From 9dbe29c63e1387c32eae47114d5fab0c0b0adfc9 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 6 Aug 2026 20:27:16 +0100 Subject: [PATCH 1/2] fix(baseline): allow Scorecard probe names in `type` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit No Scorecard finding could be baselined by ANY repository in the estate. The schema required `type` to match ^([a-z][a-z0-9_]*|[A-Z]{2,3}[0-9]{3})$ — snake_case rule names, or SD007-style structural-drift codes. Hypatia emits Scorecard probe names verbatim, in CamelCase (DependencyPinning, BranchProtection, ...), which matches neither. The failure mode is worse than a rejected entry: apply-baseline.sh rejects the WHOLE FILE with exit 2 and the message "baseline violates hypatia-baseline.schema.json". A maintainer reads that as "my baseline is malformed" and starts hunting for their own typo, when the truth is that the finding cannot be expressed at all. Found 2026-08-06 in metadatastician/stapeln, where the only way forward was to drop the finding. Adds a third alternative for CamelCase probe names. Verified: a Scorecard entry is now accepted, a `type` with spaces is still rejected with exit 2, and the existing apply-baseline test suite still passes. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- scripts/apply-baseline.sh | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/scripts/apply-baseline.sh b/scripts/apply-baseline.sh index c85d3bc9..b1308ceb 100755 --- a/scripts/apply-baseline.sh +++ b/scripts/apply-baseline.sh @@ -93,8 +93,20 @@ SCHEMA_ERRORS="$(jq -r ' and (($e.rule_module|test("^[a-z][a-z0-9_]*$"))|not) then "entry[\($i)]: rule_module fails pattern: \($e.rule_module)" else empty end), + # `type` accepts three shapes, and the third is not cosmetic: + # snake_case — the Hypatia rule modules (unsafe_block, ...) + # SD007-style codes — structural_drift + # CamelCase — SCORECARD PROBE NAMES (DependencyPinning, + # BranchProtection, ...). Hypatia emits these + # verbatim from Scorecard, and without this + # alternative NO SCORECARD FINDING COULD BE + # BASELINED BY ANY REPOSITORY — the validator + # rejected the whole file with exit 2, which + # reads as "your baseline is malformed" rather + # than "this finding is unrepresentable". + # Found 2026-08-06 in metadatastician/stapeln. (if ($e.type|type) == "string" - and (($e.type|test("^([a-z][a-z0-9_]*|[A-Z]{2,3}[0-9]{3})$"))|not) + and (($e.type|test("^([a-z][a-z0-9_]*|[A-Z]{2,3}[0-9]{3}|[A-Z][A-Za-z0-9]+)$"))|not) then "entry[\($i)]: type fails pattern: \($e.type)" else empty end), (if ($e|has("file")) and ((($e.file|type) != "string") or ($e.file == "")) then "entry[\($i)]: file must be a non-empty string" else empty end), From 0f35a88cacc03b8cb5fa687259c95e3c6dfc6770 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 6 Aug 2026 23:31:21 +0100 Subject: [PATCH 2/2] fix(baseline): apply the type-pattern fix to the AUTHORITATIVE schema too MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found by gitar-bot review on this pull request. The previous commit widened the `type` pattern in apply-baseline.sh's jq validator, but not in .machine_readable/hypatia-baseline.schema.json. That script's own header says it MIRRORS the schema file — so the two would have disagreed, with the schema still rejecting Scorecard probe names while the validator accepted them. A divergence here is worse than either state alone: the schema is what a human reads to learn what is allowed, and any other tool validating against it would reject a baseline the estate's own gate had just passed. Verified the two now carry byte-identical patterns, and the existing apply-baseline test suite still passes. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .machine_readable/hypatia-baseline.schema.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.machine_readable/hypatia-baseline.schema.json b/.machine_readable/hypatia-baseline.schema.json index 75d01be5..e27f6a2c 100644 --- a/.machine_readable/hypatia-baseline.schema.json +++ b/.machine_readable/hypatia-baseline.schema.json @@ -30,7 +30,7 @@ "type": { "description": "Hypatia finding type within the rule module. Two shapes exist: lowercase snake_case (`banned_language_file`, `secret_detected`) and uppercase mnemonic codes emitted by structural_drift/git_state/code_scanning_alerts (`SD022`, `GS007`, `CSA001`). Entries must use the literal value the finding carries (standards#477).", "type": "string", - "pattern": "^([a-z][a-z0-9_]*|[A-Z]{2,3}[0-9]{3})$" + "pattern": "^([a-z][a-z0-9_]*|[A-Z]{2,3}[0-9]{3}|[A-Z][A-Za-z0-9]+)$" }, "file": { "description": "Repo-relative path to a single file the entry exempts. Mutually exclusive with `file_pattern`.",