1- # SPDX-License-Identifier: MPL-2.0
1+ # SPDX-License-Identifier: PMPL-1.0-or-later
22# Hypatia Neurosymbolic CI/CD Security Scan
33name : Hypatia Security Scan
44
1010 schedule :
1111 - cron : ' 0 0 * * 0' # Weekly on Sunday
1212 workflow_dispatch :
13+ # Estate guardrail: cancel superseded runs so re-pushes don't pile up
14+ # queued runs across the estate. Safe here because this workflow only
15+ # performs read-only checks/lint/test/scan with no publish or mutation.
16+ concurrency :
17+ group : ${{ github.workflow }}-${{ github.ref }}
18+ cancel-in-progress : true
1319
1420permissions :
1521 contents : read
16- security-events : read # Hypatia queries Dependabot alerts via the GraphQL API
22+ # security-events: read lets the built-in GITHUB_TOKEN query this
23+ # repo's own Dependabot alerts via the Hypatia DependabotAlerts rule
24+ # (DA001-DA004). Without this, `scan_from_path` gets HTTP 403 and
25+ # the rule silently returns no findings.
26+ # See 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
27+ security-events : read
28+ # pull-requests: write lets the advisory "Comment on PR with findings"
29+ # step post its summary. Without it the built-in GITHUB_TOKEN gets
30+ # "Resource not accessible by integration" and (absent continue-on-error)
31+ # hard-fails the scan — exactly what the gate-decoupling design forbids.
32+ pull-requests : write
1733
1834jobs :
1935 scan :
2036 name : Hypatia Neurosymbolic Analysis
2137 runs-on : ubuntu-latest
22- env :
23- # Hypatia's CLI calls `gh api` for Dependabot alert lookups; without this
24- # env var it logs "Dependabot alerts unavailable: GITHUB_TOKEN not set".
25- GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
2638
2739 steps :
2840 - name : Checkout repository
@@ -31,35 +43,39 @@ jobs:
3143 fetch-depth : 0 # Full history for better pattern analysis
3244
3345 - name : Setup Elixir for Hypatia scanner
34- uses : erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.18.2
46+ uses : erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.18.2
3547 with :
3648 elixir-version : ' 1.19.4'
3749 otp-version : ' 28.3'
3850
3951 - name : Clone Hypatia
4052 run : |
41- HYPATIA_DIR="${GITHUB_WORKSPACE}/../hypatia"
42- if [ ! -d "$HYPATIA_DIR" ]; then
43- git clone --depth 1 https://github.com/hyperpolymath/hypatia.git "$HYPATIA_DIR"
53+ if [ ! -d "$HOME/hypatia" ]; then
54+ git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia"
4455 fi
45- echo "HYPATIA_DIR=$HYPATIA_DIR" >> "$GITHUB_ENV"
4656
4757name : Build Hypatia scanner (if needed)
4858 run : |
49- cd "$HYPATIA_DIR "
50- if [ ! -f hypatia ] && [ ! -f hypatia-v2 ] ; then
51- echo "Building hypatia-v2 scanner..."
52- mix deps.get --quiet
59+ cd "$HOME/hypatia "
60+ if [ ! -f hypatia ]; then
61+ echo "Building hypatia scanner..."
62+ mix deps.get
5363 mix escript.build
5464 fi
5565
5666name : Run Hypatia scan
5767 id : scan
68+ env :
69+ # Pass the built-in Actions token through to Hypatia so the
70+ # DependabotAlerts rule can query this repo's own alerts.
71+ # For cross-repo scanning (fleet-coordinator scan-supervised),
72+ # a PAT with `security_events` scope is required instead.
73+ GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
5874 run : |
5975 echo "Scanning repository: ${{ github.repository }}"
6076
61- # Run scanner
62- HYPATIA_FORMAT=json "$HYPATIA_DIR /hypatia-cli.sh" scan . > hypatia-findings.json
77+ # Run scanner (exits non-zero when findings exist — suppress to continue)
78+ HYPATIA_FORMAT=json "$HOME /hypatia/hypatia -cli.sh" scan . --exit-zero > hypatia-findings.json || true
6379
6480 # Count findings
6581 FINDING_COUNT=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0)
@@ -81,33 +97,81 @@ jobs:
8197 echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
8298
8399name : Upload findings artifact
84- uses : actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
100+ uses : actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
85101 with :
86102 name : hypatia-findings
87103 path : hypatia-findings.json
88104 retention-days : 90
89105
90106 - name : Submit findings to gitbot-fleet (Phase 2)
91107 if : steps.scan.outputs.findings_count > 0
108+ # Phase 2 is the collaborative LEARNING side-channel ("bots share
109+ # findings via gitbot-fleet"), not the security gate. The gate is
110+ # the baseline-aware "Check for critical or high-severity issues"
111+ # step below. A fleet-side regression (e.g. the submit script being
112+ # moved/removed) must NEVER hard-fail every consuming repo's scan.
113+ # Same reasoning as the "Comment on PR with findings" step.
114+ # See hyperpolymath/hypatia#213 (gate decoupling) and the exit-127
115+ # estate-wide breakage when gitbot-fleet/scripts/submit-finding.sh
116+ # no longer existed on the default branch.
117+ continue-on-error : true
92118 env :
119+ # All GitHub context values surface as env vars so the run
120+ # block never interpolates `${{ … }}` inline (closes the
121+ # workflow_audit/unsafe_curl_payload + actions_expression_injection
122+ # findings).
93123 GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
124+ FLEET_PUSH_TOKEN : ${{ secrets.HYPATIA_DISPATCH_PAT }}
125+ FLEET_DISPATCH_TOKEN : ${{ secrets.HYPATIA_DISPATCH_PAT }}
94126 GITHUB_REPOSITORY : ${{ github.repository }}
95127 GITHUB_SHA : ${{ github.sha }}
128+ FINDINGS_COUNT : ${{ steps.scan.outputs.findings_count }}
96129 run : |
97- echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..."
130+ echo "📤 Submitting $FINDINGS_COUNT findings to gitbot-fleet..."
98131
99- # Clone gitbot-fleet to temp directory
132+ # Clone gitbot-fleet to temp directory. A clone failure (network,
133+ # repo gone) is non-fatal: learning submission is best-effort.
100134 FLEET_DIR="/tmp/gitbot-fleet-$$"
101- git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR"
135+ if ! git clone --depth 1 https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR"; then
136+ echo "::warning::Could not clone gitbot-fleet — skipping Phase 2 learning submission (non-fatal)."
137+ exit 0
138+ fi
102139
103- # Run submission script
104- bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json
140+ # The submission script's location in gitbot-fleet has drifted
141+ # before (it was absent from the default branch, which exit-127'd
142+ # every consuming repo's scan). Probe known locations rather than
143+ # hard-coding one path, and skip gracefully if none is present.
144+ SUBMIT_SCRIPT=""
145+ for cand in \
146+ "$FLEET_DIR/scripts/submit-finding.sh" \
147+ "$FLEET_DIR/scripts/submit_finding.sh" \
148+ "$FLEET_DIR/bin/submit-finding.sh" \
149+ "$FLEET_DIR/submit-finding.sh"; do
150+ if [ -f "$cand" ]; then
151+ SUBMIT_SCRIPT="$cand"
152+ break
153+ fi
154+ done
155+
156+ if [ -z "$SUBMIT_SCRIPT" ]; then
157+ echo "::warning::gitbot-fleet submit-finding script not found at any known path — skipping Phase 2 learning submission (non-fatal). Findings are still uploaded as an artifact and gated below."
158+ rm -rf "$FLEET_DIR"
159+ exit 0
160+ fi
161+
162+ # Run submission script. Pass the findings path as ABSOLUTE —
163+ # the script cd's into its own working dir before reading the
164+ # file, so a relative path would resolve to the wrong place.
165+ # A submission-script failure is logged but non-fatal.
166+ if bash "$SUBMIT_SCRIPT" "$GITHUB_WORKSPACE/hypatia-findings.json"; then
167+ echo "✅ Finding submission complete"
168+ else
169+ echo "::warning::gitbot-fleet submission script exited non-zero — Phase 2 learning submission skipped (non-fatal)."
170+ fi
105171
106172 # Cleanup
107173 rm -rf "$FLEET_DIR"
108174
109- echo "✅ Finding submission complete"
110-
111175name : Check for critical issues
112176 if : steps.scan.outputs.critical > 0
113177 run : |
@@ -152,6 +216,11 @@ jobs:
152216
153217name : Comment on PR with findings
154218 if : github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0
219+ # Advisory only — posting findings as a PR comment must never gate
220+ # the scan (hypatia#213 gate decoupling). Belt-and-braces alongside
221+ # the pull-requests: write permission above: a token/API hiccup or
222+ # a fork PR (read-only token) skips the comment, not the check.
223+ continue-on-error : true
155224 uses : actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v7
156225 with :
157226 script : |
@@ -182,4 +251,4 @@ jobs:
182251 repo: context.repo.repo,
183252 issue_number: context.issue.number,
184253 body: comment
185- });
254+ });
0 commit comments