fix(ci): resolve 27 hypatia workflow-hygiene findings (#254)

## Summary

Triggered by the hypatia scan comment on [PR
#249](#249 (comment))
— 98 findings flagged. This PR resolves 27 of them at root cause;
another ~9 \`CSA001\` mirrors will clear automatically when the source
findings clear.

## Findings resolved

| Count | Severity | Type | Fix |
|---|---|---|---|
| 1 | medium | \`unpinned_action\` | \`governance.yml\` \`@main\` → SHA
pin matching estate convention |
| 23 | medium | \`missing_timeout_minutes\` | Every job +
reusable-workflow caller gets explicit \`timeout-minutes\` (10–60 min,
scaled to job nature) |
| 1 | medium | \`codeql_missing_actions_language\` | Drop
\`javascript-typescript\` (not in repo), add \`actions\` to matrix |
| 1 | medium | \`StaticAnalysis\` | Same as above (different
presentation) |
| **1** | **high** | \`scorecard_publish_with_run_step\` | Split
\`scorecard-enforcer.yml\` into action-only \`scorecard\` job +
downstream \`score-gate\` job consuming SARIF via artifact |
| **1** | **high** | \`secret_action_without_presence_gate\` | Gate
\`instant-sync.yml\`'s \`FARM_DISPATCH_TOKEN\` with \`env.HAS_TOKEN\`
check; add skip-notice step for token-absent path |

## Out of scope (separate work)

| Count | Severity | Type | Why deferred |
|---|---|---|---|
| 6 | **critical** | \`SD004\` | Hypatia rule bug — enforcing retired
\`.machine_readable/6a2/\` subdir layout. Per standards CLAUDE.md,
canonical location IS \`.machine_readable/\` directly. File hypatia
issue. |
| 29 | medium | \`expect_in_hot_path\` | Rust \`.expect()\` calls across
\`bots/*\`. Needs per-bot review + migration to \`?\` /
\`unwrap_or_else\`. Separate code work. |
| 1 | medium | \`GS007\` | 3 stale non-main remote branches. Cleanup
separately. |
| 33+1 | medium | \`CSA001\`/\`CSA002\` | Code-scanning-API mirrors of
other findings. Resolve automatically when sources resolve. |

## Key design notes

### Scorecard split

Hypatia's \`scorecard_publish_with_run_step\` rule flags any \`run:\`
step in a workflow job using \`ossf/scorecard-action\` with
\`publish_results: true\`. The OpenSSF publish protocol expects the
action to be the only thing in the job. Restructured:

```yaml
scorecard:        # action-only: checkout → run scorecard → upload SARIF → upload artifact
score-gate:       # needs: scorecard. Pulls artifact, runs score check via run-step
check-critical:   # existing, unchanged
```

### Secret presence gate

The canonical \`if: env.HAS_TOKEN == 'true'\` pattern guards the
dispatch step. Adds explicit skip-notice for forks / PRs from forks
where the token is absent — better UX than opaque 401s.

### Reusable-workflow callers

GitHub allows \`timeout-minutes\` on \`uses:\` caller jobs (caps total
reusable execution time). Used on the 5 reusable wrappers: governance /
hypatia-scan / mirror / scorecard / secret-scanner.

## Test plan

- [ ] Hypatia scan on this PR drops from 98 → ~38 findings (no
critical/high in workflow surface).
- [ ] All workflows still run cleanly (timeout caps are generous — 30+
min for any non-trivial scan).
- [ ] \`scorecard-enforcer.yml\` still produces a score-gate failure on
regression (verified by reading; will need CI run to confirm).

## Related

- #249 — the actuation PR whose scan comment surfaced these findings.
- hyperpolymath/hypatia — SD004 rule needs fixing separately (will
file).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/boj-build.yml

@@ -7,6 +7,7 @@ on:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/casket-pages.yml

@@ -18,6 +18,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
@@ -110,6 +111,7 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     needs: build
+    timeout-minutes: 10
     steps:
       - name: Deploy to GitHub Pages
         id: deployment

.github/workflows/codeql.yml

@@ -23,14 +23,18 @@ permissions:
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     permissions:
       contents: read
       security-events: write
     strategy:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          # `actions` covers GitHub Actions workflow analysis (the primary
+          # surface this repo presents) — Hypatia StaticAnalysis flagged
+          # the prior matrix as containing no language present in the repo.
+          - language: actions
             build-mode: none
           - language: rust
             build-mode: none

.github/workflows/dogfood-gate.yml

@@ -22,6 +22,7 @@ jobs:
   a2ml-validate:
     name: Validate A2ML manifests
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -66,6 +67,7 @@ jobs:
   k9-validate:
     name: Validate K9 contracts
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -115,6 +117,7 @@ jobs:
   empty-lint:
     name: Empty-linter (invisible characters)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -179,6 +182,7 @@ jobs:
   groove-check:
     name: Groove manifest check
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -239,6 +243,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [a2ml-validate, k9-validate, empty-lint, groove-check]
     if: always()
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository

.github/workflows/e2e.yml

@@ -11,6 +11,7 @@ jobs:
   e2e:
     name: E2E tests
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install PyYAML (for workflow YAML validation)

.github/workflows/governance.yml

@@ -31,4 +31,5 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@3b3549e293f87be99d7dbb939d380c8128842c8e # main 2026-06-02
+    timeout-minutes: 30

.github/workflows/hypatia-dispatch-intake.yml

@@ -16,6 +16,7 @@ permissions:
 jobs:
   intake:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout gitbot-fleet
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

.github/workflows/hypatia-scan.yml

@@ -27,3 +27,8 @@ jobs:
   hypatia:
     uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@915139d73560e65a8240b8fc7768698658502c89
     secrets: inherit
+    # Total caller-side wall-clock cap for the reusable. Matches
+    # Hypatia's `missing_timeout_minutes` rule expectation. The scan is
+    # typically ~3 min; the cap leaves headroom for slow estate builds.
+    timeout-minutes: 30
+

.github/workflows/instant-sync.yml

@@ -14,8 +14,17 @@ permissions:
 jobs:
   dispatch:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # Presence-gate the FARM_DISPATCH_TOKEN secret. Without this, forks /
+    # PR-from-fork runs reach the dispatch step with an empty token and
+    # fail with an opaque 401 — see hypatia `secret_action_without_presence_gate`.
+    # Hoisted to job-level so the gate covers any future steps that also
+    # consume the secret.
+    env:
+      HAS_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN != '' }}
     steps:
       - name: Trigger Propagation
+        if: env.HAS_TOKEN == 'true'
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}
@@ -30,4 +39,9 @@ jobs:
             }
 
       - name: Confirm
+        if: env.HAS_TOKEN == 'true'
         run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"
+
+      - name: Skip-reason notice
+        if: env.HAS_TOKEN != 'true'
+        run: echo "::notice::FARM_DISPATCH_TOKEN unavailable in this context — propagation skipped (expected on forks / PRs from forks)."

.github/workflows/learning-loop.yml

@@ -14,6 +14,7 @@ jobs:
   process-findings:
     name: Process Findings and Generate Rules
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     permissions:
       contents: write  # For creating rule proposal PRs
@@ -72,6 +73,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: process-findings
     if: false  # Enable after manual approval workflow is ready
+    timeout-minutes: 10
 
     steps:
       - name: Placeholder for rule deployment