chore(deps): bump hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml from d449286904ce8a46717ecc9d5014868fff178b81 to 897159a4e7392eb2be76630c5c5d3c1132cce040 in the actions group across 1 directory (#132)

Bumps the actions group with 1 update in the / directory:
[hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attacker).

Updates
`hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml`
from d449286904ce8a46717ecc9d5014868fff178b81 to
897159a4e7392eb2be76630c5c5d3c1132cce040
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.md">hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>[Unreleased] — 2026-04-18</h2>
<h3>Added</h3>
<ul>
<li><strong>User-classification registry</strong>
(<code>assail::UserClassification</code>,
<code>load_user_classifications</code>,
<code>apply_user_classifications</code>): panic-attack
now reads an optional project-local classification file at every assail
pass and flips matching findings to <code>suppressed = true</code> after
the kanren
structural-suppression pass. Two lookup paths:
<ul>

<li><code>&lt;project_root&gt;/audits/assail-classifications.a2ml</code>
(preferred)</li>

<li><code>&lt;project_root&gt;/.panic-attack-classifications.a2ml</code>
(fallback)
File format is a simple A2ML S-expression with <code>(classification
(file …) (category …) (audit …) (rationale …))</code> blocks;
<code>;;</code> line comments
ignored. The registry pattern lets repositories record audited findings
out-of-band from the source under scan so a PR adding a new unsafe
block cannot self-suppress without a reviewable companion edit to
the registry.</li>
</ul>
</li>
<li><strong>Rocq scaffold classifier</strong> (<code>analyze_coq</code>
+
<code>count_rocq_unverified_postulates</code> +
<code>is_rocq_abstraction_parameter</code>):
the Rocq detector no longer counts Section-scoped <code>Variable</code>
/
<code>Hypothesis</code> / <code>Parameter</code> declarations (they
discharge at <code>End Section</code>) and classifies module-level
<code>Parameter</code> declarations by
stated type: carrier types (<code>Type</code>, <code>Set</code>),
decidability witnesses
(<code>forall _, { _ = _ } + { _ &lt;&gt; _ }</code>), and function
types with a
concrete non-Prop codomain are treated as abstraction parameters.
Prop-valued declarations (classical excluded-middle, choice,
unresolved theorem statements) remain counted. Removes the
false-positive stream that surfaced on every canonical-proof-suite
scaffold.</li>
</ul>
<h3>Changed</h3>
<ul>
<li><strong>Suppression pipeline</strong>: <code>analyze()</code> and
<code>analyze_verbose()</code> now
chain <code>apply_suppression</code> →
<code>apply_user_classifications</code> in that
order; the explicit post-analyze calls in <code>assail::analyze</code>
and
<code>assail::analyze_verbose</code> at the module boundary are retained
for
API-contract clarity but are no-ops when an <code>Analyzer</code> pass
has
already run.</li>
<li><strong>Rocq test coverage</strong>: 12 new unit tests across
<code>analyzer.rs</code>
(Section-scoped Variables / module-level Type carriers / decidable
equality / concrete-codomain functions / Prop-valued axioms /
missing type annotation / full scaffold shape — 7 tests) and
<code>mod.rs</code> (missing-registry / single-entry / multiple-entry /
comment handling / end-to-end suppression-flip — 5 tests).</li>
</ul>
<h3>Verified</h3>
<ul>
<li>007 canonical-proof-suite scan: active finding count <strong>8 →
0</strong>
(the 6 scaffold ProofDrifts via the detector enhancement, the 2
<code>zig_bridge.rs</code> UnsafeCode findings via the classification
registry
pointing at <code>audits/audit-ffi-unsafe.md §1</code>). No
in-source</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/897159a4e7392eb2be76630c5c5d3c1132cce040"><code>897159a</code></a>
feat(bridge): cohort overrides for vendored-pin (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/74">#74</a>)
+ Dioxus/GTK transitive...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/5266c4b8f3379bec3866be76bde6956482789497"><code>5266c4b</code></a>
feat(assail): downgrade flake.lock-only SupplyChain to Severity::Low
(mechani...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/b2e58a92e3bc21c4666ca6832df384b5487ed687"><code>b2e58a9</code></a>
feat(assail): exclude vendored-snapshot dirs from analysis (refile of <a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/72">#72</a>
aft...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/03fdd9f506a2a895dcd52751e4156dd327f7c91a"><code>03fdd9f</code></a>
feat(bridge): split phantom into phantom-declared vs phantom-transitive
(<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/76">#76</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/1811b7bf8c96329b7d8044410846b425b98d6356"><code>1811b7b</code></a>
feat(assail): exempt Julia *Ext.jl from DynamicCodeExecution (idiomatic
packa...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/7935204c8511089dbc3dd561bbcab44b7371049c"><code>7935204</code></a>
feat(query): facts-backed (crosslang :from :to) evaluator (issue <a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/33">#33</a>
follow-u...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/dcfb96b927278c8e311163adfe7add9ba55340cb"><code>dcfb96b</code></a>
feat(storage): persist kanren CrossLangInteraction as hexads (issue <a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/33">#33</a>
follo...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/acd329fe0146878498de24cd4b556fc9f2efd06b"><code>acd329f</code></a>
feat(campaign): panic-attack campaign poll — GitHub PR transitions
(issue <a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/33">#33</a>...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/5e86c1e7919fd5d998576e176d879ddbe6e61efb"><code>5e86c1e</code></a>
feat(query): (crosslang ...) + (since ...) forms (issue <a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/33">#33</a>
S3b+c) (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/58">#58</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/732b409c4f460db5e74844585e4ad64fc39dfdfd"><code>732b409</code></a>
feat(query): panic-attack query subcommand (issue <a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/33">#33</a>
S3) (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/57">#57</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/hyperpolymath/panic-attacker/compare/d449286904ce8a46717ecc9d5014868fff178b81...897159a4e7392eb2be76630c5c5d3c1132cce040">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/security-scan.yml

@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@d449286904ce8a46717ecc9d5014868fff178b81
+    uses: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@897159a4e7392eb2be76630c5c5d3c1132cce040
 
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}