ci(hypatia): adopt standards hypatia-scan-reusable wrapper

[hyperpolymath]

Summary

Converts .github/workflows/hypatia-scan.yml from the full ~300-line standalone scanner into a thin wrapper around hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml, completing the estate-consistency pattern: governance.yml, scorecard.yml (#34), and now hypatia-scan.yml all delegate to the shared reusables, pinned to the same standards commit 861b5e9.

This is the follow-up flagged in #34.

Why this is safe

I fetched the reusable at 861b5e9 and confirmed it is a faithful equivalent of the inline scanner — same 12 steps, no functionality lost:

Capability	Standalone (before)	Reusable (after)
Elixir/BEAM setup + clone/build Hypatia	✓	✓
Run scan, upload hypatia-findings.json artifact	✓	✓
Convert to SARIF, upload under category hypatia	✓	✓
gitbot-fleet Phase 2 learning submission	✓	✓ (needs HYPATIA_DISPATCH_PAT)
Advisory critical check (surfaces, does not fail — hypatia#213)	✓	✓
PR findings comment	✓	✓

Key details

• secrets: inherit — required by the reusable so GITHUB_TOKEN and HYPATIA_DISPATCH_PAT flow through; without the PAT the gitbot-fleet Phase 2 submission can't run (it's non-fatal regardless).
• Permissions preserved at workflow level (contents: read, security-events: write, pull-requests: write) — the caller is the ceiling for the reusable's GITHUB_TOKEN, and these are exactly what its SARIF upload + Dependabot read + PR comment need.
• Triggers, the concurrency guardrail, and the MPL-2.0 header are unchanged → runtime behaviour is preserved.
• Also fixes the file's header comment, which already claimed to be a "thin wrapper" while still carrying the entire inline scanner.

How has this been verified?

• Confirmed hypatia-scan-reusable.yml exists at hyperpolymath/standards@861b5e9 and inspected its inputs (runs-on only), its secrets: inherit requirement, its top-level permissions, and its step list.
• yq parse: name, triggers, top-level permissions, jobs.scan.uses, and secrets: inherit all resolve as intended.
• git diff vs main is a single file (hypatia-scan.yml, −295/+19).

Type of change

• 🔧 Build / CI / tooling

🤖 Generated with Claude Code

https://claude.ai/code/session_01AHygjxRyU3WwmXEhA9KF5L

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 43 issues detected

Severity	Count
🔴 Critical	0
🟠 High	33
🟡 Medium	10

View findings

[
  {
    "reason": "Belt.Array deprecated -- use Array (12 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/TextTransform.res",
    "action": "module_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.Array2 deprecated -- use Array (1 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/TextTransform.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.String2 deprecated -- use String (9 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/TextTransform.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Belt.Array deprecated -- use Array (11 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/ByteDetector.res",
    "action": "module_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.Array2 deprecated -- use Array (2 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/ByteDetector.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.String2 deprecated -- use String (25 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/ByteDetector.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Belt.Array deprecated -- use Array (2 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/PathHandler.res",
    "action": "module_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.String2 deprecated -- use String (13 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/core/PathHandler.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Belt.Array deprecated -- use Array (6 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/bindings/Deno.res",
    "action": "module_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.Array2 deprecated -- use Array (2 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/empty-linter/empty-linter/src/bindings/Deno.res",
    "action": "search_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud