fix(ci): adopt canonical hypatia-scan.yml

[hyperpolymath]

Estate sweep (verisimiser#102 cascade): replace drifted hypatia-scan.yml with the fixed canonical — corrects the env.HOME workdir / old scanner layout drift AND adds pull-requests:write + Comment-step continue-on-error so the advisory PR comment never hard-fails the Hypatia check (hypatia#213). Mechanical, verified green on verisimiser main.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

[github-actions]

🔍 Hypatia Security Scan

Findings: 10 issues detected

Severity	Count
🔴 Critical	3
🟠 High	5
🟡 Medium	2

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_workflow",
    "file": "codeql.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_workflow",
    "file": "scorecard.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Required file missing (condition: public_repo)",
    "type": "missing_requirement",
    "file": ".github/workflows/scorecard.yml",
    "action": "create",
    "rule_module": "cicd_rules",
    "severity": "high"
  },
  {
    "reason": "Hardcoded credential in Nickel config -- use SecretRef (2 occurrences, CWE-798)",
    "type": "ncl_hardcoded_secret",
    "file": "/home/runner/work/flatracoon/flatracoon/netstack/configs/environments.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "line": 70,
    "reason": "Secret found: Generic secret",
    "type": "secret_detected",
    "file": "/home/runner/work/flatracoon/flatracoon/netstack/configs/environments.ncl",
    "action": "revoke_rotate_and_purge",
    "rule_module": "security_errors",
    "severity": "critical"
  },
  {
    "line": 108,
    "reason": "Secret found: Generic secret",
    "type": "secret_detected",
    "file": "/home/runner/work/flatracoon/flatracoon/netstack/configs/environments.ncl",
    "action": "revoke_rotate_and_purge",
    "rule_module": "security_errors",
    "severity": "critical"
  },
  {
    "reason": "Js.Dict deprecated -- use Dict (14 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/flatracoon/flatracoon/netstack/interface/src/FlatRacoonClient.res",
    "action": "module_replace",
    "rule_module": "migration_rules",
    "severity": "high"
  },
  {
    "reason": "Js.Json deprecated -- use JSON (31 occurrences)",
    "type": "deprecated_api",
    "file": "/home/runner/work/flatracoon/flatracoon/netstack/interface/src/FlatRacoonClient.res",
    "action": "module_replace",
    "rule_module": "migration_rules",
    "severity": "medium"
  },
  {
    "reason": "Repository has 1 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence