fix(ci): relativize paths in hypatia-scan baseline gate — greens Hypatia Security Scan - #538
Merged
Merged
Conversation
…or governance) hypatia-scan-reusable.yml Gate on baseline step ran apply-baseline.sh directly on the raw findings, without the path relativization governance-reusable.yml does. Hypatia code_safety/honest_completion modules emit ABSOLUTE host paths in .file (Path.expand(repo)) while .hypatia-baseline.json uses repo-relative paths, so those findings never matched the baseline and the gate blocked on already-acknowledged findings — keeping Hypatia Security Scan red even after every real issue was baselined or purged. Added the identical jq relativization the governance gate uses (hypatia#566 stopgap). Estate-wide: fixes the scan gate for every repo that commits a baseline. Proof: the governance baseline gate passes at the stricter info threshold once the token is purged, so with matching relativization this high-threshold gate has nothing unbaselined left to block on. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
hyperpolymath
added a commit
that referenced
this pull request
Jul 27, 2026
… last red on main (#539) Greens **Registry Verify** — the only remaining red on main. **Cause:** #536's token redaction edited `rhodium-standard-repositories/rhodium-pipeline/docs/QUICKSTART.adoc`, which is under the `rhodium-standard-repositories` spec home. The commit went in via the GitHub API (no local pre-commit hook), so the derived registry went stale by **exactly one `source_hash`** — the RSR entry. **Fix:** regenerated with `scripts/build-registry.sh` from a fresh clone of main (`564413e82`): - one hash updated (`6a00a68f…` → `d196156c…`), no entries added/removed, `TOPOLOGY.md` unchanged - verified locally: `build-registry.sh --check` ✓ and `build-scorecards.sh --check --strict` ✓ (single-step fix this time — no scorecard fallout) With this merged, main should be **fully green** for the first time: the token reds cleared via #536+#538, and this clears the drift #536 itself introduced. **Process note for the record:** any spec-home edit made via the API bypasses the #381 pre-commit guard — the CI auto-regen bot (#381 option 2) would close that hole permanently. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Greens Hypatia Security Scan, the last red besides the token.
Root cause
The
scan / Hypatia Neurosymbolic Analysisjob's "Gate on baseline" step (inhypatia-scan-reusable.yml) ranapply-baseline.shdirectly on the raw findings — with none of the path relativization thatgovernance-reusable.ymlperforms. Hypatia'scode_safety/honest_completionmodules emit absolute host paths (/home/runner/work/standards/standards/…) in.file, while.hypatia-baseline.jsonuses repo-relative paths. So those findings never matched the baseline, were treated as unbaselined, and blocked the gate — even though they're acknowledged.That's why, on the token-purge PR (#536), the Governance baseline gate passed but this scan gate failed: governance relativizes, this one didn't.
Fix
Added the identical
jqrelativization the governance gate uses (the hypatia#566 stopgap). Estate-wide — fixes the scan gate for every repo that commits a baseline.Verification
jqwas unit-tested:/root/a → a,rel/bunchanged,/root → ..infothreshold once the token is gone, so at this gate'shighthreshold, with matching relativization, nothing unbaselined remains to block on.Merge order
Independent of, but complementary to, #536 (token purge). #536 greens Governance; this greens the scan gate. Both must land for
Hypatia Security Scanto go green (the scan sees the live token as a real finding until #536, and sees unrelativized baselined findings until this). Together → main fully green.