The scan / Hypatia check is non-blocking and currently red on confirmed false positives on RSR-template scaffolding (prohibition comments matched as violations, safe ${{ }} expressions, internal-service http URLs, commented-out examples). PR #3 added a documented .hypatia-ignore that took it 20 → 14 (critical eliminated); PRs after that did not reduce it further.
Blocker
The residual 14 (3 high, 11 medium) can't be enumerated from this sandbox:
- the gating scanner is an Elixir escript, and hex.pm is firewalled (
403) so it can't be built/run here;
- the failing run never uploads its
hypatia-findings.json artifact (the step fails before the upload step).
Path to green
- Run
~/hypatia/hypatia-cli.sh scan . in a hex-enabled Elixir environment and capture hypatia-findings.json.
- For each residual finding, add a precise
module/type:path exemption to .hypatia-ignore (format documented in the file), or fix it if it's real.
Alternative (better)
Fix upstream in hyperpolymath/hypatia: don't flag prohibition comments (-- ...no believe_me...) as the banned token, and reconcile the code_safety SCM-location rule with honest_completion accepting the .machine_readable/6a2/ layout.
Ref: .hypatia-ignore, docs/guide/for-maintainers.adoc (Hypatia is advisory).
The
scan / Hypatiacheck is non-blocking and currently red on confirmed false positives on RSR-template scaffolding (prohibition comments matched as violations, safe${{ }}expressions, internal-service http URLs, commented-out examples). PR #3 added a documented.hypatia-ignorethat took it 20 → 14 (critical eliminated); PRs after that did not reduce it further.Blocker
The residual 14 (3 high, 11 medium) can't be enumerated from this sandbox:
403) so it can't be built/run here;hypatia-findings.jsonartifact (the step fails before the upload step).Path to green
~/hypatia/hypatia-cli.sh scan .in a hex-enabled Elixir environment and capturehypatia-findings.json.module/type:pathexemption to.hypatia-ignore(format documented in the file), or fix it if it's real.Alternative (better)
Fix upstream in
hyperpolymath/hypatia: don't flag prohibition comments (-- ...no believe_me...) as the banned token, and reconcile thecode_safetySCM-location rule withhonest_completionaccepting the.machine_readable/6a2/layout.Ref:
.hypatia-ignore,docs/guide/for-maintainers.adoc(Hypatia is advisory).