fix(ci): adopt canonical hypatia-scan.yml

[hyperpolymath]

Estate sweep (verisimiser#102 cascade): replace drifted hypatia-scan.yml with the fixed canonical — corrects the env.HOME workdir / old scanner layout drift AND adds pull-requests:write + Comment-step continue-on-error so the advisory PR comment never hard-fails the Hypatia check (hypatia#213). Mechanical, verified green on verisimiser main.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

[github-actions]

🔍 Hypatia Security Scan

Findings: 46 issues detected

Severity	Count
🔴 Critical	3
🟠 High	15
🟡 Medium	28

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Merge artifact in root",
    "type": "stale",
    "file": "SPEC.core.scm.orig",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "No permissions declaration -- add permissions: read-all",
    "type": "missing_permissions",
    "file": "comprehensive-quality.yml",
    "action": "add_permissions",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Atom creation from untrusted input may exhaust atom table (1 occurrences, CWE-400)",
    "type": "erlang_atom_from_untrusted",
    "file": "/home/runner/work/betlang/betlang/lsp/bet-lsp/build/packages/thoas/src/thoas_decode.erl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Atom creation from untrusted input may exhaust atom table (1 occurrences, CWE-400)",
    "type": "erlang_atom_from_untrusted",
    "file": "/home/runner/work/betlang/betlang/lsp/bet-lsp/build/packages/gleam_erlang/src/gleam@erlang@process.erl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "binary_to_term without safe decoding options -- deserialization attack (4 occurrences, CWE-502)",
    "type": "erlang_binary_to_term_unsafe",
    "file": "/home/runner/work/betlang/betlang/lsp/bet-lsp/build/packages/gleam_erlang/src/gleam@erlang.erl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Atom creation from untrusted input may exhaust atom table (1 occurrences, CWE-400)",
    "type": "erlang_atom_from_untrusted",
    "file": "/home/runner/work/betlang/betlang/lsp/bet-lsp/build/packages/gleam_erlang/src/gleam@erlang@atom.erl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Atom creation from untrusted input may exhaust atom table (4 occurrences, CWE-400)",
    "type": "erlang_atom_from_untrusted",
    "file": "/home/runner/work/betlang/betlang/lsp/bet-lsp/build/packages/glisten/src/glisten@internal@handler.erl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Atom creation from untrusted input may exhaust atom table (5 occurrences, CWE-400)",
    "type": "erlang_atom_from_untrusted",
    "file": "/home/runner/work/betlang/betlang/lsp/bet-lsp/build/packages/glisten/src/glisten@socket@options.erl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Atom creation from untrusted input may exhaust atom table (1 occurrences, CWE-400)",
    "type": "erlang_atom_from_untrusted",
    "file": "/home/runner/work/betlang/betlang/lsp/bet-lsp/build/packages/gleeunit/src/gleeunit.erl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Atom creation from untrusted input may exhaust atom table (2 occurrences, CWE-400)",
    "type": "erlang_atom_from_untrusted",
    "file": "/home/runner/work/betlang/betlang/lsp/bet-lsp/build/packages/gleam_otp/src/gleam@otp@actor.erl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence