chore(security): SHA-pin actions/checkout in boj-build.yml

[hyperpolymath]

Summary

• SHA-pins `actions/checkout@v6.0.2` → `actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2` in `.github/workflows/boj-build.yml`.
• Originally committed 2026-05-23 as part of a fleet-wide workflow-hardening pass; the change had been sitting on local main, never pushed.
• Surfaced + recovered during a 2026-05-30 closeout sweep.

Verification

• SHA `de0fac2e4500dabe0009e67214ff5f5447ce83dd` confirmed real via `gh api repos/actions/checkout/commits/de0fac2e4500dabe0009e67214ff5f5447ce83dd` → HTTP/2 200.
• Commit `bbdd496` GPG-signed by ED25519 key SHA256:kVP7Nb+Js58NvZPglm0gByBC9KeYLl/tqWpHkNN9gUA (estate canonical).
• Matches the estate-wide SHA-pinning hygiene pass (see memory: `feedback_verify_action_sha_pins.md`).

Test plan

• SHA verified against actions/checkout repo (live tag, not fake)
• GPG signature valid
• CI passes (running)

[github-actions]

🔍 Hypatia Security Scan

Findings: 76 issues detected

Severity	Count
🔴 Critical	1
🟠 High	27
🟡 Medium	48

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "No test directory or test files found",
    "type": "no_tests",
    "file": "/home/runner/work/rpa-elysium/rpa-elysium",
    "action": "flag",
    "rule_module": "honest_completion",
    "severity": "high",
    "deduction": 20
  },
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
    "type": "codeql_language_matrix_mismatch",
    "file": "codeql.yml",
    "action": "switch_codeql_matrix_to_actions",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cargo-audit.yml",
    "type": "missing_timeout_minutes",
    "file": "cargo-audit.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cargo-audit.yml",
    "type": "missing_timeout_minutes",
    "file": "cargo-audit.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cflite_batch.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_batch.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cflite_pr.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_pr.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence