build(deps): Bump hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml from 897159a4e7392eb2be76630c5c5d3c1132cce040 to ea88be7da68e07249ae7df8b948ecb8ecfb9664c in the actions group

[dependabot]

Bumps the actions group with 1 update: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml.

Updates hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml from 897159a4e7392eb2be76630c5c5d3c1132cce040 to ea88be7da68e07249ae7df8b948ecb8ecfb9664c

Changelog

Sourced from hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml's changelog.

Changelog

[Unreleased] — 2026-04-18

Added

• User-classification registry (assail::UserClassification, load_user_classifications, apply_user_classifications): panic-attack now reads an optional project-local classification file at every assail pass and flips matching findings to suppressed = true after the kanren structural-suppression pass. Two lookup paths:
  • <project_root>/audits/assail-classifications.a2ml (preferred)
  • <project_root>/.panic-attack-classifications.a2ml (fallback) File format is a simple A2ML S-expression with (classification (file …) (category …) (audit …) (rationale …)) blocks; ;; line comments ignored. The registry pattern lets repositories record audited findings out-of-band from the source under scan so a PR adding a new unsafe block cannot self-suppress without a reviewable companion edit to the registry.
• Rocq scaffold classifier (analyze_coq + count_rocq_unverified_postulates + is_rocq_abstraction_parameter): the Rocq detector no longer counts Section-scoped Variable / Hypothesis / Parameter declarations (they discharge at End Section) and classifies module-level Parameter declarations by stated type: carrier types (Type, Set), decidability witnesses (forall _, { _ = _ } + { _ <> _ }), and function types with a concrete non-Prop codomain are treated as abstraction parameters. Prop-valued declarations (classical excluded-middle, choice, unresolved theorem statements) remain counted. Removes the false-positive stream that surfaced on every canonical-proof-suite scaffold.

Changed

• Suppression pipeline: analyze() and analyze_verbose() now chain apply_suppression → apply_user_classifications in that order; the explicit post-analyze calls in assail::analyze and assail::analyze_verbose at the module boundary are retained for API-contract clarity but are no-ops when an Analyzer pass has already run.
• Rocq test coverage: 12 new unit tests across analyzer.rs (Section-scoped Variables / module-level Type carriers / decidable equality / concrete-codomain functions / Prop-valued axioms / missing type annotation / full scaffold shape — 7 tests) and mod.rs (missing-registry / single-entry / multiple-entry / comment handling / end-to-end suppression-flip — 5 tests).

Verified

• 007 canonical-proof-suite scan: active finding count 8 → 0 (the 6 scaffold ProofDrifts via the detector enhancement, the 2 zig_bridge.rs UnsafeCode findings via the classification registry pointing at audits/audit-ffi-unsafe.md §1). No in-source

... (truncated)

Commits

• ea88be7 ci(hypatia-scan): repin reusable to merge-commit SHA (#81)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions