Skip to content

Commit 4ec8927

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
authored
fix(ci+docs): resolve all Hypatia scan findings from PR #34 (#44)
## Summary Addresses all open Hypatia security scan findings reported in PR #34. **Workflow fixes (high + medium severity):** - Add `timeout-minutes` to all 9 affected jobs (`hypatia-scan`, `mirror`, `rust-ci`, `scorecard`, `secret-scanner`, `release` ×4, `scorecard-enforcer` ×3) - `scorecard-enforcer.yml`: split the combined scorecard-publish+run job into two separate jobs (`scorecard-publish` and `scorecard-enforce`) — resolves `scorecard_publish_with_run_step` - `scorecard.yml`: add explicit job-level permissions to the `analysis` caller job — resolves `scorecard_wrapper_missing_job_permissions` - `instant-sync.yml`: add `FARM_DISPATCH_TOKEN` presence gate step before `peter-evans/repository-dispatch` — resolves `secret_action_without_presence_gate` - `rsr-antipattern.yml`: anchor TypeScript Exemptions heading regex to `^[#=]+\s+` — resolves `unanchored_heading_regex` **SD022 structural drift fixes (`src/abi/` → `src/interface/Abi/`):** - `docs/RSR_OUTLINE.adoc` - `docs/developer/ABI-FFI-README.adoc` - `docs/governance/MAINTENANCE-CHECKLIST.adoc` - `docs/practice/AI-CONVENTIONS.adoc` - `src/interface/ffi/src/main.zig` **SD009 template placeholder fix:** - `src/interface/ffi/src/main.zig`: replace `{{PROJECT}}`/`{{project}}` with `nextgen_typing` ## Test plan - [ ] Hypatia scan re-run shows no new high/critical findings for the fixed rules - [ ] `scorecard-enforcer` jobs are properly split and publish runs in isolation - [ ] `instant-sync` skips dispatch when `FARM_DISPATCH_TOKEN` is absent (notices logged) - [ ] All `src/interface/Abi/` paths resolve correctly against the actual directory tree https://claude.ai/code/session_01S7PoiLxheftavnuFPE7Uq4 --- _Generated by [Claude Code](https://claude.ai/code/session_01S7PoiLxheftavnuFPE7Uq4)_ Co-authored-by: Claude <noreply@anthropic.com>
1 parent b158d66 commit 4ec8927

14 files changed

Lines changed: 86 additions & 38 deletions

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,5 +25,6 @@ permissions:
2525

2626
jobs:
2727
hypatia:
28+
timeout-minutes: 30
2829
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@915139d73560e65a8240b8fc7768698658502c89
2930
secrets: inherit

‎.github/workflows/instant-sync.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,20 @@ jobs:
1616
runs-on: ubuntu-latest
1717
timeout-minutes: 15
1818
steps:
19+
- name: Check FARM_DISPATCH_TOKEN presence
20+
id: gate
21+
env:
22+
TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
23+
run: |
24+
if [ -n "$TOKEN" ]; then
25+
echo "present=true" >> "$GITHUB_OUTPUT"
26+
else
27+
echo "present=false" >> "$GITHUB_OUTPUT"
28+
echo "::notice::FARM_DISPATCH_TOKEN not set — skipping propagation"
29+
fi
30+
1931
- name: Trigger Propagation
32+
if: steps.gate.outputs.present == 'true'
2033
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
2134
with:
2235
token: ${{ secrets.FARM_DISPATCH_TOKEN }}
@@ -31,6 +44,7 @@ jobs:
3144
}
3245
3346
- name: Confirm
47+
if: steps.gate.outputs.present == 'true'
3448
env:
3549
REPO_NAME: ${{ github.event.repository.name }}
3650
run: echo "::notice::Propagation triggered for ${REPO_NAME}"

‎.github/workflows/mirror.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,6 @@ permissions:
1111

1212
jobs:
1313
mirror:
14+
timeout-minutes: 15
1415
uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f
1516
secrets: inherit

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
build:
1919
name: Build Artifacts
2020
runs-on: ubuntu-latest
21-
timeout-minutes: 15
21+
timeout-minutes: 30
2222
permissions:
2323
contents: read
2424
steps:
@@ -154,6 +154,7 @@ jobs:
154154
provenance:
155155
name: SLSA Provenance
156156
needs: [build]
157+
timeout-minutes: 20
157158
permissions:
158159
actions: read
159160
id-token: write

‎.github/workflows/rsr-antipattern.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ jobs:
8888
if claude_md.exists():
8989
in_table = False
9090
for line in claude_md.read_text(encoding='utf-8').splitlines():
91-
if re.search(r'TypeScript [Ee]xemptions', line):
91+
if re.search(r'^[#=]+\s+.*TypeScript [Ee]xemptions', line):
9292
in_table = True
9393
continue
9494
if in_table and line.startswith(('### ', '## ', '# ')):

‎.github/workflows/rust-ci.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,5 @@ permissions:
1414

1515
jobs:
1616
rust-ci:
17+
timeout-minutes: 30
1718
uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@cc5a372af1af1b202c17f1b21efd954e6c038bef

‎.github/workflows/scorecard-enforcer.yml‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,15 @@ permissions:
2121
contents: read
2222

2323
jobs:
24-
scorecard:
24+
# Scorecard publish job — must be isolated from run steps per OpenSSF guidance.
25+
scorecard-publish:
2526
runs-on: ubuntu-latest
26-
timeout-minutes: 15
27+
timeout-minutes: 30
2728
permissions:
2829
security-events: write
2930
id-token: write # For OIDC
31+
contents: read
32+
actions: read
3033
steps:
3134
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3235
with:
@@ -44,6 +47,25 @@ jobs:
4447
with:
4548
sarif_file: results.sarif
4649

50+
# Score enforcement job — separate from publish to satisfy scorecard_publish_with_run_step rule.
51+
scorecard-enforce:
52+
runs-on: ubuntu-latest
53+
timeout-minutes: 15
54+
needs: scorecard-publish
55+
permissions:
56+
contents: read
57+
steps:
58+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
59+
with:
60+
persist-credentials: false
61+
62+
- name: Run Scorecard (score only, no publish)
63+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
64+
with:
65+
results_file: results.sarif
66+
results_format: sarif
67+
publish_results: false
68+
4769
- name: Check minimum score
4870
run: |
4971
# Parse score from results

‎.github/workflows/scorecard.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,11 @@ permissions: read-all
1212

1313
jobs:
1414
analysis:
15+
timeout-minutes: 30
16+
permissions:
17+
security-events: write
18+
id-token: write
19+
contents: read
20+
actions: read
1521
uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef
1622
secrets: inherit

‎.github/workflows/secret-scanner.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,6 @@ permissions:
1515

1616
jobs:
1717
scan:
18+
timeout-minutes: 15
1819
uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0
1920
secrets: inherit

‎docs/RSR_OUTLINE.adoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ just validate-rsr
103103
|`AI.a2ml`
104104
|Claude-specific instructions
105105

106-
|`src/abi/`
106+
|`src/interface/Abi/`
107107
|Idris2 ABI definitions (Types, Layout, Foreign)
108108

109109
|`ffi/zig/`
@@ -179,7 +179,7 @@ project/
179179
│ ├── TOPOLOGY-GUIDE.adoc
180180
│ ├── generated/
181181
│ └── man/
182-
├── src/abi/ # Idris2 ABI definitions
182+
├── src/interface/Abi/ # Idris2 ABI definitions
183183
│ ├── Types.idr
184184
│ ├── Layout.idr
185185
│ └── Foreign.idr

0 commit comments

Comments
 (0)