|
| 1 | +# SPDX-License-Identifier: PMPL-1.0-or-later |
| 2 | +# Hypatia Neurosymbolic CI/CD Security Scan |
| 3 | +name: Hypatia Security Scan |
| 4 | + |
| 5 | +on: |
| 6 | + push: |
| 7 | + branches: [ main, master, develop ] |
| 8 | + pull_request: |
| 9 | + branches: [ main, master ] |
| 10 | + schedule: |
| 11 | + - cron: '0 0 * * 0' # Weekly on Sunday |
| 12 | + workflow_dispatch: |
| 13 | + |
| 14 | +permissions: |
| 15 | + contents: read |
| 16 | + # security-events: read lets the built-in GITHUB_TOKEN query this |
| 17 | + # repo's own Dependabot alerts via the Hypatia DependabotAlerts rule |
| 18 | + # (DA001-DA004). Without this, `scan_from_path` gets HTTP 403 and |
| 19 | + # the rule silently returns no findings. |
| 20 | + # See 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md. |
| 21 | + security-events: read |
| 22 | + |
| 23 | +jobs: |
| 24 | + scan: |
| 25 | + name: Hypatia Neurosymbolic Analysis |
| 26 | + runs-on: ubuntu-latest |
| 27 | + |
| 28 | + steps: |
| 29 | + - name: Checkout repository |
| 30 | + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 31 | + with: |
| 32 | + fetch-depth: 0 # Full history for better pattern analysis |
| 33 | + |
| 34 | + - name: Setup Elixir for Hypatia scanner |
| 35 | + uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.18.2 |
| 36 | + with: |
| 37 | + elixir-version: '1.19.4' |
| 38 | + otp-version: '28.3' |
| 39 | + |
| 40 | + - name: Clone Hypatia |
| 41 | + run: | |
| 42 | + if [ ! -d "$HOME/hypatia" ]; then |
| 43 | + git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" |
| 44 | + fi |
| 45 | +
|
| 46 | + - name: Build Hypatia scanner (if needed) |
| 47 | + run: | |
| 48 | + cd "$HOME/hypatia" |
| 49 | + if [ ! -f hypatia ]; then |
| 50 | + echo "Building hypatia scanner..." |
| 51 | + mix deps.get |
| 52 | + mix escript.build |
| 53 | + fi |
| 54 | +
|
| 55 | + - name: Run Hypatia scan |
| 56 | + id: scan |
| 57 | + env: |
| 58 | + # Pass the built-in Actions token through to Hypatia so the |
| 59 | + # DependabotAlerts rule can query this repo's own alerts. |
| 60 | + # For cross-repo scanning (fleet-coordinator scan-supervised), |
| 61 | + # a PAT with `security_events` scope is required instead. |
| 62 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 63 | + run: | |
| 64 | + echo "Scanning repository: ${{ github.repository }}" |
| 65 | +
|
| 66 | + # Run scanner (exits non-zero when findings exist — suppress to continue) |
| 67 | + HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.json || true |
| 68 | +
|
| 69 | + # Count findings |
| 70 | + FINDING_COUNT=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0) |
| 71 | + echo "findings_count=$FINDING_COUNT" >> $GITHUB_OUTPUT |
| 72 | +
|
| 73 | + # Extract severity counts |
| 74 | + CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json) |
| 75 | + HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json) |
| 76 | + MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' hypatia-findings.json) |
| 77 | +
|
| 78 | + echo "critical=$CRITICAL" >> $GITHUB_OUTPUT |
| 79 | + echo "high=$HIGH" >> $GITHUB_OUTPUT |
| 80 | + echo "medium=$MEDIUM" >> $GITHUB_OUTPUT |
| 81 | +
|
| 82 | + echo "## Hypatia Scan Results" >> $GITHUB_STEP_SUMMARY |
| 83 | + echo "- Total findings: $FINDING_COUNT" >> $GITHUB_STEP_SUMMARY |
| 84 | + echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY |
| 85 | + echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY |
| 86 | + echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY |
| 87 | +
|
| 88 | + - name: Upload findings artifact |
| 89 | + uses: actions/upload-artifact@65c79d7f54e76e4e3c7a8f34db0f4ac8b515c478 # v4 |
| 90 | + with: |
| 91 | + name: hypatia-findings |
| 92 | + path: hypatia-findings.json |
| 93 | + retention-days: 90 |
| 94 | + |
| 95 | + - name: Submit findings to gitbot-fleet (Phase 2) |
| 96 | + if: steps.scan.outputs.findings_count > 0 |
| 97 | + env: |
| 98 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 99 | + GITHUB_REPOSITORY: ${{ github.repository }} |
| 100 | + GITHUB_SHA: ${{ github.sha }} |
| 101 | + run: | |
| 102 | + echo "📤 Submitting ${{ steps.scan.outputs.findings_count }} findings to gitbot-fleet..." |
| 103 | +
|
| 104 | + # Clone gitbot-fleet to temp directory |
| 105 | + FLEET_DIR="/tmp/gitbot-fleet-$$" |
| 106 | + git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR" |
| 107 | +
|
| 108 | + # Run submission script |
| 109 | + bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json |
| 110 | +
|
| 111 | + # Cleanup |
| 112 | + rm -rf "$FLEET_DIR" |
| 113 | +
|
| 114 | + echo "✅ Finding submission complete" |
| 115 | +
|
| 116 | + - name: Check for critical issues |
| 117 | + if: steps.scan.outputs.critical > 0 |
| 118 | + run: | |
| 119 | + echo "⚠️ Critical security issues found!" |
| 120 | + echo "Review hypatia-findings.json for details" |
| 121 | + # Don't fail the build yet - just warn |
| 122 | + # exit 1 |
| 123 | +
|
| 124 | + - name: Generate scan report |
| 125 | + run: | |
| 126 | + cat << EOF > hypatia-report.md |
| 127 | + # Hypatia Security Scan Report |
| 128 | +
|
| 129 | + **Repository:** ${{ github.repository }} |
| 130 | + **Scan Date:** $(date -u +"%Y-%m-%d %H:%M:%S UTC") |
| 131 | + **Commit:** ${{ github.sha }} |
| 132 | +
|
| 133 | + ## Summary |
| 134 | +
|
| 135 | + | Severity | Count | |
| 136 | + |----------|-------| |
| 137 | + | Critical | ${{ steps.scan.outputs.critical }} | |
| 138 | + | High | ${{ steps.scan.outputs.high }} | |
| 139 | + | Medium | ${{ steps.scan.outputs.medium }} | |
| 140 | + | **Total**| ${{ steps.scan.outputs.findings_count }} | |
| 141 | +
|
| 142 | + ## Next Steps |
| 143 | +
|
| 144 | + 1. Review findings in the artifact: hypatia-findings.json |
| 145 | + 2. Auto-fixable issues will be addressed by robot-repo-automaton (Phase 3) |
| 146 | + 3. Manual review required for complex issues |
| 147 | +
|
| 148 | + ## Learning |
| 149 | +
|
| 150 | + These findings feed Hypatia's learning engine to improve future rules. |
| 151 | +
|
| 152 | + --- |
| 153 | + *Powered by [Hypatia](https://github.com/hyperpolymath/hypatia) - Neurosymbolic CI/CD Intelligence* |
| 154 | + EOF |
| 155 | +
|
| 156 | + cat hypatia-report.md >> $GITHUB_STEP_SUMMARY |
| 157 | +
|
| 158 | + - name: Comment on PR with findings |
| 159 | + if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0 |
| 160 | + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v7 |
| 161 | + with: |
| 162 | + script: | |
| 163 | + const fs = require('fs'); |
| 164 | + const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8')); |
| 165 | +
|
| 166 | + const critical = findings.filter(f => f.severity === 'critical').length; |
| 167 | + const high = findings.filter(f => f.severity === 'high').length; |
| 168 | +
|
| 169 | + let comment = `## 🔍 Hypatia Security Scan\n\n`; |
| 170 | + comment += `**Findings:** ${findings.length} issues detected\n\n`; |
| 171 | + comment += `| Severity | Count |\n|----------|-------|\n`; |
| 172 | + comment += `| 🔴 Critical | ${critical} |\n`; |
| 173 | + comment += `| 🟠 High | ${high} |\n`; |
| 174 | + comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`; |
| 175 | +
|
| 176 | + if (critical > 0) { |
| 177 | + comment += `⚠️ **Action Required:** Critical security issues found!\n\n`; |
| 178 | + } |
| 179 | +
|
| 180 | + comment += `<details><summary>View findings</summary>\n\n`; |
| 181 | + comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`; |
| 182 | + comment += `</details>\n\n`; |
| 183 | + comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`; |
| 184 | +
|
| 185 | + github.rest.issues.createComment({ |
| 186 | + owner: context.repo.owner, |
| 187 | + repo: context.repo.repo, |
| 188 | + issue_number: context.issue.number, |
| 189 | + body: comment |
| 190 | + }); |
0 commit comments