fix: resolve subshell variable scoping in CI/CD hooks validators

.githooks/validate-spdx-workflows.sh

@@ -12,9 +12,14 @@
 
   # Check for SPDX header in first non-comment line
   HAS_SPDX=false
-  while IFS= read -r line; do
+  while IFS= read -r line || [ $? -eq 0 ]; do
     [[ "$line" =~ ^[[:space:]]*$ ]] && continue
-    [[ "$line" =~ ^[[:space:]]*# ]] && { echo "$line" | grep -qE 'SPDX-License-Identifier' && HAS_SPDX=true; continue; }
+    [[ "$line" =~ ^[[:space:]]*# ]] && { 
+      if echo "$line" | grep -qE 'SPDX-License-Identifier'; then
+        HAS_SPDX=true
+        continue
+      fi
+    }
     break
   done < "$file"
 

.github/workflows/hypatia-scan-reusable.yml

@@ -113,10 +113,10 @@ jobs:
         id: scan
         run: |
           set -euo pipefail
-          # Exactly one JSON array of findings, each with a recognised severity.
-          # Missing/truncated output is a scanner error, never an empty clean scan.
-          if [ ! -s hypatia-findings.json ] || ! jq -e '
-            type == "array" and length > 0 and all(.[];
+          # Exactly one JSON document that is a flat array of findings, each with a recognised severity.
+          # An empty array [] means no findings; multiple documents or missing/truncated output is a scanner error.
+          if [ ! -s hypatia-findings.json ] || ! jq -e -s '
+            length == 1 and (.[0] | type == "array" and all(.[];
               type == "object" and (.severity as $s |
                 ["critical", "high", "medium", "low", "info", "informational"] | index($s) != null))
           ' hypatia-findings.json >/dev/null; then

0-ai-gatekeeper-protocol/.github/dependabot.yml

@@ -14,40 +14,18 @@ updates:
         patterns:
           - "*"
     open-pull-requests-limit: 2
-
   # Rust/Cargo
   - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 0
-
   # Elixir/Mix
   - package-ecosystem: "mix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
     open-pull-requests-limit: 3
-
   # Node.js/npm
   - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-
   # Python/pip
   - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-
   # Nix flakes
   - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"

rhodium-standard-repositories/.github/dependabot.yml

@@ -11,6 +11,3 @@ updates:
           - "*"
     open-pull-requests-limit: 2
   - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"

rhodium-standard-repositories/satellites/cccp/.github/dependabot.yml

@@ -14,40 +14,18 @@ updates:
         patterns:
           - "*"
     open-pull-requests-limit: 2
-
   # Rust/Cargo
   - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 0
-
   # Elixir/Mix
   - package-ecosystem: "mix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
     open-pull-requests-limit: 3
-
   # Node.js/npm
   - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-
   # Python/pip
   - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-
   # Nix flakes
   - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"

rhodium-standard-repositories/satellites/cccp/satellites/nextgen-languages/7-tentacles/.github/dependabot.yml

@@ -11,6 +11,3 @@ updates:
           - "*"
     open-pull-requests-limit: 2
   - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"

rhodium-standard-repositories/satellites/cccp/satellites/php-aegis/.github/dependabot.yml

@@ -1,32 +1,2 @@
+# SPDX-License-Identifier: MPL-2.0
 version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    groups:
-      actions:
-        patterns:
-          - "*"
-    open-pull-requests-limit: 2
-
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-patch"]
-    open-pull-requests-limit: 0
-
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3

rhodium-standard-repositories/satellites/cccp/satellites/sanctify-php/.github/dependabot.yml

@@ -1,32 +1,2 @@
+# SPDX-License-Identifier: MPL-2.0
 version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    groups:
-      actions:
-        patterns:
-          - "*"
-    open-pull-requests-limit: 2
-
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-patch"]
-    open-pull-requests-limit: 0
-
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3

rhodium-standard-repositories/satellites/mustfile/.github/dependabot.yml

@@ -14,40 +14,18 @@ updates:
         patterns:
           - "*"
     open-pull-requests-limit: 2
-
   # Rust/Cargo
   - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 0
-
   # Elixir/Mix
   - package-ecosystem: "mix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
     open-pull-requests-limit: 3
-
   # Node.js/npm
   - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-
   # Python/pip
   - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-
   # Nix flakes
   - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"

rhodium-standard-repositories/satellites/palimpsest-license/.github/dependabot.yml

@@ -1,34 +1,2 @@
+# SPDX-License-Identifier: MPL-2.0
 version: 2
-updates:
-  # 1. Maintain GitHub Actions (workflows)
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    # THE MAGIC PART: Groups updates into one PR
-    groups:
-      dependencies:
-        patterns:
-          - "*"
-    open-pull-requests-limit: 2
-
-  # 2. Maintain Rust (cargo)
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      dependencies:
-        patterns:
-          - "*"
-    open-pull-requests-limit: 0
-
-  # 3. Maintain NPM (if you have package.json)
-  - package-ecosystem: "deno"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      dependencies:
-        patterns:
-          - "*"

rhodium-standard-repositories/satellites/robot-repo-automaton/.github/dependabot.yml

@@ -1,32 +1,2 @@
+# SPDX-License-Identifier: MPL-2.0
 version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    groups:
-      actions:
-        patterns:
-          - "*"
-    open-pull-requests-limit: 2
-
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-patch"]
-    open-pull-requests-limit: 0
-
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3

rhodium-standard-repositories/satellites/rsr-certifier/.github/dependabot.yml

@@ -1,36 +1,2 @@
+# SPDX-License-Identifier: MPL-2.0
 version: 2
-updates:
-  # Rust dependencies
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-      - "rust"
-    commit-message:
-      prefix: "chore(deps)"
-
-  # GitHub Actions
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    labels:
-      - "dependencies"
-      - "ci"
-    commit-message:
-      prefix: "chore(ci)"
-    open-pull-requests-limit: 2
-
-  # Docker
-  - package-ecosystem: "docker"
-    directory: "/container"
-    schedule:
-      interval: "daily"
-    labels:
-      - "dependencies"
-      - "container"
-    commit-message:
-      prefix: "chore(container)"

rhodium-standard-repositories/satellites/rsr-deployer/.github/dependabot.yml

@@ -14,40 +14,18 @@ updates:
         patterns:
           - "*"
     open-pull-requests-limit: 2
-
   # Rust/Cargo
   - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 0
-
   # Elixir/Mix
   - package-ecosystem: "mix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
     open-pull-requests-limit: 3
-
   # Node.js/npm
   - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-
   # Python/pip
   - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-
   # Nix flakes
   - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"

rhodium-standard-repositories/satellites/state.scm/.github/dependabot.yml

@@ -11,6 +11,3 @@ updates:
           - "*"
     open-pull-requests-limit: 2
   - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"