Skip to content

Commit e9c98f5

Browse files
hyperpolymathhyperpolymath
committed
fix(ci): adopt canonical hypatia-scan.yml (env.HOME/scanner-layout + Comment-step gate)
1 parent 8cb565b commit e9c98f5

1 file changed

Lines changed: 110 additions & 71 deletions

File tree

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 110 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-License-Identifier: MPL-2.0
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
22
# Hypatia Neurosymbolic CI/CD Security Scan
33
name: Hypatia Security Scan
44

@@ -10,19 +10,31 @@ on:
1010
schedule:
1111
- cron: '0 0 * * 0' # Weekly on Sunday
1212
workflow_dispatch:
13+
# Estate guardrail: cancel superseded runs so re-pushes don't pile up
14+
# queued runs across the estate. Safe here because this workflow only
15+
# performs read-only checks/lint/test/scan with no publish or mutation.
16+
concurrency:
17+
group: ${{ github.workflow }}-${{ github.ref }}
18+
cancel-in-progress: true
1319

1420
permissions:
1521
contents: read
16-
security-events: read # Hypatia queries Dependabot alerts via the GraphQL API
22+
# security-events: read lets the built-in GITHUB_TOKEN query this
23+
# repo's own Dependabot alerts via the Hypatia DependabotAlerts rule
24+
# (DA001-DA004). Without this, `scan_from_path` gets HTTP 403 and
25+
# the rule silently returns no findings.
26+
# See 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
27+
security-events: read
28+
# pull-requests: write lets the advisory "Comment on PR with findings"
29+
# step post its summary. Without it the built-in GITHUB_TOKEN gets
30+
# "Resource not accessible by integration" and (absent continue-on-error)
31+
# hard-fails the scan — exactly what the gate-decoupling design forbids.
32+
pull-requests: write
1733

1834
jobs:
1935
scan:
2036
name: Hypatia Neurosymbolic Analysis
2137
runs-on: ubuntu-latest
22-
env:
23-
# Hypatia's CLI calls `gh api` for Dependabot alert lookups; without this
24-
# env var it logs "Dependabot alerts unavailable: GITHUB_TOKEN not set".
25-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2638

2739
steps:
2840
- name: Checkout repository
@@ -37,107 +49,129 @@ jobs:
3749
otp-version: '28.3'
3850

