Merge branch 'main' into findings-submissions

Author: hyperpolymath

.github/workflows/hypatia-dispatch-intake.yml

@@ -11,7 +11,7 @@ on:
       - hypatia-general-findings
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   intake:

.github/workflows/supervised-fleet-scan.yml

@@ -45,17 +45,14 @@ jobs:
           INVENTORY_FILE: ${{ github.event.inputs.inventory_file || '' }}
           PROCESS_FINDINGS: ${{ github.event.inputs.process_findings || 'true' }}
           FLEET_SUPERVISED_REPOS_FILE: ${{ github.event.inputs.inventory_file || '' }}
-          # GITHUB_TOKEN is required for Hypatia's DependabotAlerts
+          # FLEET_SCAN_PAT is required for Hypatia's DependabotAlerts
           # rule (DA001-DA004) to query per-repo Dependabot alerts via
-          # the GitHub REST API. The built-in secrets.GITHUB_TOKEN
-          # only has scope for the gitbot-fleet repo itself — for
-          # cross-repo scanning across the estate, promote this to a
-          # PAT secret (FLEET_SCAN_PAT) with `security_events` scope
-          # on every target repo. Without a valid token, the rule
-          # silently returns no findings and Dependabot alerts are
-          # missed. See
+          # the GitHub REST API. This PAT must have `security_events: read`
+          # scope on ALL target repos. Without it, cross-repo alerts will
+          # be MISSING. The built-in GITHUB_TOKEN is insufficient for
+          # estate-wide scanning. See:
           # 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
-          GITHUB_TOKEN: ${{ secrets.FLEET_SCAN_PAT || secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.FLEET_SCAN_PAT }}
           # HYPATIA_SEVERITY=low surfaces low-severity findings from
           # every rule module. The Hypatia CLI's default threshold is
           # "medium"; without this override, low-severity findings

tests/e2e.sh

@@ -203,7 +203,7 @@ for bot in rhodibot echidnabot panicbot cipherbot; do
     if [ -f "$CARGO" ]; then
         OUTPUT=$(cat "$CARGO")
         check "$bot Cargo.toml has package name" "name.*$bot\|name.*\"$bot\"" "$OUTPUT"
-        check "$bot Cargo.toml has PMPL license" "PMPL\|pmpl" "$OUTPUT"
+        check "$bot Cargo.toml has MPL-2.0 license" "MPL-2\.0\|MPL 2\.0\|mpl-2\.0" "$OUTPUT"
     else
         skip_test "$bot Cargo.toml" "file not found"
     fi