Skip to content

Commit c6110ec

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
authored
ci(workflow): adopt hardened hypatia-scan from hyperpolymath/hypatia#237 (#7)
* ci(workflow): adopt hardened hypatia-scan from hyperpolymath/hypatia#237 Replaces the local copy of `.github/workflows/hypatia-scan.yml` with the canonical version from upstream main. The old copy had three issues that combined to break every Dependabot PR: 1. `working-directory: \${{ env.HOME }}/hypatia\``, where `env.HOME` is not a GHA context — it evaluated to empty, so `cd /hypatia` failed and the scanner was never built. 2. `hypatia-cli.sh scan .` without `--exit-zero` — scanner exit-1 on findings short-circuited the rest of the step under `set -e`. 3. No baseline gate, so any pre-existing critical/high failed the build. Upstream version: - captures scanner exit code + stderr (visible on crash) - falls back to `[]` on missing/invalid JSON - reads `.hypatia-baseline.json` and fails only on NET-NEW critical/high - scopes permissions narrowly (contents: read, pull-requests: write) - marks the PR-comment step `continue-on-error: true` so Dependabot PRs (read-only token) don't fail on the unavoidable 403 Baseline file follows in a second commit on this branch — first we need the new workflow to actually run and capture current findings. Unblocks PR #6 (CODEOWNERS) which is stuck on this exact scan. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * ci(fixup): restore newlines in hypatia-scan.yml Previous commit on this branch wrote the YAML as a single line due to a PowerShell encoding/-NoNewline mistake on my end. This re-applies the canonical workflow content byte-for-byte, with line breaks intact, so GitHub Actions can parse it. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * ci(baseline): seed/refresh .hypatia-baseline.json from new workflow's first scan Captured from run 25856336153 on this branch. 13 critical+high entries accepted as pre-existing baseline. Net-new findings going forward will still fail the gate. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
1 parent 7372eb7 commit c6110ec

2 files changed

Lines changed: 189 additions & 25 deletions

File tree

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 109 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,11 @@ on:
1313

1414
permissions:
1515
contents: read
16-
# security-events: read lets the built-in GITHUB_TOKEN query this
17-
# repo\'s own Dependabot alerts via the Hypatia DependabotAlerts rule.
18-
security-events: read
16+
# `pull-requests: write` is needed for the "Comment on PR with findings"
17+
# step to POST a results summary. Note: on Dependabot PRs the token is
18+
# downgraded to read-only regardless, so that step is also marked
19+
# continue-on-error below.
20+
pull-requests: write
1921

2022
jobs:
2123
scan:
@@ -24,40 +26,72 @@ jobs:
2426

2527
steps:
2628
- name: Checkout repository
27-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
29+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
2830
with:
2931
fetch-depth: 0 # Full history for better pattern analysis
3032

3133
- name: Setup Elixir for Hypatia scanner
32-
uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.18.2
34+
uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.18.2
3335
with:
3436
elixir-version: '1.19.4'
3537
otp-version: '28.3'
3638

37-
- name: Clone Hypatia
39+
- name: Clone Hypatia (or use checkout when scanning hypatia itself)
3840
run: |
39-
if [ ! -d "$HOME/hypatia" ]; then
41+
# When scanning hypatia from inside hypatia, point $HOME/hypatia
42+
# at the PR/branch checkout instead of cloning main — otherwise
43+
# CLI changes can never pass their own gate (the scanner binary
44+
# would always come from main and ignore new flags).
45+
if [ "${{ github.repository }}" = "hyperpolymath/hypatia" ]; then
46+
ln -sfn "${GITHUB_WORKSPACE}" "$HOME/hypatia"
47+
elif [ ! -d "$HOME/hypatia" ]; then
4048
git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia"
4149
fi
4250
4351
- name: Build Hypatia scanner (if needed)
44-
working-directory: ${{ env.HOME }}/hypatia
4552
run: |
46-
if [ ! -f hypatia-v2 ]; then
47-
echo "Building hypatia-v2 scanner..."
48-
cd scanner
53+
cd "$HOME/hypatia"
54+
if [ ! -f hypatia ]; then
55+
echo "Building hypatia scanner..."
4956
mix deps.get
5057
mix escript.build
51-
mv hypatia ../hypatia-v2
5258
fi
5359
5460
- name: Run Hypatia scan
5561
id: scan
62+
env:
63+
# Suppress the "Warning: Dependabot alerts unavailable: GITHUB_TOKEN
64+
# not set" line so the run is silent-warning-free. The token is
65+
# read-only by default and only used to query Dependabot alerts.
66+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5667
run: |
5768
echo "Scanning repository: ${{ github.repository }}"
5869
59-
# Run scanner
60-
HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.json
70+
# Run scanner with --exit-zero so a findings-found exit-1 does
71+
# NOT short-circuit the rest of this step under `set -e`. The
72+
# downstream "Check for critical or high-severity issues" step
73+
# is the explicit gate. See hyperpolymath/hypatia#213.
74+
#
75+
# Guard against the scanner producing no output (a crash, an
76+
# unknown flag, etc.): if hypatia-findings.json is empty or
77+
# missing after the run, fall back to "[]" so the jq calls
78+
# below don't 9 the whole gate. We surface stderr so the
79+
# underlying scanner failure is still visible in the log.
80+
set +e
81+
HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero \
82+
> hypatia-findings.json 2> hypatia-scan.stderr
83+
SCAN_EXIT=$?
84+
set -e
85+
echo "Scanner exit: $SCAN_EXIT"
86+
if [ -s hypatia-scan.stderr ]; then
87+
echo "--- scanner stderr ---"
88+
cat hypatia-scan.stderr
89+
echo "--- end stderr ---"
90+
fi
91+
if ! jq empty hypatia-findings.json 2>/dev/null; then
92+
echo "Scanner did not produce valid JSON; defaulting to empty findings."
93+
echo "[]" > hypatia-findings.json
94+
fi
6195
6296
# Count findings
6397
FINDING_COUNT=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0)
@@ -79,7 +113,7 @@ jobs:
79113
echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
80114
81115
- name: Upload findings artifact
82-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
116+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
83117
with:
84118
name: hypatia-findings
85119
path: hypatia-findings.json
@@ -89,6 +123,8 @@ jobs:
89123
if: steps.scan.outputs.findings_count > 0
90124
env:
91125
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
126+
FLEET_PUSH_TOKEN: ${{ secrets.HYPATIA_DISPATCH_PAT }}
127+
FLEET_DISPATCH_TOKEN: ${{ secrets.HYPATIA_DISPATCH_PAT }}
92128
GITHUB_REPOSITORY: ${{ github.repository }}
93129
GITHUB_SHA: ${{ github.sha }}
94130
run: |
@@ -98,21 +134,63 @@ jobs:
98134
FLEET_DIR="/tmp/gitbot-fleet-$$"
99135
git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR"
100136
101-
# Run submission script
102-
bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json
137+
# Run submission script. Pass the findings path as ABSOLUTE —
138+
# submit-finding.sh cd's into its own working dir before reading
139+
# the file, so a relative path would resolve to the wrong place
140+
# and the script fails with "No such file or directory".
141+
bash "$FLEET_DIR/scripts/submit-finding.sh" "$GITHUB_WORKSPACE/hypatia-findings.json"
103142
104143
# Cleanup
105144
rm -rf "$FLEET_DIR"
106145
107146
echo "✅ Finding submission complete"
108147
109-
- name: Check for critical issues
110-
if: steps.scan.outputs.critical > 0
148+
- name: Check for critical or high-severity issues
149+
if: steps.scan.outputs.critical > 0 || steps.scan.outputs.high > 0
111150
run: |
112-
echo "⚠️ Critical security issues found!"
113-
echo "Review hypatia-findings.json for details"
114-
# Don't fail the build yet - just warn
115-
# exit 1
151+
echo "Total critical/high: ${{ steps.scan.outputs.critical }} critical, ${{ steps.scan.outputs.high }} high"
152+
153+
# Baseline-aware gate: pre-existing accepted findings live in
154+
# .hypatia-baseline.json (committed). New critical/high findings
155+
# not in the baseline still fail the build. Findings are matched
156+
# on (severity, rule_module, type, file) tuple with absolute
157+
# build paths normalised to repo-relative.
158+
if [ -f .hypatia-baseline.json ]; then
159+
# Normalise + project the FINDING IDENTITY tuple from the current
160+
# scan. Identity is (severity, rule_module, type, file) — `action`
161+
# is remediation guidance that can legitimately drift between
162+
# scanner versions (e.g. "flag" -> "create_branch") and is NOT
163+
# part of what makes two findings the same.
164+
jq '[ .[] | select(.severity == "critical" or .severity == "high")
165+
| {severity, rule_module, type,
166+
file: (.file | sub("^/home/runner/work/[^/]+/[^/]+/"; "")
167+
| sub("^/github/workspace/"; "")) } ]' \
168+
hypatia-findings.json > findings-current.json
169+
170+
# Subtract baseline. A current finding is "new" iff there's no
171+
# baseline element with the same identity tuple. Baseline entries
172+
# may include extra fields (e.g. `action`); strip them before the
173+
# comparison so legacy baselines keep working.
174+
jq --slurpfile base .hypatia-baseline.json \
175+
'($base[0] | map({severity, rule_module, type, file})) as $bk
176+
| map(. as $f | select(($bk | any(. == $f)) | not))' \
177+
findings-current.json > findings-new.json
178+
new_count=$(jq 'length' findings-new.json)
179+
180+
if [ "$new_count" -gt 0 ]; then
181+
echo "::error::$new_count new critical/high finding(s) outside the baseline:"
182+
jq -r '.[] | " [\(.severity)] \(.rule_module)/\(.type) — \(.file)"' findings-new.json
183+
echo
184+
echo "If these are intentional, regenerate .hypatia-baseline.json:"
185+
echo " jq '[.[] | select(.severity == \"critical\" or .severity == \"high\") | {severity, rule_module, type, file}] | sort_by(.severity, .rule_module, .type, .file)' hypatia-findings.json > .hypatia-baseline.json"
186+
exit 1
187+
fi
188+
echo "All critical/high findings present in baseline — gate passes."
189+
else
190+
echo "No .hypatia-baseline.json — failing on any critical/high (legacy behaviour)."
191+
echo "Review hypatia-findings.json for details"
192+
exit 1
193+
fi
116194
117195
- name: Generate scan report
118196
run: |
@@ -149,8 +227,14 @@ jobs:
149227
cat hypatia-report.md >> $GITHUB_STEP_SUMMARY
150228
151229
- name: Comment on PR with findings
230+
# Dependabot PRs always run with a read-only token regardless of the
231+
# workflow's declared permissions, so the createComment call below
232+
# would 403 on every dep-bump PR. The PR comment is informational
233+
# (the check result is already visible in the PR UI); we don't want
234+
# its absence to block merge.
152235
if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0
153-
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v7
236+
continue-on-error: true
237+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v7
154238
with:
155239
script: |
156240
const fs = require('fs');
@@ -180,4 +264,4 @@ jobs:
180264
repo: context.repo.repo,
181265
issue_number: context.issue.number,
182266
body: comment
183-
});
267+
});

