From 8ae41d9816a340b83feea12a7fa4db7239e526c5 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 27 Jul 2026 15:59:30 +0100 Subject: [PATCH] fix(ci): relativize finding paths in hypatia-scan baseline gate (mirror governance) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hypatia-scan-reusable.yml Gate on baseline step ran apply-baseline.sh directly on the raw findings, without the path relativization governance-reusable.yml does. Hypatia code_safety/honest_completion modules emit ABSOLUTE host paths in .file (Path.expand(repo)) while .hypatia-baseline.json uses repo-relative paths, so those findings never matched the baseline and the gate blocked on already-acknowledged findings — keeping Hypatia Security Scan red even after every real issue was baselined or purged. Added the identical jq relativization the governance gate uses (hypatia#566 stopgap). Estate-wide: fixes the scan gate for every repo that commits a baseline. Proof: the governance baseline gate passes at the stricter info threshold once the token is purged, so with matching relativization this high-threshold gate has nothing unbaselined left to block on. Co-Authored-By: Claude Fable 5 --- .github/workflows/hypatia-scan-reusable.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml index a0f87423..c46c94d4 100644 --- a/.github/workflows/hypatia-scan-reusable.yml +++ b/.github/workflows/hypatia-scan-reusable.yml @@ -169,7 +169,18 @@ jobs: # itself the moment a baseline lands (standards#399/#437/#446). if [ -f scripts/apply-baseline.sh ] && [ -f .hypatia-baseline.json ]; then echo "Baseline present — running BLOCKING gate (threshold: high)." - bash scripts/apply-baseline.sh hypatia-findings.json .hypatia-baseline.json blocking + # Relativize finding paths before matching (hypatia#566 stopgap): + # code_safety / honest_completion emit ABSOLUTE host paths in .file + # (Path.expand(repo)); the baseline uses repo-relative paths, so without + # this they never match and the gate fails on already-acknowledged + # findings. Mirrors governance-reusable.yml, which relativizes identically. + jq --arg root "$PWD" ' + map(if (.file? // "") == $root then .file = "." + elif (.file? // "") | startswith($root + "/") + then .file = (.file | ltrimstr($root + "/")) + else . end) + ' hypatia-findings.json > hypatia-findings.relativized.json + bash scripts/apply-baseline.sh hypatia-findings.relativized.json .hypatia-baseline.json blocking else echo "No committed baseline — gate stays advisory (see next step)." fi