fix(governance): eradicate inline Python from governance-reusable.yml#189
Merged
Conversation
Estate language policy bans Python with no exceptions (SaltStack
exception removed 2026-01-03). The governance-reusable workflow that
enforces the policy was itself written in inline Python — a
self-referential violation of the structural class fixed in hypatia#328.
This PR:
* Ports the ~85-line python3 heredoc to scripts/check-ts-allowlist.ts
(Deno; --allow-read only).
* Adds scripts/tests/check-ts-allowlist-test.sh with 13 regression
cases (builtin allows: mod.ts / bindings/ / vendor/ / *.bench.ts /
lsp.ts / *.d.ts / vscode-dir / deno-prefix-dir; CLAUDE.md table
parsing: bare violation, exempted, glob match, dotted-dir skip,
later-heading closes table).
* Updates governance-reusable.yml to install Deno + check out the
standards repo's scripts/ via sparse-checkout at the same SHA the
caller picked (`github.workflow_sha`) + run the script.
Behaviour MUST stay byte-identical to the previous Python; this is a
refactor, not a policy change. All 13 fixture cases pass locally.
Dogfooded against the standards repo itself: '✅ No TypeScript files
outside allowlist (1 per-repo exemption(s) parsed)' (matches the
Telegraf carve-out documented in .claude/CLAUDE.md).
Refs: hypatia#328 (CSA001 self-loop precedent),
standards#168 (the reusable's parent landing).
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -0,0 +1,152 @@ | |||
| // SPDX-License-Identifier: PMPL-1.0-or-later | |||
🔍 Hypatia Security ScanFindings: 119 issues detected
View findings[
{
"reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
"type": "unpinned_action",
"file": "deno-ci-reusable.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
"type": "unpinned_action",
"file": "governance-reusable.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Python file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/scripts/check-ts-allowlist.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
"type": "agda_postulate",
"file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
},
{
"reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
"type": "believe_me",
"file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
hyperpolymath
enabled auto-merge (squash)
May 26, 2026 10:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Estate language policy bans Python with no exceptions (CLAUDE.md Language Policy; the SaltStack exception was removed 2026-01-03). The
governance-reusable.ymlworkflow that enforces this policy was itself written as an 85-line inlinepython3 << PYEOFheredoc — a self-referential violation, structurally identical to the CSA001 self-loop fixed in hypatia#328 (the security gate alerting on itself).This PR replaces the inline Python with a Deno script.
Changes
scripts/check-ts-allowlist.ts(new) — Deno port.--allow-readonly; no network, no env, no write.scripts/tests/check-ts-allowlist-test.sh(new) — 13 regression cases (builtin allows + CLAUDE.md table parsing)..github/workflows/governance-reusable.yml— replaces the python3 heredoc step withsetup-deno+actions/checkoutofhyperpolymath/standards@${{ github.workflow_sha }}into.standards-checkout/(sparsescripts/) +deno run --allow-read .standards-checkout/scripts/check-ts-allowlist.ts.Behaviour preservation
Byte-identical refactor, not a policy change. All 13 fixture cases pass locally. Dogfooded against this standards repo itself:
✅ No TypeScript files outside allowlist (1 per-repo exemption(s) parsed)— matches the Telegraf bot carve-out in.claude/CLAUDE.md§ TypeScript Exemptions.Why now
The standards repo currently violates its own no-Python rule. Merging unblocks the per-repo Python sweep across the rest of the estate without leaving a CI gate that contradicts the policy it enforces.
Test plan
bash scripts/tests/check-ts-allowlist-test.sh— 13/13 pass.claude/CLAUDE.mdgets0 per-repo exemption(s) parsedRefs: hypatia#328 (CSA001 self-loop precedent), standards#168 (parent reusable).
🤖 Generated with Claude Code