chore(deps): bump hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml from 136b38b305e5b04847de461cfbcdf73e1ff289f2 to d449286904ce8a46717ecc9d5014868fff178b81 in the actions group across 1 directory (#101)

[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps the actions group with 1 update in the / directory:
[hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attacker).

Updates
`hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml`
from 136b38b305e5b04847de461cfbcdf73e1ff289f2 to
d449286904ce8a46717ecc9d5014868fff178b81
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.md">hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>[Unreleased] — 2026-04-18</h2>
<h3>Added</h3>
<ul>
<li><strong>User-classification registry</strong>
(<code>assail::UserClassification</code>,
<code>load_user_classifications</code>,
<code>apply_user_classifications</code>): panic-attack
now reads an optional project-local classification file at every assail
pass and flips matching findings to <code>suppressed = true</code> after
the kanren
structural-suppression pass. Two lookup paths:
<ul>

<li><code>&lt;project_root&gt;/audits/assail-classifications.a2ml</code>
(preferred)</li>

<li><code>&lt;project_root&gt;/.panic-attack-classifications.a2ml</code>
(fallback)
File format is a simple A2ML S-expression with <code>(classification
(file …) (category …) (audit …) (rationale …))</code> blocks;
<code>;;</code> line comments
ignored. The registry pattern lets repositories record audited findings
out-of-band from the source under scan so a PR adding a new unsafe
block cannot self-suppress without a reviewable companion edit to
the registry.</li>
</ul>
</li>
<li><strong>Rocq scaffold classifier</strong> (<code>analyze_coq</code>
+
<code>count_rocq_unverified_postulates</code> +
<code>is_rocq_abstraction_parameter</code>):
the Rocq detector no longer counts Section-scoped <code>Variable</code>
/
<code>Hypothesis</code> / <code>Parameter</code> declarations (they
discharge at <code>End Section</code>) and classifies module-level
<code>Parameter</code> declarations by
stated type: carrier types (<code>Type</code>, <code>Set</code>),
decidability witnesses
(<code>forall _, { _ = _ } + { _ &lt;&gt; _ }</code>), and function
types with a
concrete non-Prop codomain are treated as abstraction parameters.
Prop-valued declarations (classical excluded-middle, choice,
unresolved theorem statements) remain counted. Removes the
false-positive stream that surfaced on every canonical-proof-suite
scaffold.</li>
</ul>
<h3>Changed</h3>
<ul>
<li><strong>Suppression pipeline</strong>: <code>analyze()</code> and
<code>analyze_verbose()</code> now
chain <code>apply_suppression</code> →
<code>apply_user_classifications</code> in that
order; the explicit post-analyze calls in <code>assail::analyze</code>
and
<code>assail::analyze_verbose</code> at the module boundary are retained
for
API-contract clarity but are no-ops when an <code>Analyzer</code> pass
has
already run.</li>
<li><strong>Rocq test coverage</strong>: 12 new unit tests across
<code>analyzer.rs</code>
(Section-scoped Variables / module-level Type carriers / decidable
equality / concrete-codomain functions / Prop-valued axioms /
missing type annotation / full scaffold shape — 7 tests) and
<code>mod.rs</code> (missing-registry / single-entry / multiple-entry /
comment handling / end-to-end suppression-flip — 5 tests).</li>
</ul>
<h3>Verified</h3>
<ul>
<li>007 canonical-proof-suite scan: active finding count <strong>8 →
0</strong>
(the 6 scaffold ProofDrifts via the detector enhancement, the 2
<code>zig_bridge.rs</code> UnsafeCode findings via the classification
registry
pointing at <code>audits/audit-ffi-unsafe.md §1</code>). No
in-source</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/d449286904ce8a46717ecc9d5014868fff178b81"><code>d449286</code></a>
chore(ci): convert hypatia-scan.yml to wrapper of standards reusable (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/54">#54</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/0f6ea9480e5a14a1a62f62cccad4c23864908cc3"><code>0f6ea94</code></a>
fix: bound three unbounded file reads (resolves self-scan Critical) (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/51">#51</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/ea02d50aa476bc62d5d65d3d31b62d97c84305ab"><code>ea02d50</code></a>
fix(bridge): distinguish direct vs transitive phantom deps (closes <a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/47">#47</a>)
(<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/50">#50</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/db0e1b7b136f918fec52709d491ecdf01e9255ef"><code>db0e1b7</code></a>
fix(assail): PA021 Isabelle detector skips prose blocks + antiquotations
(clo...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/7766c1880632be43677360f2141e13071ec3dff0"><code>7766c18</code></a>
fix(proofs): align Idris Lang enum with Rust (Chapel not C) — closes <a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/41">#41</a>
(<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/46">#46</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/edf8d6ea3f0bb010847e460ddb07bf2cd1506561"><code>edf8d6e</code></a>
ci(rust): convert rust-ci.yml to thin wrapper (standards#174) (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/45">#45</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/da58c21a75c2f732f826b29412fbee283461c0c9"><code>da58c21</code></a>
fix(gui): make headless GUI path feature-independent (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/44">#44</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/43d36caac891498525a60af9a6c07a18c53b95f8"><code>43d36ca</code></a>
docs: post-rename hygiene + stale-fact refresh (26 files) (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/40">#40</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/2e7b1ab4fe2ccb07cf7989f0bdd5b8f7c0ca6df9"><code>2e7b1ab</code></a>
chore(msrv): feature-gate eframe/egui behind opt-in <code>gui</code>
feature (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/39">#39</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/0d54dc37b9675cd1559f52e85c9544f4ab7175f3"><code>0d54dc3</code></a>
chore(pre-commit): SHA-pin a2ml + k9 hooks (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/37">#37</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/hyperpolymath/panic-attacker/compare/136b38b305e5b04847de461cfbcdf73e1ff289f2...d449286904ce8a46717ecc9d5014868fff178b81">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/security-scan.yml

@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@136b38b305e5b04847de461cfbcdf73e1ff289f2
+    uses: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@d449286904ce8a46717ecc9d5014868fff178b81
 
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}