fix(ci): hypatia-scan.yml -- --exit-zero + GITHUB_TOKEN (hyperpolymath/hypatia#213) (#32)

* fix(ci): hypatia-scan.yml -- pass GITHUB_TOKEN, use --exit-zero (hyperpolymath/hypatia#213)

The Hypatia Security Scan workflow exits 1 on any findings (>= medium)
because lib/hypatia/cli.ex halts with System.halt(1). Under `set -e`,
that short-circuits the step before jq/artifact-upload/PR-comment run.

Mirrors hyperpolymath/hypatia#228:
* pass GITHUB_TOKEN so the Dependabot rule stops warning
* append --exit-zero so the downstream critical/high gate stays
  the explicit gate
* bump actions/upload-artifact to v4.6.2 (ea165f8d) to match the
  estate-wide pin

See hyperpolymath/hypatia#213 for the diagnosis.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(ci): bump erlef/setup-beam to fc68ffb (ubuntu24 support)

Follow-up commit on PR #32. The Hypatia Neurosymbolic Analysis check has been failing because `erlef/setup-beam@2f0cc07b…` doesn't know how to map `ImageOS=ubuntu24` (only knows ubuntu18/20/22). Without the bootstrap, the `--exit-zero` change in this PR never gets exercised.

Bumping the pin to `fc68ffb90438ef2936bbb3251622353b3dcb2f93` (matches the pin currently in hyperpolymath/hypatia upstream, dated 2026-03-30, adds ubuntu24 → ubuntu-24.04 mapping).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

* fix(manifests): add top-level identity to vendored A2ML + K9 templates

The 6 A2ML manifests under verified-container-spec/.machine_readable/6a2/
and the 6 K9 templates/examples under .machine_readable/svc/k9/ were
firing identity-field validation errors on every CI run, blocking
#32 (and any other PR) from going green.

Two parallel fixes:

  * A2ML: added `name = "verified-container-spec/<file>"` inside the
    [metadata] section of META, NEUROSYM, PLAYBOOK, AGENTIC (the 4 that
    lacked any top-level identity). STATE and ECOSYSTEM already had
    `project` / `name` respectively; left untouched.

  * K9 templates/examples: hoisted a `name = "k9-template/<level>"` or
    `name = "k9-example/<name>"` field to the top of each pedigree block,
    immediately after `schema_version`. Works around a brace-counting
    edge in hyperpolymath/k9-validate-action's pedigree-block detector:
    when `pedigree = {` opens, the validator doesn't count the opening
    brace from that line, so a subsequent `security = { ... },` closing
    brace prematurely terminates the validator's view of the pedigree
    block — making `metadata.name` invisible. The hoisted top-level
    `pedigree.name` is captured at depth 1 before any nested block,
    so it's seen regardless of the bug. The underlying bug is being
    addressed upstream in k9-validate-action#7.

Both classes of error will also be self-suppressing once stapeln bumps
its action pins to consume the new `paths-ignore` input being added in
hyperpolymath/a2ml-validate-action#7 + hyperpolymath/k9-validate-action#7
(vendored / training-corpus paths default-skipped). The fixes here are
belt-and-suspenders — independent of those upstream merges, so stapeln
#32 can go green today rather than waiting on the dependency chain.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/hypatia-scan.yml

@@ -26,7 +26,7 @@ jobs:
           fetch-depth: 0  # Full history for better pattern analysis
 
       - name: Setup Elixir for Hypatia scanner
-        uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.18.2
+        uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.18.2
         with:
           elixir-version: '1.19.4'
           otp-version: '28.3'
@@ -50,11 +50,14 @@ jobs:
 
       - name: Run Hypatia scan
         id: scan
+        env:
+          # Suppress the Dependabot "GITHUB_TOKEN not set" warning.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           echo "Scanning repository: ${{ github.repository }}"
 
           # Run scanner
-          HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.json
+          HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia-findings.json
 
           # Count findings
           FINDING_COUNT=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0)
@@ -76,7 +79,7 @@ jobs:
           echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
 
       - name: Upload findings artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: hypatia-findings
           path: hypatia-findings.json

.machine_readable/svc/k9/examples/ci-config.k9.ncl

@@ -6,6 +6,7 @@ K9!
 
 {
   pedigree = {
+    name = "k9-example/ci-config",
     schema_version = "1.0.0",
     component_type = "ci-configuration",
     security = {

.machine_readable/svc/k9/examples/project-metadata.k9.ncl

@@ -6,6 +6,7 @@ K9!
 
 {
   pedigree = {
+    name = "k9-example/project-metadata",
     schema_version = "1.0.0",
     component_type = "project-metadata",
     security = {

.machine_readable/svc/k9/examples/setup-repo.k9.ncl

@@ -6,6 +6,7 @@ K9!
 
 {
   pedigree = {
+    name = "k9-example/setup-repo",
     schema_version = "1.0.0",
     component_type = "repository-setup",
     security = {

.machine_readable/svc/k9/template-hunt.k9.ncl

@@ -6,6 +6,7 @@ K9!
 
 {
   pedigree = {
+    name = "k9-template/hunt",
     schema_version = "1.0.0",
     component_type = "TODO: describe component type (e.g., 'deployment', 'setup-script')",
     security = {

.machine_readable/svc/k9/template-kennel.k9.ncl

@@ -6,6 +6,7 @@ K9!
 
 {
   pedigree = {
+    name = "k9-template/kennel",
     schema_version = "1.0.0",
     component_type = "TODO: describe component type (e.g., 'build-config', 'metadata')",
     security = {

.machine_readable/svc/k9/template-yard.k9.ncl

@@ -6,6 +6,7 @@ K9!
 
 {
   pedigree = {
+    name = "k9-template/yard",
     schema_version = "1.0.0",
     component_type = "TODO: describe component type (e.g., 'validated-config', 'schema')",
     security = {

verified-container-spec/.machine_readable/6a2/AGENTIC.a2ml

@@ -3,6 +3,7 @@
 #
 # AGENTIC.a2ml — AI agent constraints and capabilities
 [metadata]
+name = "verified-container-spec/AGENTIC"
 version = "0.1.0"
 last-updated = "2026-04-11"
 

verified-container-spec/.machine_readable/6a2/META.a2ml

@@ -3,6 +3,7 @@
 #
 # META.a2ml — Verified Container Spec meta-level information
 [metadata]
+name = "verified-container-spec/META"
 version = "0.1.0"
 last-updated = "2026-04-11"
 

verified-container-spec/.machine_readable/6a2/NEUROSYM.a2ml

@@ -3,6 +3,7 @@
 #
 # NEUROSYM.a2ml — Neurosymbolic integration metadata
 [metadata]
+name = "verified-container-spec/NEUROSYM"
 version = "0.1.0"
 last-updated = "2026-04-11"