3951
- name: Clone Hypatia
40-
id: clone_hypatia
41-
continue-on-error: true
4252
run: |
43-
HYPATIA_DIR="${GITHUB_WORKSPACE}/../hypatia"
44-
if [ ! -d "$HYPATIA_DIR" ]; then
45-
git clone --depth 1 https://github.com/hyperpolymath/hypatia.git "$HYPATIA_DIR" || {
46-
echo "::warning::Hypatia clone failed — scan will be skipped"
47-
exit 0
48-
}
53+
if [ ! -d "$HOME/hypatia" ]; then
54+
git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia"
4955
fi
50-
echo "HYPATIA_DIR=$HYPATIA_DIR" >> "$GITHUB_ENV"
51-
echo "hypatia_ready=true" >> "$GITHUB_OUTPUT"
5256
5357
- name: Build Hypatia scanner (if needed)
54-
if: steps.clone_hypatia.outputs.hypatia_ready == 'true'
55-
id: build_hypatia
56-
continue-on-error: true
5758
run: |
58-
cd "$HYPATIA_DIR"
59-
if [ ! -f hypatia ] && [ ! -f hypatia-v2 ]; then
60-
echo "Building hypatia-v2 scanner..."
61-
mix deps.get --quiet || { echo "::warning::mix deps.get failed"; exit 0; }
62-
mix escript.build || { echo "::warning::mix escript.build failed"; exit 0; }
59+
cd "$HOME/hypatia"
60+
if [ ! -f hypatia ]; then
61+
echo "Building hypatia scanner..."
62+
mix deps.get
63+
mix escript.build
6364
fi
64-
echo "scanner_ready=true" >> "$GITHUB_OUTPUT"
6565
6666
- name: Run Hypatia scan
6767
id: scan
68-
if: steps.build_hypatia.outputs.scanner_ready == 'true'
68+
env:
69+
# Pass the built-in Actions token through to Hypatia so the
70+
# DependabotAlerts rule can query this repo's own alerts.
71+
# For cross-repo scanning (fleet-coordinator scan-supervised),
72+
# a PAT with `security_events` scope is required instead.
73+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
6974
run: |
7075
echo "Scanning repository: ${{ github.repository }}"
7176
72-
# Run scanner — failures here must not red the check; scanner-infra
73-
# issues are tracked upstream and surface as a warning instead.
74-
HYPATIA_FORMAT=json "$HYPATIA_DIR/hypatia-cli.sh" scan . > hypatia-findings.json 2>scan-stderr.log || {
75-
echo "::warning::hypatia-cli.sh exited non-zero — see scan-stderr.log"
76-
echo "[]" > hypatia-findings.json
77-
}
78-
79-
# If the scanner wrote something that isn't a JSON array, normalise to [].
80-
if ! jq -e 'type == "array"' hypatia-findings.json >/dev/null 2>&1; then
81-
echo "::warning::hypatia-findings.json is not a JSON array — treating as empty"
82-
echo "[]" > hypatia-findings.json
83-
fi
77+
# Run scanner (exits non-zero when findings exist — suppress to continue)
78+
HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia-findings.json || true
79+
80+
# Count findings
81+
FINDING_COUNT=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0)
82+
echo "findings_count=$FINDING_COUNT" >> $GITHUB_OUTPUT
83+
84+
# Extract severity counts
85+
CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json)
86+
HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json)
87+
MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' hypatia-findings.json)
8488
85-
FINDING_COUNT=$(jq 'length' hypatia-findings.json 2>/dev/null || echo 0)
86-
CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json 2>/dev/null || echo 0)
87-
HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json 2>/dev/null || echo 0)
88-
MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' hypatia-findings.json 2>/dev/null || echo 0)
89-
90-
{
91-
echo "findings_count=$FINDING_COUNT"
92-
echo "critical=$CRITICAL"
93-
echo "high=$HIGH"
94-
echo "medium=$MEDIUM"
95-
} >> "$GITHUB_OUTPUT"
96-
97-
{
98-
echo "## Hypatia Scan Results"
99-
echo "- Total findings: $FINDING_COUNT"
100-
echo "- Critical: $CRITICAL"
101-
echo "- High: $HIGH"
102-
echo "- Medium: $MEDIUM"
103-
} >> "$GITHUB_STEP_SUMMARY"
89+
echo "critical=$CRITICAL" >> $GITHUB_OUTPUT
90+
echo "high=$HIGH" >> $GITHUB_OUTPUT
91+
echo "medium=$MEDIUM" >> $GITHUB_OUTPUT
92+
93+
echo "## Hypatia Scan Results" >> $GITHUB_STEP_SUMMARY
94+
echo "- Total findings: $FINDING_COUNT" >> $GITHUB_STEP_SUMMARY
95+
echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY
96+
echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY
97+
echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
10498
10599
- name: Upload findings artifact
106-
if: steps.build_hypatia.outputs.scanner_ready == 'true'
107-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
100+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
108101
with:
109102
name: hypatia-findings
110103
path: hypatia-findings.json
111104
retention-days: 90
112105

113106
- name: Submit findings to gitbot-fleet (Phase 2)
114107
if: steps.scan.outputs.findings_count > 0
108+
# Phase 2 is the collaborative LEARNING side-channel ("bots share
109+
# findings via gitbot-fleet"), not the security gate. The gate is
110+
# the baseline-aware "Check for critical or high-severity issues"
111+
# step below. A fleet-side regression (e.g. the submit script being
112+
# moved/removed) must NEVER hard-fail every consuming repo's scan.
113+
# Same reasoning as the "Comment on PR with findings" step.
114+
# See hyperpolymath/hypatia#213 (gate decoupling) and the exit-127
115+
# estate-wide breakage when gitbot-fleet/scripts/submit-finding.sh
116+
# no longer existed on the default branch.
115117
continue-on-error: true
116118
env:
119+
# All GitHub context values surface as env vars so the run
120+
# block never interpolates `${{ … }}` inline (closes the
121+
# workflow_audit/unsafe_curl_payload + actions_expression_injection
122+
# findings).
117123
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
124+
FLEET_PUSH_TOKEN: ${{ secrets.HYPATIA_DISPATCH_PAT }}
125+
FLEET_DISPATCH_TOKEN: ${{ secrets.HYPATIA_DISPATCH_PAT }}
118126
GITHUB_REPOSITORY: ${{ github.repository }}
119127
GITHUB_SHA: ${{ github.sha }}
128+
FINDINGS_COUNT: ${{ steps.scan.outputs.findings_count }}
120129
run: |
121-
echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..."
130+
echo "📤 Submitting $FINDINGS_COUNT findings to gitbot-fleet..."
122131
123-
# Clone gitbot-fleet to temp directory. Private repo — if unauthenticated,
124-
# skip with a warning rather than failing the whole workflow.
132+
# Clone gitbot-fleet to temp directory. A clone failure (network,
133+
# repo gone) is non-fatal: learning submission is best-effort.
125134
FLEET_DIR="/tmp/gitbot-fleet-$$"
126-
if ! git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR" 2>/dev/null; then
127-
echo "::warning::gitbot-fleet clone failed (likely private/no auth) — skipping submission"
135+
if ! git clone --depth 1 https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR"; then
136+
echo "::warning::Could not clone gitbot-fleet — skipping Phase 2 learning submission (non-fatal)."
128137
exit 0
129138
fi
130139
131-
# Run submission script
132-
bash "$FLEET_DIR/scripts/submit-finding.sh" "$(pwd)/hypatia-findings.json" || {
133-
echo "::warning::submit-finding.sh failed — see step log"
134-
}
140+
# The submission script's location in gitbot-fleet has drifted
141+
# before (it was absent from the default branch, which exit-127'd
142+
# every consuming repo's scan). Probe known locations rather than
143+
# hard-coding one path, and skip gracefully if none is present.
144+
SUBMIT_SCRIPT=""
145+
for cand in \
146+
"$FLEET_DIR/scripts/submit-finding.sh" \
147+
"$FLEET_DIR/scripts/submit_finding.sh" \
148+
"$FLEET_DIR/bin/submit-finding.sh" \
149+
"$FLEET_DIR/submit-finding.sh"; do
150+
if [ -f "$cand" ]; then
151+
SUBMIT_SCRIPT="$cand"
152+
break
153+
fi
154+
done
155+
156+
if [ -z "$SUBMIT_SCRIPT" ]; then
157+
echo "::warning::gitbot-fleet submit-finding script not found at any known path — skipping Phase 2 learning submission (non-fatal). Findings are still uploaded as an artifact and gated below."
158+
rm -rf "$FLEET_DIR"
159+
exit 0
160+
fi
161+
162+
# Run submission script. Pass the findings path as ABSOLUTE —
163+
# the script cd's into its own working dir before reading the
164+
# file, so a relative path would resolve to the wrong place.
165+
# A submission-script failure is logged but non-fatal.
166+
if bash "$SUBMIT_SCRIPT" "$GITHUB_WORKSPACE/hypatia-findings.json"; then
167+
echo "✅ Finding submission complete"
168+
else
169+
echo "::warning::gitbot-fleet submission script exited non-zero — Phase 2 learning submission skipped (non-fatal)."
170+
fi
135171
136172
# Cleanup
137173
rm -rf "$FLEET_DIR"
138174
139-
echo "✅ Finding submission complete"
140-
141175
- name: Check for critical issues
142176
if: steps.scan.outputs.critical > 0
143177
run: |
@@ -182,6 +216,11 @@ jobs:
182216
183217
- name: Comment on PR with findings
184218
if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0
219+
# Advisory only — posting findings as a PR comment must never gate
220+
# the scan (hypatia#213 gate decoupling). Belt-and-braces alongside
221+
# the pull-requests: write permission above: a token/API hiccup or
222+
# a fork PR (read-only token) skips the comment, not the check.
223+
continue-on-error: true
185224
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v7
186225
with:
187226
script: |
@@ -212,4 +251,4 @@ jobs:
212251
repo: context.repo.repo,
213252
issue_number: context.issue.number,
214253
body: comment
215-
});
254+
});

0 commit comments

Comments
 (0)