Skip to content

fix(ci): hypatia-scan.yml -- --exit-zero + GITHUB_TOKEN (hyperpolymath/hypatia#213) - #2

Merged
hyperpolymath merged 1 commit into
mainfrom
fix/hypatia-213-scanner-flag
May 13, 2026
Merged

fix(ci): hypatia-scan.yml -- --exit-zero + GITHUB_TOKEN (hyperpolymath/hypatia#213)#2
hyperpolymath merged 1 commit into
mainfrom
fix/hypatia-213-scanner-flag

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented May 13, 2026

Copy link
Copy Markdown
Owner

Mirrors hyperpolymath/hypatia#228 in this consumer repo.

What was actually broken in Hypatia Security Scan

The scanner halts with System.halt(1) whenever findings exist at or above the severity threshold (lib/hypatia/cli.ex:158-160 pre-#228). Under GitHub Actions' default set -e, that exit-1 short-circuits the workflow step before jq aggregation, actions/upload-artifact, the PR comment, AND the explicit "Check for critical or high-severity issues" step.

The previous actions/upload-artifact SHA-bump sweep across the estate (41 PRs) was based on a wrong diagnosis -- the failing runs were not at action-resolve time. See hyperpolymath/hypatia#213 for the full root-cause writeup.

Changes in this PR

  • Pass GITHUB_TOKEN to the scan step env so the Dependabot rule can query alerts (and stops emitting Warning: Dependabot alerts unavailable: GITHUB_TOKEN not set).
  • Append --exit-zero to the hypatia-cli.sh scan . invocation so findings-at-severity no longer short-circuits the step. The downstream "Check for critical or high-severity issues" step (already in this workflow) remains the explicit gate.
  • Pin actions/upload-artifact to v4.6.2 (ea165f8d65b6e75b540449e92b4886f43607fa02) to match the estate-wide pin.

Notes

  • --exit-zero was added in fix(cli): add --exit-zero flag + always-emit stderr summary (closes #213) hypatia#228 and is silently ignored by pre-#228 versions of the scanner (OptionParser strict mode places unknown flags in invalid and the CLI discards that), so this PR is safe to merge in either order relative to #228.
  • This change does not affect non-CI usage of the scanner; the default exit 1 on findings is unchanged for shell / pre-commit users.

🤖 Generated with Claude Code

@hyperpolymath @claude
fix(ci): hypatia-scan.yml -- pass GITHUB_TOKEN, use --exit-zero (hype…
29c47d6 
…rpolymath/hypatia#213)

The Hypatia Security Scan workflow exits 1 on any findings (>= medium)
because lib/hypatia/cli.ex halts with System.halt(1). Under `set -e`,
that short-circuits the step before jq/artifact-upload/PR-comment run.

Mirrors hyperpolymath/hypatia#228:
* pass GITHUB_TOKEN so the Dependabot rule stops warning
* append --exit-zero so the downstream critical/high gate stays
  the explicit gate
* bump actions/upload-artifact to v4.6.2 (ea165f8d) to match the
  estate-wide pin

See hyperpolymath/hypatia#213 for the diagnosis.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@hyperpolymath
hyperpolymath merged commit 1dde1c4 into main May 13, 2026
1 of 27 checks passed
@hyperpolymath
hyperpolymath deleted the fix/hypatia-213-scanner-flag branch May 13, 2026 01:45
@hyperpolymath hyperpolymath mentioned this pull request Oct 5, 2026
Merged
9 of 11 tasks
hyperpolymath added a commit that referenced this pull request Oct 5, 2026
@hyperpolymath
docs(type-connections): register the Secret Types family (nextgen-typ…
579c320 
…ing#118) (#124)

## Summary

Registers **Secret Types** in the shared type-family map
(`docs/TYPE-CONNECTIONS.adoc`), completing the *register* step of
nextgen-typing#118's secret-types item ("mint + define + register"). The
row is **not** invented or paraphrased: it is the owner-prepared wording
attached to the reviewed/merged Secret Types source change —
`hyperpolymath/secret-types` PR #4 (commit `906e110f`, merged
2026-10-04T09:07:42Z, owner confirmation 2026-10-04, rulings D153/D154
in `docs/secret-types.adoc` + ADR-0004) — relayed in the 2026-10-04
handoff comment on that PR ("Prepared cross-repo handoff updates …
Proposed row for `TYPE-CONNECTIONS.adoc` … owner wording wins"). No
`TYPE-FAMILY-MAP-ROW.adoc` file exists anywhere in the org (checked by
tree walk + code search on 2026-10-05); that handoff comment is the
canonical prepared row text, and it matches the canonical scope
statement's question and boundary.

This does **not** close #118: the occupancy-types map patch, its `just
type-map` rebuild, and the choreographic-types reviewer item remain open
(audit below).

## Changes

- `docs/TYPE-CONNECTIONS.adoc`
- "What each family means": sixth family row for [Secret
Types](https://github.com/hyperpolymath/secret-types), verbatim
owner-prepared wording (question: which value flows a confidentiality
label permits; boundary: a label is not cryptography and not an
epistemic standpoint; baseline declassifies nothing; no consumer
selected as of 2026-10-04).
- "Where things belong": `secret-types` bullet — specification-stage, no
`Secret` type / IFC calculus / declassification rule / noninterference
theorem yet, **no connection obligation asserted**.
- "Primary project entry points": Secret Types README and scope
statement.
- "Sources and review boundary": dated provenance note (row added
2026-10-05 from secret-types PR #4; specification-stage caveats).
  - Intro: five → six research families; image alt text updated.
- `docs/images/type-connections.dot` — `secret` node added to the
research rank, **no edges** (registration only; no connection has been
proposed, so none is drawn). Map date → October 2026.
- `docs/images/type-connections.svg` — regenerated with the documented
`just type-map` recipe (`dot -Tsvg` + the two SPDX `sed` lines).
**Renderer note:** no native Graphviz is installable in this sandbox (no
distro mirrors); rendering used real Graphviz 16.1.0 via wasm on the
updated `.dot`. Owners with local Graphviz may re-run `just type-map` to
normalise the generated bytes.
- `.machine_readable/bot_directives/placement.a2ml` — routing rule
`confidentiality labels / information-flow control (secret types) →
secret-types`, matching the rule every other registered family already
has; `last-updated` → 2026-10-05.

## RSR Quality Checklist

### Required

- [x] Tests pass (`just test` or equivalent) — docs-only change; the
repo's runnable gates were executed directly (see Testing)
- [x] Code is formatted — AsciiDoc wrapped to the file's existing line
width
- [x] Linter is clean — invisible-character scan clean on all four
touched files
- [x] No banned language patterns — docs + TOML only
- [x] No `unsafe` blocks — n/a
- [x] No banned functions — n/a
- [x] SPDX license headers present on all new/modified source files —
`.dot`/`.adoc`/`.a2ml` headers untouched and intact; SVG SPDX lines
re-inserted by the recipe
- [x] No secrets, credentials, or `.env` files included

### As Applicable

- [ ] `.machine_readable/STATE.a2ml` updated — not changed: no
project-state change (map content change is tracked in #118, and
placement.a2ml carries its own `last-updated`)
- [x] Documentation updated for user-facing changes
- [ ] `CHANGELOG` — left alone deliberately; map receipt history is
recorded in TYPE-CONNECTIONS itself per repo practice (happy to add an
entry if maintainers prefer)

## Testing

- `scripts/check-coordination-boundary.sh` — **PASS** ("Coordination
boundary intact: docs + cross-project proofs only")
- `scripts/check-pipeline-drift.sh .` — **PASS** (no pipeline drift;
date-sync check unaffected by placement.a2ml's own `last-updated`)
- `placement.a2ml` parses as TOML (16 routing rules; new rule present)
- Table-structure lint of `TYPE-CONNECTIONS.adoc`: family table now
header + 6 rows × 3 cells; glossary and connection tables unchanged
- Invisible/zero-width character scan on all four touched files — clean
- `.dot` re-parsed and laid out by real Graphviz (wasm build) — node
positions verified numerically; Secret Types renders in the research
rank beside Residual Evidence and Choreographic, no edges
- **Not run here** (recorded, not claimed): `asciidoctor` render and
native `just type-map` — no Ruby/Graphviz in this sandbox; CI is the
render authority

## nextgen-typing#118 checklist audit (evidence checked 2026-10-05)

| Item | Evidence | Proposed status |
|---|---|---|
| Map patch above lands (occupancy row + glossary + connection rows +
where-things-belong + naming note) | Not landed: `main` (`70df154`) has
no occupancy content in `TYPE-CONNECTIONS.adoc`; no map PR since #120
(2026-09-30). RULING D188 (absolute-zero#175, 2026-09-30) approved the
OND residue-list rename and "the two map rows" in substance, but nothing
has landed. Owner wording in #118 is the source. | stays **open** |
| `type-connections.dot` + SVG rebuilt (`just type-map`) | Not done for
the occupancy patch (no occupancy node at `main`). This PR rebuilds
dot+SVG for the Secret Types registration only. | stays **open**
(occupancy rebuild pending item 1) |
| occupancy-types README/glossary reciprocal links | Verified:
occupancy-types commit `1004e496` "docs: type-family map cross-links
(nextgen-typing TYPE-CONNECTIONS)"; README links the map (checked
2026-10-05). | already **[x]**, still accurate |
| kategoria issue | Filed: kategoria#76 (2026-09-27T16:59:39Z, open, 0
comments). Link never edited into #118's body. | tick **[x]** (filed) +
edit link in |
| typell issue | Filed: typell#62 (2026-09-27T16:59:40Z, open, 0
comments). | tick **[x]** (filed) + edit link in |
| absolute-zero issue | Filed: absolute-zero#175 (2026-09-27T16:59:41Z,
open); RULING D188 (2026-09-30) answers the residue-list rename and
approves the two map rows. | tick **[x]** (filed) + edit link in |
| januskey issue | Filed: januskey#137 (2026-09-27T16:59:42Z, open);
RULING D147 + RULING D204 (2026-09-30, also on #118) answer the
formal-home question (NW-1: one filesystem-reversibility model via
absolute-zero's abstract CNO interface + valence-shell). Issue stays
open in januskey for its own cross-link work. | tick **[x]** (filed) +
edit link in |
| secret-types issue (mint + define + register) | Filed: secret-types#2
(2026-09-27T16:59:43Z, open). Mint + define landed via secret-types PR
#4 (merged 2026-10-04): canonical scope statement, real README,
ADR-0004. Register = **this PR**. #2 stays open for the `just repo-init`
scaffolding sweep ("minted in scope, not in scaffolding"). | tick
**[x]** on merge of this PR |
| choreographic-types: reviewer for the Occupancy→Choreographic row |
Not started: choreographic-types#15 open, 0 comments; zero issues/PRs in
choreographic-types mention occupancy (org search 2026-10-05). Also
blocked on item 1 (row not landed). | stays **open** |

