fix(baseline): collapse the two invalid_actions_lock acks into one

[hyperpolymath]

Spends the capability #971 added. Closes the loop on #966.

What

.hypatia-baseline.json: 212 → 211 entries. The two invalid_actions_lock
acknowledgements become one entry whose rule_module is
["workflow_audit", "workflow_hardening"].

Hypatia emits this one defect from two rule modules — workflow_audit /
parse_actions_lock (file actions.lock) and WH004 standalone
(workflow_hardening, full path). Acking it twice meant two expiry dates for
one decision: whichever half expires first silently reopens the gate while
the ledger still looks correct in every visible respect. That is the shape
#966 was filed about.

The ratchet is satisfied with no Ratchet-exception trailer — the ledger
shrank:

SHRANK         .hypatia-baseline.json: 212 -> 211  <- debt paid down
Exemption ratchet: OK.

⚠ This is a widening, not a refactor — stated, not buried

One entry carries one matcher, and the two emissions carry different file
values, so the surviving entry must match by file_pattern. The
workflow_hardening half therefore moves from the exact path
.github/workflows/actions.lock to **actions.lock — the breadth the
workflow_audit half already had at the same severity and type.

Measured, not assumed:

finding	before	after
workflow_hardening / invalid_actions_lock @ vendor/actions.lock	KEPT	SUPPRESSED

Accepted because both halves are the same defect with the same exit criteria.
The entry's note records the widening and says to narrow this entry if a
second actions.lock is ever vendored, rather than trusting it.

(** in a pattern is allowed here: the ratchet's no-wildcard rule 3 binds the
banned-language migration ledger, and explicitly carves out
.hypatia-baseline.json "where a note explains them". This entry carries both
a note and a tracking_issue, so it is also not anonymous debt under rule 2.)

Tests — 26 → 29, reading the shipped ledger

The three new assertions run against the real .hypatia-baseline.json, not
a fixture, so the collapse itself is pinned rather than merely demonstrated.

Two mutants, each killed by the right assertion:

mutant	assertion that reds	result
split the entry back into two	"one entry naming two modules"	2,1 ≠ 1,2
swap file_pattern for an exact file	"suppresses BOTH emission paths"	1,1

The second mutant is the valuable one: 1,1 is exactly the half-suppression
that reddens main — the #966 symptom reproduced on demand.

An over-match control asserts the ack is not a blanket amnesty for
actions.lock: a different type and a different rule_module are both still
kept (0,2).

Verification

• 52/52 local suites green (scripts/tests/*.sh, tests/*.sh); no regressions.
• The collapsed ledger validates against hypatia-baseline.schema.json and
  suppresses both real emissions through the real scripts/apply-baseline.sh
  (suppressed=2 kept=0).
• governance-reusable.yml:282 prefers the caller's own
  scripts/apply-baseline.sh, so standards self-lints with the tree under
  test — this PR's ledger is filtered by this PR's script, not by main's.
• The ledger edit is +5/−11 and local: jq -a --indent 1 was confirmed to
  round-trip the file byte-identically before editing, so the diff shows
  only the two acks (the file stores em-dashes as —; without -a the
  whole ledger reflows).

Second commit — the ack pointed at a closed tracking issue

48415f6b repoints tracking_issue from #951 to #963. #951 was closed
COMPLETED with zero comments while its defect is demonstrably live:
.github/workflows/actions.lock:210 still declares the floating transitive
actions/setup-python@v2 under the asana/push-signed-commits pin, and
setup-python is never a top-level lock key. The cause is supersession, not
error — #963 is OPEN and carries the cure; the ledger simply never
followed. So this is a repoint, not a reopen.

That find generalised: 20 of the 211 acks cite a closed issue, across 7
closed issues. This PR fixes the 2 that cited #951; the remaining 18 are
filed as #975 with the evidence, deliberately not swept — each needs
checking against the issue that actually superseded it.

Refs #966, #951, #963, #971, #975.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

[coderabbitai]

Warning

Review limit reached

Next included review available in 49 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: bcc141cc-0721-4932-ad4c-cc36ab2773a8

📥 Commits

Reviewing files that changed from the base of the PR and between 436a89b and 48415f6.

📒 Files selected for processing (2)

• .hypatia-baseline.json
• scripts/tests/apply-baseline-test.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud