Skip to content

ci(workflow): adopt hardened hypatia-scan from hyperpolymath/hypatia#237 #60

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 3 commits into from
May 14, 2026
+302 −24
Merged

ci(workflow): adopt hardened hypatia-scan from hyperpolymath/hypatia#237 #60

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b0c5f79
ci(workflow): adopt hardened hypatia-scan from hyperpolymath/hypatia#237
hyperpolymath May 14, 2026
9fcb0e5
ci(fixup): restore newlines in hypatia-scan.yml
hyperpolymath May 14, 2026
0b0cc34
ci(baseline): seed/refresh .hypatia-baseline.json from new workflow's…
hyperpolymath May 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
132 changes: 108 additions & 24 deletions .github/workflows/hypatia-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,11 @@ on:

permissions:
contents: read
# security-events: read lets the built-in GITHUB_TOKEN query this
# repo\'s own Dependabot alerts via the Hypatia DependabotAlerts rule.
security-events: read
# `pull-requests: write` is needed for the "Comment on PR with findings"
# step to POST a results summary. Note: on Dependabot PRs the token is
# downgraded to read-only regardless, so that step is also marked
# continue-on-error below.
pull-requests: write

jobs:
scan:
Expand All @@ -29,35 +31,67 @@ jobs:
fetch-depth: 0 # Full history for better pattern analysis

- name: Setup Elixir for Hypatia scanner
uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.18.2
uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.18.2
with:
elixir-version: '1.19.4'
otp-version: '28.3'

- name: Clone Hypatia
- name: Clone Hypatia (or use checkout when scanning hypatia itself)
run: |
if [ ! -d "$HOME/hypatia" ]; then
# When scanning hypatia from inside hypatia, point $HOME/hypatia
# at the PR/branch checkout instead of cloning main — otherwise
# CLI changes can never pass their own gate (the scanner binary
# would always come from main and ignore new flags).
if [ "${{ github.repository }}" = "hyperpolymath/hypatia" ]; then
ln -sfn "${GITHUB_WORKSPACE}" "$HOME/hypatia"
elif [ ! -d "$HOME/hypatia" ]; then
git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia"
fi

- name: Build Hypatia scanner (if needed)
working-directory: ${{ env.HOME }}/hypatia
run: |
if [ ! -f hypatia-v2 ]; then
echo "Building hypatia-v2 scanner..."
cd scanner
cd "$HOME/hypatia"
if [ ! -f hypatia ]; then
echo "Building hypatia scanner..."
mix deps.get
mix escript.build
mv hypatia ../hypatia-v2
fi

- name: Run Hypatia scan
id: scan
env:
# Suppress the "Warning: Dependabot alerts unavailable: GITHUB_TOKEN
# not set" line so the run is silent-warning-free. The token is
# read-only by default and only used to query Dependabot alerts.
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
echo "Scanning repository: ${{ github.repository }}"

# Run scanner
HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.json
# Run scanner with --exit-zero so a findings-found exit-1 does
# NOT short-circuit the rest of this step under `set -e`. The
# downstream "Check for critical or high-severity issues" step
# is the explicit gate. See hyperpolymath/hypatia#213.
#
# Guard against the scanner producing no output (a crash, an
# unknown flag, etc.): if hypatia-findings.json is empty or
# missing after the run, fall back to "[]" so the jq calls
# below don't 9 the whole gate. We surface stderr so the
# underlying scanner failure is still visible in the log.
set +e
HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero \
> hypatia-findings.json 2> hypatia-scan.stderr
SCAN_EXIT=$?
set -e
echo "Scanner exit: $SCAN_EXIT"
if [ -s hypatia-scan.stderr ]; then
echo "--- scanner stderr ---"
cat hypatia-scan.stderr
echo "--- end stderr ---"
fi
if ! jq empty hypatia-findings.json 2>/dev/null; then
echo "Scanner did not produce valid JSON; defaulting to empty findings."
echo "[]" > hypatia-findings.json
fi

# Count findings
FINDING_COUNT=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0)
Expand All @@ -79,7 +113,7 @@ jobs:
echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY

- name: Upload findings artifact
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: hypatia-findings
path: hypatia-findings.json
Expand All @@ -89,6 +123,8 @@ jobs:
if: steps.scan.outputs.findings_count > 0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
FLEET_PUSH_TOKEN: ${{ secrets.HYPATIA_DISPATCH_PAT }}
FLEET_DISPATCH_TOKEN: ${{ secrets.HYPATIA_DISPATCH_PAT }}
GITHUB_REPOSITORY: ${{ github.repository }}
GITHUB_SHA: ${{ github.sha }}
run: |
Expand All @@ -98,21 +134,63 @@ jobs:
FLEET_DIR="/tmp/gitbot-fleet-$$"
git clone https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR"

# Run submission script
bash "$FLEET_DIR/scripts/submit-finding.sh" hypatia-findings.json
# Run submission script. Pass the findings path as ABSOLUTE —
# submit-finding.sh cd's into its own working dir before reading
# the file, so a relative path would resolve to the wrong place
# and the script fails with "No such file or directory".
bash "$FLEET_DIR/scripts/submit-finding.sh" "$GITHUB_WORKSPACE/hypatia-findings.json"

# Cleanup
rm -rf "$FLEET_DIR"

echo "✅ Finding submission complete"

- name: Check for critical issues
if: steps.scan.outputs.critical > 0
- name: Check for critical or high-severity issues
if: steps.scan.outputs.critical > 0 || steps.scan.outputs.high > 0
run: |
echo "⚠️ Critical security issues found!"
echo "Review hypatia-findings.json for details"
# Don't fail the build yet - just warn
# exit 1
echo "Total critical/high: ${{ steps.scan.outputs.critical }} critical, ${{ steps.scan.outputs.high }} high"

# Baseline-aware gate: pre-existing accepted findings live in
# .hypatia-baseline.json (committed). New critical/high findings
# not in the baseline still fail the build. Findings are matched
# on (severity, rule_module, type, file) tuple with absolute
# build paths normalised to repo-relative.
if [ -f .hypatia-baseline.json ]; then
# Normalise + project the FINDING IDENTITY tuple from the current
# scan. Identity is (severity, rule_module, type, file) — `action`
# is remediation guidance that can legitimately drift between
# scanner versions (e.g. "flag" -> "create_branch") and is NOT
# part of what makes two findings the same.
jq '[ .[] | select(.severity == "critical" or .severity == "high")
| {severity, rule_module, type,
file: (.file | sub("^/home/runner/work/[^/]+/[^/]+/"; "")
| sub("^/github/workspace/"; "")) } ]' \
hypatia-findings.json > findings-current.json

# Subtract baseline. A current finding is "new" iff there's no
# baseline element with the same identity tuple. Baseline entries
# may include extra fields (e.g. `action`); strip them before the
# comparison so legacy baselines keep working.
jq --slurpfile base .hypatia-baseline.json \
'($base[0] | map({severity, rule_module, type, file})) as $bk
| map(. as $f | select(($bk | any(. == $f)) | not))' \
findings-current.json > findings-new.json
new_count=$(jq 'length' findings-new.json)

if [ "$new_count" -gt 0 ]; then
echo "::error::$new_count new critical/high finding(s) outside the baseline:"
jq -r '.[] | " [\(.severity)] \(.rule_module)/\(.type) — \(.file)"' findings-new.json
echo
echo "If these are intentional, regenerate .hypatia-baseline.json:"
echo " jq '[.[] | select(.severity == \"critical\" or .severity == \"high\") | {severity, rule_module, type, file}] | sort_by(.severity, .rule_module, .type, .file)' hypatia-findings.json > .hypatia-baseline.json"
exit 1
fi
echo "All critical/high findings present in baseline — gate passes."
else
echo "No .hypatia-baseline.json — failing on any critical/high (legacy behaviour)."
echo "Review hypatia-findings.json for details"
exit 1
fi

- name: Generate scan report
run: |
Expand Down Expand Up @@ -149,8 +227,14 @@ jobs:
cat hypatia-report.md >> $GITHUB_STEP_SUMMARY

- name: Comment on PR with findings
# Dependabot PRs always run with a read-only token regardless of the
# workflow's declared permissions, so the createComment call below
# would 403 on every dep-bump PR. The PR comment is informational
# (the check result is already visible in the PR UI); we don't want
# its absence to block merge.
if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v7
continue-on-error: true
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v7
with:
script: |
const fs = require('fs');
Expand Down Expand Up @@ -180,4 +264,4 @@ jobs:
repo: context.repo.repo,
issue_number: context.issue.number,
body: comment
});
});
Loading
Loading