Related, outside the checklist: #115 (TYPE-CONNECTIONS receipts /
Echo→Residual + Epistemic→Residual acceptance criteria) remains open —
untouched by this change. The stale premise in #118 gap 2 ("un-minted,
README still `{{PROJECT_NAME}}`") is superseded by secret-types PR #4;
the owner-prepared replacement text is in the PR #4 handoff comment.

## Prepared update for nextgen-typing#118 — posting blocked by
credentials

This session's token **cannot write issues** (the 2026-10-04 session
recorded `403 Resource not accessible by integration` /
`X-Accepted-Github-Permissions: issues=write`; re-verified from this
session — see below). The prepared comment and body edits are therefore
included here verbatim for anyone with issue-write access:

<details>
<summary>Prepared comment for #118 (not posted)</summary>

**Secret Types registered in the type-family map** (2026-10-05) —
registration PR: <this PR>

The reviewed/merged Secret Types source change is secret-types PR #4
(merged 2026-10-04, owner confirmation 2026-10-04, D153/D154): canonical
scope statement `docs/secret-types.adoc`, real README, ADR-0004. The map
row uses the owner-prepared wording from the PR #4 handoff comment
verbatim.

Landed in the PR: the "What each family means" row; a `secret-types`
"Where things belong" entry; an entry-point link; a dated provenance
note; the `secret` node in `type-connections.dot` with **no edges** (no
connection obligation is asserted — the specification is stage-only: no
`Secret` type, IFC calculus, declassification rule or noninterference
theorem exists yet); the SVG rebuilt by the `just type-map` recipe; and
a `placement.a2ml` routing rule.

Checklist updates in this edit: the five per-repo issues are ticked as
*filed* with links (they were all filed 2026-09-27, ~50s after this
issue, but their links were never edited in); the secret-types item is
ticked (mint + define via secret-types#4; register via the linked PR).
**Still open here:** the occupancy-types map patch (this issue's body is
the source; RULING D188 already approves the OND rows in substance), the
`just type-map` rebuild for the occupancy patch, and the
choreographic-types reviewer for Occupancy→Choreographic
(choreographic-types#15 is the separate overclaim problem; the echo
loss-grade reconciliation stays open in the map). Gap 2's "un-minted"
premise is superseded by secret-types PR #4 (replacement wording in the
PR #4 handoff comment).

This issue stays **open**: registration of one family does not discharge
the remaining estate-wide work.

</details>

<details>
<summary>Prepared body edits for #118 (not applied)</summary>

1. **Gap 2** — replace with the owner-prepared paragraph from the
secret-types#4 handoff comment (2026-10-04), beginning "Owner
confirmation, 2026-10-04: the standalone `secret-types` repository is
the home of the confidentiality-label / information-flow work…", ending
"…minted in scope, not in scaffolding — tracked in secret-types#2."
2. **Proposed patch section** — append the Secret Types row (same
verbatim three cells as landed in this PR).
3. **Checklist** —
- `- [x] kategoria issue (taxonomy non-conflation + reciprocal link) —
filed: kategoria#76 (open there)`
- `- [x] typell issue (reciprocal link + vocabulary alignment) — filed:
typell#62 (open there)`
- `- [x] absolute-zero issue (residue-list collision + proposed OND
connection rows) — filed: absolute-zero#175; RULING D188 (2026-09-30)
approves rename + rows`
- `- [x] januskey issue (cross-link to CNO pillar or IS-NOT) — filed:
januskey#137; formal-home question answered by RULING D204 (NW-1)`
- `- [x] secret-types issue (mint + define + register) — filed:
secret-types#2; mint + define via secret-types#4 (merged 2026-10-04);
register via <this PR> (scaffolding sweep still open in secret-types#2)`
- items 1, 2 (occupancy map patch + its `just type-map` rebuild) and the
choreographic reviewer item stay `- [ ]`.

</details>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath