fix(hypatia): ack the workflow_hardening copy of the lock finding (unblocks red main)

[hyperpolymath]

main is red, and round 2 only half-landed

main has been red on both Hypatia checks since #954 (9c256b67) — scan / Hypatia Neurosymbolic Analysis and governance / Validate Hypatia Baseline. Every PR opened since inherits it, including #961.

The cause is not the lockfile. It is that one defect is emitted by two rule modules, and round 2 acknowledged only one of them.

	acknowledged in #954	still blocking
rule_module	workflow_audit	workflow_hardening
file	actions.lock	.github/workflows/actions.lock
type	invalid_actions_lock	invalid_actions_lock
severity	high	high
reason	transitive_dependencies_missing, asana/push-signed-commits@d615	identical

scripts/apply-baseline.sh:188 matches by exact string equality:

.severity   == $finding.severity
and .rule_module == $finding.rule_module      # <- exact, so workflow_audit != workflow_hardening
and .type   == $finding.type

The file_pattern was never the problem. **actions.lock tokenises to \A.*actions\.lock\z, which matches the full path correctly.

Evidence

Reproduced locally against main's own committed apply-baseline.sh, schema and baseline, using the finding copied verbatim from the failing run 35716729172:

before:  kept=1  suppressed=0   ::error::Gate failed: 1 unfiltered finding(s) at or above 'high'.   exit=1
after:   kept=0  suppressed=1                                                                       exit=0

The before line is byte-identical to what CI printed.

Four negative controls confirm the entry suppresses only this exact finding — all four stay KEPT:

control	result
same finding at critical	KEPT
same finding, rule_module: some_other_module	KEPT
type: unpinned_action on the same file	KEPT
same finding on .github/workflows/release.yml	KEPT

Suites, all green on this branch: apply-baseline-test.sh 15/0 · filter-sarif-by-baseline-test.sh 13/0 · hypatia-blocking-gate-test.sh 4/4. Full pre-commit hookset passes.

Exemption ratchet, both directions:

with the trailer:     OK (declared)  .hypatia-baseline.json: 211 -> 212  [Ratchet-exception present]   exit=0
without the trailer:  Exemption ratchet: FAILED.                                                       exit=1

The mutant was a throwaway branch, asserted and deleted — the gate has teeth here, it is not being taken on trust.

What this does not do

It does not accept new exposure. The underlying risk is unchanged and still owned by #951: asana/push-signed-commits@d615 (immutable pin, ref v1.3) declares a transitive actions/setup-python@v2, which floats upstream and can never be a lock key. gh-actions-lock v0.1.6 verify reports valid:true on the same file — Hypatia is stricter than the authoritative tool. The exits remain exactly #951's: Asana pins setup-python, we replace the action, or Hypatia downgrades float-transitives.

The diff is +9 / −0, a pure append. No existing entry is touched.

Follow-up worth considering (not in this PR)

One triage decision now needs two baseline entries that differ in a single field, and nothing warns you when you write only one — which is precisely how main went red. Letting rule_module accept a list would make one decision one entry. That is a schema + apply-baseline.sh + test change, so it is deliberately out of scope here; filing separately.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

[coderabbitai]

Warning

Review limit reached

Next included review available in 37 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 286a40c1-79cc-45b4-a17d-c4d8d6d38d2b

📥 Commits

Reviewing files that changed from the base of the PR and between 9c256b6 and ba08ae0.

📒 Files selected for processing (1)

• .hypatia-baseline.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud