
| scan: | |
| name: Hypatia Neurosymbolic Analysis | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4 | |
| with: | |
| fetch-depth: 0 # Full history for better pattern analysis | |
| - name: Setup Elixir for Hypatia scanner | |
| uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.18.2 | |
| with: | |
| elixir-version: '1.19.4' | |
| otp-version: '28.3' | |
| - name: Clone Hypatia | |
| run: | | |
| if [ ! -d "$RUNNER_TEMP/hypatia" ]; then | |
| git clone https://github.com/hyperpolymath/hypatia.git "$RUNNER_TEMP/hypatia" | |
| fi | |
| - name: Build Hypatia scanner (if needed) | |
| working-directory: ${{ runner.temp }}/hypatia | |
| run: | | |
| if [ ! -f hypatia-v2 ]; then | |
| echo "Building hypatia-v2 scanner..." | |
| mix deps.get | |
| mix escript.build | |
| mv hypatia ../hypatia-v2 | |
| fi | |
| - name: Run Hypatia scan | |
| id: scan | |
| run: | | |
| echo "Scanning repository: ${{ github.repository }}" | |
| # Run scanner | |
| HYPATIA_FORMAT=json "$RUNNER_TEMP/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia-findings.json || true | |
| # Count findings | |
| FINDING_COUNT=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0) | |
| echo "findings_count=$FINDING_COUNT" >> $GITHUB_OUTPUT | |
| # Extract severity counts | |
| CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json) | |
| HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json) | |
| MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' hypatia-findings.json) | |
| echo "critical=$CRITICAL" >> $GITHUB_OUTPUT | |
| echo "high=$HIGH" >> $GITHUB_OUTPUT | |
| echo "medium=$MEDIUM" >> $GITHUB_OUTPUT | |
| echo "## Hypatia Scan Results" >> $GITHUB_STEP_SUMMARY | |
| echo "- Total findings: $FINDING_COUNT" >> $GITHUB_STEP_SUMMARY | |
| echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY | |
| echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY | |
| echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY | |
| - name: Upload findings artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: hypatia-findings | |
| path: hypatia-findings.json | |
| retention-days: 90 | |
| - name: Submit findings to gitbot-fleet (Phase 2) | |
| if: steps.scan.outputs.findings_count > 0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_REPOSITORY: ${{ github.repository }} | |
| GITHUB_SHA: ${{ github.sha }} | |
| run: "echo \"\U0001F4E4 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet...\"\n\n# Clone gitbot-fleet to temp directory\nFLEET_DIR=\"/tmp/gitbot-fleet-$$\"\ngit clone https://github.com/hyperpolymath/gitbot-fleet.git \"$FLEET_DIR\"\n\n# Run submission script\nbash \"$FLEET_DIR/scripts/submit-finding.sh\" hypatia-findings.json\n\n# Cleanup\nrm -rf \"$FLEET_DIR\"\n\necho \"✅ Finding submission complete\"\n" | |
| - name: Check for critical issues | |
| if: steps.scan.outputs.critical > 0 | |
| run: | | |
| echo "⚠️ Critical security issues found!" | |
| echo "Review hypatia-findings.json for details" | |
| # Don't fail the build yet - just warn | |
| # exit 1 | |
| - name: Generate scan report | |
| run: | | |
| cat << EOF > hypatia-report.md | |
| # Hypatia Security Scan Report | |
| **Repository:** ${{ github.repository }} | |
| **Scan Date:** $(date -u +"%Y-%m-%d %H:%M:%S UTC") | |
| **Commit:** ${{ github.sha }} | |
| ## Summary | |
| | Severity | Count | | |
| |----------|-------| | |
| | Critical | ${{ steps.scan.outputs.critical }} | | |
| | High | ${{ steps.scan.outputs.high }} | | |
| | Medium | ${{ steps.scan.outputs.medium }} | | |
| | **Total**| ${{ steps.scan.outputs.findings_count }} | | |
| ## Next Steps | |
| 1. Review findings in the artifact: hypatia-findings.json | |
| 2. Auto-fixable issues will be addressed by robot-repo-automaton (Phase 3) | |
| 3. Manual review required for complex issues | |
| ## Learning | |
| These findings feed Hypatia's learning engine to improve future rules. | |
| --- | |
| *Powered by [Hypatia](https://github.com/hyperpolymath/hypatia) - Neurosymbolic CI/CD Intelligence* | |
| EOF | |
| cat hypatia-report.md >> $GITHUB_STEP_SUMMARY | |
| - name: Comment on PR with findings | |
| if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v7 | |
| with: | |
| script: "const fs = require('fs');\nconst findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));\n\nconst critical = findings.filter(f => f.severity === 'critical').length;\nconst high = findings.filter(f => f.severity === 'high').length;\n\nlet comment = `## \U0001F50D Hypatia Security Scan\\n\\n`;\ncomment += `**Findings:** ${findings.length} issues detected\\n\\n`;\ncomment += `| Severity | Count |\\n|----------|-------|\\n`;\ncomment += `| \U0001F534 Critical | ${critical} |\\n`;\ncomment += `| \U0001F7E0 High | ${high} |\\n`;\ncomment += `| \U0001F7E1 Medium | ${findings.length - critical - high} |\\n\\n`;\n\nif (critical > 0) {\n comment += `⚠️ **Action Required:** Critical security issues found!\\n\\n`;\n}\n\ncomment += `<details><summary>View findings</summary>\\n\\n`;\ncomment += `\\`\\`\\`json\\n${JSON.stringify(findings.slice(0, 10), null, 2)}\\n\\`\\`\\`\\n`;\ncomment += `</details>\\n\\n`;\ncomment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;\n\ngithub.rest.issues.createComment({\n owner: context.repo.owner,\n repo: context.repo.repo,\n issue_number: context.issue.number,\n body: comment\n});" |