‎.hypatia-baseline.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
[
2+
{
3+
"severity": "critical",
4+
"rule_module": "security_errors",
5+
"type": "secret_detected",
6+
"file": ".envrc"
7+
},
8+
{
9+
"severity": "critical",
10+
"rule_module": "workflow_audit",
11+
"type": "actions_expression_injection",
12+
"file": "boj-build.yml"
13+
},
14+
{
15+
"severity": "critical",
16+
"rule_module": "workflow_audit",
17+
"type": "actions_expression_injection",
18+
"file": "hypatia-scan.yml"
19+
},
20+
{
21+
"severity": "critical",
22+
"rule_module": "workflow_audit",
23+
"type": "actions_expression_injection",
24+
"file": "mirror.yml"
25+
},
26+
{
27+
"severity": "critical",
28+
"rule_module": "workflow_audit",
29+
"type": "actions_expression_injection",
30+
"file": "quality.yml"
31+
},
32+
{
33+
"severity": "high",
34+
"rule_module": "cicd_rules",
35+
"type": "missing_requirement",
36+
"file": ".github/dependabot.yml"
37+
},
38+
{
39+
"severity": "high",
40+
"rule_module": "cicd_rules",
41+
"type": "missing_requirement",
42+
"file": ".github/workflows/scorecard.yml"
43+
},
44+
{
45+
"severity": "high",
46+
"rule_module": "cicd_rules",
47+
"type": "missing_requirement",
48+
"file": "permissions: read-all"
49+
},
50+
{
51+
"severity": "high",
52+
"rule_module": "git_state",
53+
"type": "GS005",
54+
"file": "."
55+
},
56+
{
57+
"severity": "high",
58+
"rule_module": "scorecard",
59+
"type": "TokenPermissions",
60+
"file": "/home/runner/work/cloudguard-cli/cloudguard-cli"
61+
},
62+
{
63+
"severity": "high",
64+
"rule_module": "workflow_audit",
65+
"type": "download_then_run",
66+
"file": "mirror.yml"
67+
},
68+
{
69+
"severity": "high",
70+
"rule_module": "workflow_audit",
71+
"type": "unsafe_curl_payload",
72+
"file": "boj-build.yml"
73+
},
74+
{
75+
"severity": "high",
76+
"rule_module": "workflow_audit",
77+
"type": "unsafe_curl_payload",
78+
"file": "hypatia-scan.yml"
79+
}
80+
]

0 commit comments

Comments
 (0)