ci(hypatia): standardise the wrapper caller id to the canonical hypatia

[hyperpolymath]

The check a reusable-caller job publishes is <caller job id> / <inner job display name>. The estate's canonical required context is hypatia / Hypatia Neurosymbolic Analysis (docs/audits/audit-hypatia-pin-orphan-2026-05-27.adoc), so the caller job must be named hypatia. This wrapper named it scan, and so published scan / Hypatia Neurosymbolic Analysis — two names for one gate, and any requirement written against one is unsatisfiable in a repository that publishes the other (the defect class of hyperpolymath/tropical-types#17).

Rename only — the job body, its pin, its inputs and its secrets are byte-for-byte unchanged.

Audit-first, requirement-aware: this is --fix output from scripts/propagate-hypatia-caller-id.sh in hyperpolymath/standards (the script stages; it never commits or pushes). The repository's active branch rulesets were read before the rename — no rule here names the old prefixed context, so the published name and every requirement stay in agreement.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: e3c0c054-9ed4-4b6e-a0ba-d2c331ebefaa

📥 Commits

Reviewing files that changed from the base of the PR and between ea57ab2 and dd43761.

📒 Files selected for processing (1)

• .github/workflows/hypatia-scan.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (6)

• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: Hypatia neurosymbolic scan
• GitHub Check: Patch Bridge CVE triage
• GitHub Check: panic-attack assail
• GitHub Check: openssf-compliance
• GitHub Check: lint-workflows

⚠️ CI failures not shown inline (2)

GitHub Actions: Workflow Security Linter / 0_lint-workflows.txt: ci(hypatia): standardise the wrapper caller id to the canonical `hypa…

Conclusion: failure

View job details

##[group]Run echo "=== Checking SPDX License Headers ==="
 �[36;1mecho "=== Checking SPDX License Headers ==="�[0m
 �[36;1mfailed=0�[0m
 �[36;1mfor file in .github/workflows/*.yml .github/workflows/*.yaml; do�[0m
 �[36;1m  [ -f "$file" ] || continue�[0m
 �[36;1m  if ! head -1 "$file" | grep -q "^# SPDX-License-Identifier:"; then�[0m
 �[36;1m    echo "ERROR: $file missing SPDX header"�[0m
 �[36;1m    failed=1�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1mif [ $failed -eq 1 ]; then�[0m
 �[36;1m  echo "Add '# SPDX-License-Identifier: MPL-2.0' as first line"�[0m
 �[36;1m  exit 1�[0m
 �[36;1mfi�[0m
 �[36;1mecho "All workflows have SPDX headers"�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 === Checking SPDX License Headers ===
 ERROR: .github/workflows/ada-ci.yml missing SPDX header
 ERROR: .github/workflows/dogfood-gate.yml missing SPDX header
 ERROR: .github/workflows/hypatia-scan.yml missing SPDX header
 ERROR: .github/workflows/label-triage.yml missing SPDX header
 ERROR: .github/workflows/labels.yml missing SPDX header
 ERROR: .github/workflows/openssf-compliance.yml missing SPDX header
 ERROR: .github/workflows/static-analysis-gate.yml missing SPDX header
 ERROR: .github/workflows/workflow-linter.yml missing SPDX header
 Add '# SPDX-License-Identifier: MPL-2.0' as first line
 ##[error]Process completed with exit code 1.

---

GitHub Actions: Workflow Security Linter / lint-workflows: ci(hypatia): standardise the wrapper caller id to the canonical `hypa…

Conclusion: failure

View job details

##[group]Run echo "=== Checking SPDX License Headers ==="
 �[36;1mecho "=== Checking SPDX License Headers ==="�[0m
 �[36;1mfailed=0�[0m
 �[36;1mfor file in .github/workflows/*.yml .github/workflows/*.yaml; do�[0m
 �[36;1m  [ -f "$file" ] || continue�[0m
 �[36;1m  if ! head -1 "$file" | grep -q "^# SPDX-License-Identifier:"; then�[0m
 �[36;1m    echo "ERROR: $file missing SPDX header"�[0m
 �[36;1m    failed=1�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1mif [ $failed -eq 1 ]; then�[0m
 �[36;1m  echo "Add '# SPDX-License-Identifier: MPL-2.0' as first line"�[0m
 �[36;1m  exit 1�[0m
 �[36;1mfi�[0m
 �[36;1mecho "All workflows have SPDX headers"�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 === Checking SPDX License Headers ===
 ERROR: .github/workflows/ada-ci.yml missing SPDX header
 ERROR: .github/workflows/dogfood-gate.yml missing SPDX header
 ERROR: .github/workflows/hypatia-scan.yml missing SPDX header
 ERROR: .github/workflows/label-triage.yml missing SPDX header
 ERROR: .github/workflows/labels.yml missing SPDX header
 ERROR: .github/workflows/openssf-compliance.yml missing SPDX header
 ERROR: .github/workflows/static-analysis-gate.yml missing SPDX header
 ERROR: .github/workflows/workflow-linter.yml missing SPDX header
 Add '# SPDX-License-Identifier: MPL-2.0' as first line
 ##[error]Process completed with exit code 1.

🧰 Additional context used

🪛 GitHub Actions: Workflow Security Linter / 0_lint-workflows.txt

.github/workflows/hypatia-scan.yml

[error] 1-1: SPDX license header is missing. Add '# SPDX-License-Identifier: MPL-2.0' as the first line.

🪛 GitHub Actions: Workflow Security Linter / lint-workflows

.github/workflows/hypatia-scan.yml

[error] 1-1: SPDX license header check failed. Add '# SPDX-License-Identifier: MPL-2.0' as the first line.

🔇 Additional comments (1)

.github/workflows/hypatia-scan.yml (1)

30-30: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the internal security scanning workflow’s job label for improved consistency.
  • Security scan triggers, permissions, concurrency settings, and pinned workflow revision remain unchanged.

Walkthrough

The GitHub Actions workflow renames the Hypatia security scan job from scan to hypatia. All other workflow settings remain unchanged.

Changes

Hypatia workflow

Layer / File(s)	Summary
Rename the Hypatia job .github/workflows/hypatia-scan.yml	The job identifier changes from scan to hypatia. The workflow reference, revision, triggers, permissions, and concurrency settings remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: renaming the Hypatia wrapper caller ID to the canonical hypatia.
Description check	✅ Passed	The description directly explains the job rename, the resulting check context, and the unchanged workflow implementation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow name
The scan runs on the same fixed frame
Hypatia hops into the queue
The triggers stay exactly true
No other settings change their place}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud