Skip to content

fix(ci): Phase-2 fleet submission must not fail the security gate#10

Merged
hyperpolymath merged 1 commit into
mainfrom
fix/hypatia-scan-phase2-resync
May 16, 2026
Merged

fix(ci): Phase-2 fleet submission must not fail the security gate#10
hyperpolymath merged 1 commit into
mainfrom
fix/hypatia-scan-phase2-resync

Conversation

@hyperpolymath
Copy link
Copy Markdown
Owner

Layer-1 propagation of hyperpolymath/hypatia#252.

This repo carries its own copy of .github/workflows/hypatia-scan.yml.
The "Submit findings to gitbot-fleet (Phase 2)" step hard-failed the
job (exit 127) for any commit with ≥1 finding — it clones gitbot-fleet
and execs scripts/submit-finding.sh, which no longer exists on
gitbot-fleet's default branch. That is the estate-wide "Hypatia
Neurosymbolic Analysis fails regardless of content" symptom.

Phase 2 is the collaborative learning side-channel, not the security
gate (the gate is the separate baseline-aware critical/high step, which
is untouched). Fix mirrors the canonical workflow:

  • continue-on-error: true on the Phase-2 step.
  • Self-healing body: non-fatal clone, probe known submit-script paths,
    skip with ::warning:: if absent or non-zero.

Surgical: only the Phase-2 step changed; every other step preserved.
Security enforcement is unchanged.

Refs hyperpolymath/hypatia#252

🤖 Generated with Claude Code

Layer-1 propagation of hyperpolymath/hypatia#252. This repo's own copy
of hypatia-scan.yml hard-failed (exit 127) for any commit with >=1
finding: the "Submit findings to gitbot-fleet (Phase 2)" step cloned
gitbot-fleet and exec'd scripts/submit-finding.sh, which no longer
exists on gitbot-fleet's default branch.

Phase 2 is the collaborative LEARNING side-channel, not the security
gate. Fix: continue-on-error + self-healing body (non-fatal clone,
probe known script paths, graceful ::warning:: skip). Security
enforcement (the baseline-aware critical/high step) is unchanged.

Refs hyperpolymath/hypatia#252

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@hyperpolymath hyperpolymath merged commit 1ff902e into main May 16, 2026
16 of 19 checks passed
@hyperpolymath hyperpolymath deleted the fix/hypatia-scan-phase2-resync branch May 16, 2026 12:37
@github-actions
Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 3 issues detected

Severity Count
🔴 Critical 1
🟠 High 0
🟡 Medium 2

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "line": 24,
    "reason": "Secret found: Generic API key",
    "type": "secret_detected",
    "file": "/home/runner/work/TradeUnionist.jl/TradeUnionist.jl/.envrc",
    "action": "revoke_rotate_and_purge",
    "rule_module": "security_errors",
    "severity": "critical"
  },
  {
    "reason": "Repository has 1 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Source file missing SPDX-License-Identifier header",
    "type": "SD009",
    "file": "ffi/zig/src/main.zig",
    "action": "add_spdx_header",
    "rule_module": "structural_drift",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant