feat(governance): add hypatia-scan-reusable.yml — biggest LOC leverage of the reusable trilogy

[hyperpolymath]

Summary

Fourth and largest-leverage reusable in the workflow-convergence campaign (#168 → #174 → #187 → #190 → #192 → this). Targets hypatia-scan.yml, the 416-line estate-wide Hypatia neurosymbolic security scanner.

Drift survey

Full pagination of gh api /search/code against org:hyperpolymath:

Metric	Value
Total deployments	255
Unique blob SHAs	30
Structural drift	11.8% — lowest of all 5 surveyed templates
Top 5 SHAs coverage	213/255 (83.5%)
Top-SHA share	100 repos (39.2%)

Feature variance: zero

Sampled top 7 + long-tail 10 variants — every single one carries exactly one scan job. Line counts range 207-416, but this is pure propagation lag: older repos run an earlier slimmer version of the same monolithic job; newer repos run the 413-416-line current canonical.

No customisation, no per-repo extras, no missing jobs in the long tail.

Leverage — biggest of the convergence campaign

PR	Per-repo lines	Wrappers	LOC retired
#187 mirror	145 → 12	~267	~35,500
#190 secret-scanner	~80 → 12	~275	~19,000
#192 codeql	49 → 5	~245	~10,800
#193 hypatia-scan	416 → 16	~235	~94,000

This single PR's downstream sweep retires more workflow LOC than #187 + #190 + #192 combined.

Design

Zero inputs except runs-on. The scan job body is byte-identical to the canonical hypatia-scan.yml — no per-repo values to parameterise; every interpolation is ${{ github.* }} or ${{ secrets.* }} which resolve in the caller context.

Caller MUST:

• Use secrets: inherit — so GITHUB_TOKEN + HYPATIA_DISPATCH_PAT flow through. Without inherit, the Phase-2 gitbot-fleet submission step silently no-ops (it's continue-on-error-guarded), and the DependabotAlerts rule loses read access (HTTP 403).
• Grant contents: read + security-events: write + pull-requests: write at the call-site permissions block. Called-workflow permissions are CAPPED by caller — without security-events: write at the call site, SARIF upload to Security → Code scanning silently fails.

Caller wrapper shape (post-merge)

# SPDX-License-Identifier: PMPL-1.0-or-later
name: Hypatia Security Scan
on:
  push:
    branches: [ main, master, develop ]
  pull_request:
    branches: [ main, master ]
  schedule:
    - cron: '0 0 * * 0'
  workflow_dispatch:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions:
  contents: read
  security-events: write
  pull-requests: write
jobs:
  scan:
    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@<sha>
    secrets: inherit

~16 lines per repo, replacing ~250-416 lines (depending on which propagation snapshot the repo currently carries).

Rollout plan

NOT started in this PR — owner-gated, same as #187 / #190 / #192.

Wave	Repos	Action
1: current-canonical	~211	Top 6 SHAs at 413-416 lines. Pure mechanical wrapper.
2: standardize-up older	~24	207-253-line older versions; convert to same wrapper — body of the scan job auto-upgrades on next workflow run.
3: per-repo review	~2	hypatia repo itself (345-line — likely a development snapshot), standards (the canonical source). Exclude from sweep.

Total expected sweep: ~235 mechanical wrappers (92.2%) + 2 excluded + minor per-repo review.

Pattern hardening

• Same workflow_call shape as refactor(governance): subsume language-policy.yml + add deno-ci-reusable (semantics-level fix for estate-template drift) #168 / feat(governance): add rust-ci-reusable + elixir-ci-reusable workflows #174 / feat(governance): add mirror-reusable.yml — consolidate 289-repo mirror.yml drift #187 / feat(governance): add secret-scanner-reusable.yml — propagate shell-secrets to 281 repos #190 / feat(governance): add codeql-reusable.yml — consolidate 263-repo codeql.yml drift #192 — no new infrastructure.
• Independent of all open standards PRs — lands in any order.

Note on parallel-session count discrepancy

A separate session's audit memory ([[project_foundational_workflow_survey_2026_05_26]]) recorded "hypatia-scan: 702 copies × 416 lines × HIGH homogeneity". My methodology (gh api /search/code paginated with filename:hypatia-scan.yml path:.github/workflows org:hyperpolymath) returns 255. The HIGH homogeneity finding agrees in both surveys; the 702 figure is likely scheduled-run count or includes historical branches. Either way the leverage doesn't change much — this is the biggest single LOC removal in the campaign.

🤖 Generated with Claude Code