fix(ci): repair instant-sync + clear Hypatia/SonarCloud findings from PR #21

[hyperpolymath]

Why

PR #21 merged with two red checks (Hypatia, SonarCloud). The post-merge auto-remediation d0db0a1 then broke instant-sync.yml (invalid YAML + secrets used in if:, which GitHub doesn't support), silently disabling repository-dispatch to .git-private-farm — i.e. estate propagation. Since empty-linter is consumed across the estate's CI/CD, this is wide blast-radius, not a leaf failure.

This follow-up repairs the live breakage and clears every finding.

Changes

File	Fix	Clears
instant-sync.yml	Rewrite with env-mapping presence gate (secret → job env, if: env.X != '', with reads env). Repairs the invalid YAML.	invalid workflow + WF017
mirror.yml	Same env-mapping for all 6 ssh-agent jobs; gate radicle on RADICLE_KEY and stop interpolating the secret into the shell.	WF017 ×6 + a silent no-op gate
scorecard-enforcer.yml	Drop publish_results: true (publishing belongs to scorecard.yml; a publishing action may not share a file with run:).	WF014
codeql.yml	Add language: actions matrix entry.	WF020
userscript/empty-linter.user.js	Replace 4 innerHTML = with createElement/textContent/replaceChildren; remove dead escapeHtml.	js_innerhtml CWE-79 ×4 + SonarCloud hotspot

Why env-mapping and not Hypatia's literal if: secrets.X != '' recipe: secrets is not available in any if: (actions/runner#520). Env-mapping is the documented-correct pattern and clears WF017 structurally. Hypatia's recipe is itself broken — see the advisory in hypatia.

Validation

• All 12 workflow files parse as valid YAML (instant-sync.yml was invalid on main).
• instant-sync / mirror structurally confirmed: gates read env.*, inputs read env.*.
• Userscript passes node --check; zero functional innerHTML remain.

Notes

• Full post-mortem: docs/reports/incident-2026-06-11-cicd-pr21.adoc.
• ⚠️ Flag-only (no edit): secret-scanner.yml and scorecard.yml carry SPDX PMPL-1.0; per policy empty-linter must be MPL-2.0. License changes are owner-only/manual — surfaced for your action, not touched here.

https://claude.ai/code/session_01EqEysvTPzPwhS9ZGY7EYdr

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

🔍 Hypatia Security Scan

Findings: 56 issues detected

Severity	Count
🔴 Critical	0
🟠 High	41
🟡 Medium	15

View findings

[
  {
    "reason": "HTTP URL in code -- use HTTPS for non-localhost (1 occurrences, CWE-319)",
    "type": "js_http_url_in_code",
    "file": "/home/runner/work/empty-linter/empty-linter/userscript/empty-linter.user.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "Belt.Array deprecated -- use Array (12 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/TextTransform.res",
    "action": "module_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.Array2 deprecated -- use Array (1 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/TextTransform.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.String2 deprecated -- use String (9 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/TextTransform.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Belt.Array deprecated -- use Array (11 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/ByteDetector.res",
    "action": "module_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.Array2 deprecated -- use Array (2 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/ByteDetector.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.String2 deprecated -- use String (25 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/ByteDetector.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Belt.Array deprecated -- use Array (2 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/PathHandler.res",
    "action": "module_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.String2 deprecated -- use String (13 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/PathHandler.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Belt.Array deprecated -- use Array (6 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/bindings/Deno.res",
    "action": "module_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence