ci(governance): adopt the hypatia-baseline fix (bump governance-reusable pin)#171
Merged
Merged
Conversation
…eline fix standards#455 wired scripts/apply-baseline.sh into the shared `validate-hypatia-baseline` job so it now actually consults .hypatia-baseline.json (previously it counted raw findings and failed on any, ignoring the baseline entirely). Bumping neurophone's governance-reusable pin 7c9db0e -> 832b157 (current standards main, fix confirmed present) lets that job suppress this repo's honestly-baselined findings and go green, while still failing on any genuinely-new finding (no silent-green — apply-baseline.sh keeps non-baselined findings for the gate). Surgical on purpose: only governance-reusable is bumped. The other five standards reusables (rust-ci — deliberately pinned at 7c9db0e for the standards#439 toolchain fix — plus secret-scanner, scorecard, hypatia-scan, mirror) are left at 7c9db0e to avoid pulling unrelated deltas. This bump does pull the governance delta since 7c9db0e (standards #453 "Wave 0", #457/#458 "Wave 4"); neurophone's full CI is checked on this PR to surface any surprise from it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh
|
hyperpolymath
marked this pull request as ready for review
July 3, 2026 02:37
hyperpolymath
added a commit
that referenced
this pull request
Jul 3, 2026
…tually runs) (#172) ## Summary Follow-up to #171. That PR pinned standards `832b157` (which had #455's baseline-filter wire-in), but #455 had a bug — the scan's by-design exit-on-findings aborted the step under `bash -e` *before* the filter ran, so the gate was still mechanically broken. **standards#464** fixed that (`|| true` + a JSON-array crash guard). This re-pins `governance-reusable` **`832b157` → `f81bb04`** (current standards `main`, both #455 and #464 present). Still surgical: the other five standards reusables stay at `7c9db0e`. ## What this PR is for (diagnostic) This is the run where `validate-hypatia-baseline` finally *reaches* `apply-baseline.sh`. The newer hypatia HEAD now reports **18 findings vs the 14** neurophone's `.hypatia-baseline.json` was written against (#168), so the outcome will be one of: - **Green** — if the current baseline happens to cover all 18. Done. - **Red on the delta** — the filter kept some genuinely-new findings (there's a **new critical**, 2→3). That is the filter working correctly. Those get **honest per-repo handling** — fix-at-source, or baseline *only* verified false-positives — **never blind-baselined**, and the critical goes to the owner for a decision first. I'll read this PR's filter output and report exactly which findings are kept. Draft pending that diagnosis. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh --- _Generated by [Claude Code](https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adopts the estate-wide fix from standards#455 (merged) so neurophone's last red —
governance / Validate Hypatia Baseline— can finally go green honestly.That job previously ran
hypatia-cli.sh scan ., counted raw findings, and failed on any, ignoring.hypatia-baseline.jsonentirely. standards#455 wiredscripts/apply-baseline.shinto it (with path relativization for the hypatia#566 absolute-path gap), so it now suppresses acknowledged baseline entries while still failing on any new finding.This bumps neurophone's
governance-reusable.ymlpin7c9db0e→832b157(current standardsmain, fix confirmed present) in.github/workflows/governance.yml.Scope — surgical on purpose
governance-reusableis bumped. The other five standards reusables stay at7c9db0e— notablyrust-ci(deliberately pinned there for the standards#439 toolchain fix), plussecret-scanner,scorecard,hypatia-scan,mirror— to avoid pulling unrelated deltas.7c9db0e(standards #453 "Wave 0", #457/#458 "Wave 4"). neurophone's full CI on this PR is the check for any surprise from that delta — I'll report before/after, and flag (not paper over) anything the fuller governance reusable newly-reds.Expected outcome
governance / Validate Hypatia Baseline→ green (the repo's honestly-baselined findings — bench panics,no_testsscanner-limitation, cross-repo SD022, git_state flux — are now suppressed; validated behaviour in standards#455).Verification
The suppression logic was ground-truthed against synthetic fixtures in standards#455 (baselined → pass; a new finding → fail). This PR is the live end-to-end proof against neurophone's real
.hypatia-baseline.jsonand a freshly-built hypatia scanner in CI.Left as a draft pending the CI result + your review, since it changes which findings a security gate blocks on.
🤖 Generated with Claude Code
https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh
Generated by Claude Code