hypatia-scan.yml

# SPDX-License-Identifier: MPL-2.0
# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
# SPDX-License-Identifier: MPL-2.0
# hypatia-scan.yml — thin wrapper calling the shared Hypatia neurosymbolic scan
# in hyperpolymath/standards (hypatia-scan-reusable.yml) instead of carrying the
# per-repo copy. Pinned to the same standards commit as governance.yml and
# scorecard.yml so the estate moves in lockstep. See standards#191 for the
# reusable's purpose and design.
#
# secrets: inherit passes GITHUB_TOKEN and HYPATIA_DISPATCH_PAT through to the
# reusable — the latter is needed by the gitbot-fleet Phase 2 learning
# submission (best-effort / non-fatal). The reusable keeps Hypatia advisory:
# critical findings surface on the code-scanning page (category: hypatia) but
# do not fail the check; tighten via branch protection, not here (hypatia#213).
name: Hypatia Security Scan
on:
  push:
    branches: [main, master, develop]
  pull_request:
    branches: [main, master]
  schedule:
    - cron: '0 0 * * 0' # Weekly on Sunday
  workflow_dispatch:

# Estate guardrail: cancel superseded runs so re-pushes don't pile up.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Caller is the ceiling for the reusable's GITHUB_TOKEN; the single job below
# inherits these. The reusable needs:
#   security-events: write  — upload SARIF + read Dependabot alerts
#   pull-requests:  write   — post the findings comment on PRs
#   contents:       read    — checkout
permissions:
  contents: read
  security-events: write
  pull-requests: write
jobs:
  scan:
    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
    secrets: inherit