From ba08ae0a6ea80b0f5b6a10af13f058ca61be7846 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 22 Sep 2026 11:48:46 +0100 Subject: [PATCH] fix(hypatia): ack the workflow_hardening copy of the lock finding main has been red since #954 (9c256b67). The round-2 acknowledgement covers the invalid_actions_lock finding as emitted by rule_module "workflow_audit", but Hypatia emits the SAME defect a second time from rule_module "workflow_hardening", carrying file ".github/workflows/actions.lock". scripts/apply-baseline.sh:188 matches rule_module by exact string equality, so one copy was suppressed and the other kept blocking. The file_pattern was never the problem: "**actions.lock" globs to \A.*actions\.lock\z and matches the full path fine. Reproduced locally against main's own committed apply-baseline.sh, schema and baseline, using the finding copied verbatim from the failing run 35716729172: before: kept=1 suppressed=0 ::error::Gate failed: 1 unfiltered finding(s) at or above 'high'. exit=1 after: kept=0 suppressed=1 exit=0 Four negative controls confirm the new entry suppresses only this exact finding - a critical-severity copy, a different rule_module, a different type, and a non-lock file are all still KEPT (kept=4). Suites: apply-baseline-test.sh 15/0, filter-sarif-by-baseline-test.sh 13/0, hypatia-blocking-gate-test.sh 4/4. The exposure is unchanged and is NOT newly accepted here: asana/push- signed-commits@d615 (immutable pin, ref v1.3) declares transitive actions/setup-python@v2, which floats upstream and can never be a lock key. gh-actions-lock v0.1.6 verify says valid:true on the same file. The exit remains #951's: Asana pins setup-python, we replace the action, or Hypatia downgrades float-transitives. Ratchet-exception: .hypatia-baseline.json -- second module emitting an already-acknowledged finding; this documents the existing #951 debt at its second emission site rather than accepting new debt. Entry count 211 -> 212, exposure unchanged. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR --- .hypatia-baseline.json | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.hypatia-baseline.json b/.hypatia-baseline.json index 9c7481e2..0b26b3d6 100644 --- a/.hypatia-baseline.json +++ b/.hypatia-baseline.json @@ -1732,5 +1732,14 @@ "note": "TRIAGED (round-2 fix-forward 2026-09-22): Hypatia workflow_audit fails the lock closed with transitive_dependencies_missing -- asana/push-signed-commits@d615 (immutable pin, ref v1.3) declares transitive actions/setup-python@v2, which floats upstream and can never be a lock key. gh-actions-lock v0.1.6 verify says valid:true on the same file; Hypatia is stricter than the authoritative tool. Exposure is upstream float only. Exit: Asana pins setup-python, we replace the action, or Hypatia downgrades float-transitives. #947 deleted the metadata to silence the scanner; round 2 restored it verbatim and acked honestly.", "expires_at": "2026-12-22", "tracking_issue": "hyperpolymath/standards#951" + }, + { + "severity": "high", + "rule_module": "workflow_hardening", + "type": "invalid_actions_lock", + "file_pattern": "**actions.lock", + "note": "TRIAGED (round-3 fix-forward 2026-09-22): the SAME invalid_actions_lock defect already acknowledged for rule_module 'workflow_audit' is ALSO emitted by rule_module 'workflow_hardening', whose finding carries file '.github/workflows/actions.lock'. apply-baseline.sh matches rule_module by EXACT string equality (scripts/apply-baseline.sh:188), so the round-2 acknowledgement suppressed one copy and left the other blocking main. Same defect, same exposure: asana/push-signed-commits@d615 (immutable pin, ref v1.3) declares transitive actions/setup-python@v2, which floats upstream and can never be a lock key; gh-actions-lock v0.1.6 verify says valid:true on the same file. Exit is identical to #951: Asana pins setup-python, we replace the action, or Hypatia downgrades float-transitives.", + "expires_at": "2026-12-22", + "tracking_issue": "hyperpolymath/standards#951" } ]