From b6ea5cb75a73cf69e77c4e5e2064357cbe542f2e Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 1 May 2026 01:48:43 +0100
Subject: [PATCH 1/3] ci(hypatia): fix unresolvable upload-artifact SHA pin

The pinned SHA 65c79d7f54e76e4e3c7a8f34db0f4ac8b515c478 doesn't exist
in actions/upload-artifact, so the runner errors with "Unable to
resolve action ... unable to find version" and Hypatia scans never
start.

Pinned to v4.6.2 (ea165f8d65b6e75b540449e92b4886f43607fa02), which
is the latest v4 series matching the original `# v4` comment.
---
 .github/workflows/hypatia-scan.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 82ff6ce..2e5a7df 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -73,7 +73,7 @@ jobs:
           echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
 
       - name: Upload findings artifact
-        uses: actions/upload-artifact@65c79d7f54e76e4e3c7a8f34db0f4ac8b515c478 # v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: hypatia-findings
           path: hypatia-findings.json

From 9258c2f72ebeb9016585bf25c4374cc7831ff820 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 1 May 2026 01:55:48 +0100
Subject: [PATCH 2/3] ci: bump setup-beam to v1.24.0; tighten workflow-linter
 uses: regex

Two more CI infra fixes uncovered while sorting PR #2:

* hypatia-scan.yml: setup-beam@v1.18.2 doesn't recognise ImageOS
  ubuntu24, so every Hypatia run aborts with "Tried to map a target
  OS from env. variable 'ImageOS' (got ubuntu24), but failed."
  Bumped to v1.24.0 (8d44588995...), which lists ubuntu-24.04
  support in its README.

* workflow-linter.yml: the SHA-pinned-actions check ran
  `grep -rn "uses:" .github/workflows/`, which matches the linter's
  own explanatory comment `# Find any uses: lines that don't have
  @SHA format`. The comment is then flagged as unpinned and the
  check fails on itself. Anchor the regex on leading-whitespace +
  the directive form `^[[:space:]]+uses:[[:space:]]` so comments
  no longer match.
---
 .github/workflows/hypatia-scan.yml    | 2 +-
 .github/workflows/workflow-linter.yml | 7 ++++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 2e5a7df..a8c2b6c 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -25,7 +25,7 @@ jobs:
           fetch-depth: 0  # Full history for better pattern analysis
 
       - name: Setup Elixir for Hypatia scanner
-        uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2
+        uses: erlef/setup-beam@8d44588995e53ce789721e96227122a67826542d # v1.24.0
         with:
           elixir-version: '1.19.4'
           otp-version: '28.3'
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index 2c46c59..734e3f9 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -61,9 +61,10 @@ jobs:
       - name: Check SHA-Pinned Actions
         run: |
           echo "=== Checking Action Pinning ==="
-          # Find any uses: lines that don't have @SHA format
-          # Pattern: uses: owner/repo@<40-char-hex>
-          unpinned=$(grep -rn "uses:" .github/workflows/ | \
+          # Find indented "uses:" directives without an @SHA pin.
+          # Anchor on leading whitespace + the directive form so this
+          # check doesn't match its own explanatory comments.
+          unpinned=$(grep -rnE "^[[:space:]]+uses:[[:space:]]" .github/workflows/ | \
             grep -v "@[a-f0-9]\{40\}" | \
             grep -v "uses: \./\|uses: docker://\|uses: actions/github-script" || true)
 

From f386823560d746497177bd8b746268a05dbe6ddf Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 1 May 2026 01:57:54 +0100
Subject: [PATCH 3/3] ci(hypatia): cd into $HOME/hypatia in shell instead of
 via working-directory

\${{ env.HOME }} resolves the workflow's `env:` block, not the runner's
$HOME, so the previous `working-directory: \${{ env.HOME }}/hypatia`
expanded to /hypatia and the build step failed with
"working directory '/hypatia'. No such file or directory".

Use a shell `cd "$HOME/hypatia"` instead, matching how the Clone and
Run steps already address the path.
---
 .github/workflows/hypatia-scan.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index a8c2b6c..40916ed 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -37,8 +37,8 @@ jobs:
           fi
 
       - name: Build Hypatia scanner (if needed)
-        working-directory: ${{ env.HOME }}/hypatia
         run: |
+          cd "$HOME/hypatia"
           if [ ! -f hypatia ] && [ ! -f hypatia-v2 ]; then
             echo "Building hypatia-v2 scanner..."
             mix deps.get