ci: repair invalid instant-sync workflow + Scorecard enforcer

[hyperpolymath]

Why

Two workflow files were failing at GitHub Actions validation (whole-run failure, zero jobs), so they show red on every push to main.

instant-sync.yml — invalid YAML structure

The K9-SVC Validation block was authored as a YAML sequence item (- name: at 2-space indent) placed directly under the jobs: mapping. A mapping key (dispatch:) and a sequence entry cannot coexist at the same level, so the file does not parse and the whole workflow is invalid.

Fix: converged onto the estate-canonical instant-sync.yml:

• K9-SVC Validation is now a proper step inside the dispatch job.
• the propagation dispatch is presence-gated via a job-level env: var (env.FARM_DISPATCH_TOKEN != ''). The secrets context is not available in if:, so gating on it directly would itself invalidate the workflow.

scorecard-enforcer.yml — OSSF publish + run-step (HTTP 400) and an unreadable score

• The scorecard job ran ossf/scorecard-action with publish_results: true and a run: step in the same job; OSSF attestation rejects that with HTTP 400 ("scorecard job must only have steps with uses").
• The gate parsed SARIF at .runs[0].tool.driver.properties.score, which SARIF does not carry → it always read 0 and failed the < 5 check.

Fix: split into an uses-only publish job + an unprivileged score-gate job that re-derives the score in JSON mode (top-level .score). Also: least-privilege contents: read, bounded timeouts, canonical SHA pins. (Both failure modes verified live on nextgen-languages scorecard-enforcer run 27468148000.)

Verification

No Julia toolchain locally; both files validated as parseable YAML (yaml.safe_load). These workflows trigger on push-to-main (not pull_request), so the green proof lands after merge.

https://claude.ai/code/session_01VwbFNQJw23tW8tqM7utWku

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 23 issues detected

Severity	Count
🔴 Critical	0
🟠 High	20
🟡 Medium	3

View findings

[
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Nominal-only SAST in Axiology.jl: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/Axiology.jl/Axiology.jl",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  },
  {
    "reason": "Repository has 3 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence