fix(code_scanning_alerts): break CSA001 self-referential echo loop (#328)

## Why

\`CSA001-CSA004\` (\`lib/rules/code_scanning_alerts.ex\`) are lenses
over GitHub's code-scanning alerts — they query
\`/repos/<owner>/<repo>/code-scanning/alerts\` and echo each as a
Hypatia finding so a single run surfaces everything GitHub's Security
tab shows.

The findings then get uploaded back to GitHub as SARIF, creating new
alerts under \`tool: Hypatia\`, \`rule_id:
hypatia/code_scanning_alerts/CSA00X\`. Without a filter, the **next**
Hypatia scan sees those alerts via CSA001 and echoes them again,
generating fresh CSA findings about previous CSA findings.

## The observed failure mode (boj-server)

boj-server accumulated 30+ self-referential alerts on
\`cartridges/*/ffi/cartridge_shim.zig\` (alert numbers 357-386, all
created at exactly \`2026-05-24T20:07:32Z\` — single scan emitted 30
echoes in one go). The PR check Hypatia failed and blocked PR #149
(\"Claude/repo tidy rsr taxonomy\") even though the PR didn't touch the
code-scanning surface at all.

The message field of each looped alert showed the self-echo chain
explicitly — the \`description\` slot was filled with the previous
round's rendered \`build_alert_reason/5\` output, so each round nested
one level deeper:

> Code scanning (Hypatia): hypatia/code_scanning_alerts/CSA001 --
Hypatia code_scanning_alerts: CSA001 -- 1 day(s) old

## The fix

Adds \`self_referential_alert?/1\` — a predicate that returns true when:
- \`tool.name == \"Hypatia\"\`, AND
- \`rule.id\` starts with \`hypatia/code_scanning_alerts/\`

\`fetch_alerts/2\` applies it as an \`Enum.reject\` filter immediately
after JSON decode, so all four CSA rules see a CSA-free alert list and
cannot generate fresh CSA findings about previous CSA findings.

### Why narrow

The predicate **only** suppresses this module's own emissions. Real
findings from other Hypatia rule modules (\`code_safety\`,
\`supply_chain\`, \`workflow_hardening\`, etc.) continue to surface via
CSA001 even when they happen to carry \`tool: Hypatia\`, because they do
**not** match the \`rule.id\` prefix. CodeQL and third-party SARIF
findings are unaffected.

## Tests

Six regression cases in \`test/code_scanning_alerts_test.exs\`:

- CSA001 self-echo (the primary failure mode)
- CSA002 / CSA003 / CSA004 echoes (same loop mechanism)
- CodeQL alert passes through (real findings still surface)
- Third-party SARIF (Snyk) alert passes through
- Hypatia non-CSA finding passes through (other rule modules unaffected)
- Missing \`tool\` / \`rule\` keys handled gracefully

Local \`mix test\` couldn't complete in this environment (Phoenix dep is
incompatible with Elixir 1.14 here); CI will run the suite.

## Cleanup follow-up

Once this lands, the 30+ existing self-referential alerts on boj-server
can be dismissed in one batch:

\`\`\`bash
gh api repos/hyperpolymath/boj-server/code-scanning/alerts --paginate \\
--jq '.[] | select(.rule.id == \"hypatia/code_scanning_alerts/CSA001\"
and .state == \"open\") | .number' \\
  | xargs -I{} gh api -X PATCH \\
      repos/hyperpolymath/boj-server/code-scanning/alerts/{} \\
      -f state=dismissed -f dismissed_reason=\"false positive\" \\
-f dismissed_comment=\"Self-referential CSA001 echo loop; see
hypatia#$THIS_PR\"
\`\`\`

## Refs

- boj-server #149 (the visible failure)
- Earlier memory: \`project_hypatia_scorecard_loop_closer.md\` (related
alert-lifecycle pattern; this is a sibling fix in the same class)

## Architectural note (separate consideration, not in this PR)

The deeper question is whether Hypatia's SARIF-upload step should
exclude **lens** rules (CSA001-004, plus Dependabot lens equivalents)
from upload entirely — uploading \"this is what GitHub already shows\"
back to GitHub Code Scanning is by definition redundant. That's a larger
architectural change; this PR is the defensive belt-and-braces filter
that stops the bleeding immediately.

## Test plan

- [ ] CI green (especially the new \`describe
\"self_referential_alert?/1\"\` block)
- [ ] After merge, run the batch dismissal on boj-server and confirm PR
#149's Hypatia check goes green
- [ ] Confirm no regression in real CSA001 surfacing (CodeQL findings on
a fresh repo should still appear)

Author: hyperpolymath

lib/rules/code_scanning_alerts.ex

@@ -318,6 +318,31 @@ defmodule Hypatia.Rules.CodeScanningAlerts do
     end
   end
 
+  # ─── Self-referential filter ───────────────────────────────────────────
+
+  @doc """
+  Returns true when the alert is one Hypatia previously uploaded for this
+  module (CSA001-CSA004). These rules are lenses over GitHub's code-scanning
+  alerts; their findings are themselves uploaded back to GitHub as SARIF and
+  become new alerts under `tool: Hypatia`, rule id
+  `hypatia/code_scanning_alerts/CSA00X`.
+
+  Without this filter, each scan generates new CSA alerts about the previous
+  scan's CSA alerts — boj-server accumulated 30+ self-referential alerts on
+  `cartridges/*/ffi/cartridge_shim.zig` this way (alert numbers 357-386).
+  The message field showed the self-echo: the `description` slot was filled
+  with the previous round's rendered `build_alert_reason/5` output, so each
+  round nests one level deeper.
+
+  Public so the regression test in `test/code_scanning_alerts_test.exs` can
+  exercise it without hitting the GitHub API.
+  """
+  def self_referential_alert?(alert) do
+    tool = get_in(alert, ["tool", "name"])
+    rule_id = get_in(alert, ["rule", "id"]) || ""
+    tool == "Hypatia" and String.starts_with?(rule_id, "hypatia/code_scanning_alerts/")
+  end
+
   # ─── GitHub API ────────────────────────────────────────────────────────
 
   defp fetch_alerts(owner, repo) do
@@ -343,9 +368,14 @@ defmodule Hypatia.Rules.CodeScanningAlerts do
            ], stderr_to_stdout: true) do
         {body, 0} ->
           case Jason.decode(body) do
-            {:ok, alerts} when is_list(alerts) -> {:ok, alerts}
-            {:ok, %{"message" => msg}} -> {:error, "GitHub API: #{msg}"}
-            {:error, _} -> {:error, "Invalid JSON response from GitHub API"}
+            {:ok, alerts} when is_list(alerts) ->
+              {:ok, Enum.reject(alerts, &self_referential_alert?/1)}
+
+            {:ok, %{"message" => msg}} ->
+              {:error, "GitHub API: #{msg}"}
+
+            {:error, _} ->
+              {:error, "Invalid JSON response from GitHub API"}
           end
 
         {error, _} ->

test/code_scanning_alerts_test.exs

@@ -65,4 +65,74 @@ defmodule Hypatia.Rules.CodeScanningAlertsTest do
       File.rm_rf!(tmp)
     end
   end
+
+  describe "self_referential_alert?/1" do
+    # Regression for the boj-server #149 self-amplifying loop where each
+    # Hypatia scan generated new CSA001 alerts about the previous scan's
+    # CSA001 alerts (30+ alerts on cartridges/*/ffi/cartridge_shim.zig
+    # before the fix).
+
+    test "rejects Hypatia's own CSA001 echo" do
+      alert = %{
+        "tool" => %{"name" => "Hypatia"},
+        "rule" => %{"id" => "hypatia/code_scanning_alerts/CSA001"}
+      }
+
+      assert CodeScanningAlerts.self_referential_alert?(alert)
+    end
+
+    test "rejects CSA002 / CSA003 / CSA004 echoes too" do
+      for rule_id <- ~w(
+            hypatia/code_scanning_alerts/CSA002
+            hypatia/code_scanning_alerts/CSA003
+            hypatia/code_scanning_alerts/CSA004
+          ) do
+        alert = %{
+          "tool" => %{"name" => "Hypatia"},
+          "rule" => %{"id" => rule_id}
+        }
+
+        assert CodeScanningAlerts.self_referential_alert?(alert),
+               "expected #{rule_id} to be flagged self-referential"
+      end
+    end
+
+    test "keeps CodeQL alerts" do
+      alert = %{
+        "tool" => %{"name" => "CodeQL"},
+        "rule" => %{"id" => "rs/unsafe-cast"}
+      }
+
+      refute CodeScanningAlerts.self_referential_alert?(alert)
+    end
+
+    test "keeps third-party SARIF alerts" do
+      alert = %{
+        "tool" => %{"name" => "Snyk"},
+        "rule" => %{"id" => "SNYK-RS-12345"}
+      }
+
+      refute CodeScanningAlerts.self_referential_alert?(alert)
+    end
+
+    test "keeps Hypatia alerts from other rule modules" do
+      # Hypatia has many rule modules (code_safety, supply_chain,
+      # workflow_hardening, etc.); only the code_scanning_alerts module is
+      # a lens over GitHub's API and recursive. Other modules find real
+      # things in the code and SHOULD continue to surface even when their
+      # findings get re-uploaded as SARIF.
+      alert = %{
+        "tool" => %{"name" => "Hypatia"},
+        "rule" => %{"id" => "hypatia/code_safety/CSA001"}
+      }
+
+      refute CodeScanningAlerts.self_referential_alert?(alert)
+    end
+
+    test "handles missing tool / rule keys gracefully" do
+      refute CodeScanningAlerts.self_referential_alert?(%{})
+      refute CodeScanningAlerts.self_referential_alert?(%{"tool" => %{"name" => "Hypatia"}})
+      refute CodeScanningAlerts.self_referential_alert?(%{"rule" => %{"id" => "x"}})
+    end
+  end
 end