fix(ci): re-point validate-action references at the ecosystem repos

[hyperpolymath]

hyperpolymath/k9-validate-action and hyperpolymath/a2ml-validate-action no longer exist as standalone repositories. Both were consolidated into k9-ecosystem / a2ml-ecosystem as real top-level directories and the originals deleted.

The content is intact — 302 and 306 files respectively. Only these references are stale.

Any workflow reaching them fails at job setup:

Unable to resolve action hyperpolymath/k9-validate-action, repository not found

The fix — a path change, not a restore

GitHub resolves an action held in a subdirectory as owner/repo/path@ref:

- uses: hyperpolymath/a2ml-validate-action@<old-sha>
+ uses: hyperpolymath/a2ml-ecosystem/validate-action@aa4b836b
- uses: hyperpolymath/k9-validate-action@<old-sha>
+ uses: hyperpolymath/k9-ecosystem/validate-action@89f3c270

Both targets verified to hold a real action.yml — Validate A2ML Manifests and Validate K9 Configurations.

How this stayed hidden

dogfood-gate.yml was itself invalid YAML in 71 repos, so the workflow had never run and never attempted to resolve these actions. Repairing the parse error exposed the stale reference underneath — one layer of silent breakage concealing another.

Verified before push

• every edited file still parses and still yields a jobs: mapping
• no *-validate-action@ reference remains
• 1 file(s) changed, all under .github/workflows

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 42 issues detected

Severity	Count
🔴 Critical	4
🟠 High	22
🟡 Medium	16

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (1 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/valence-shell/valence-shell/proofs/agda/FilesystemModel.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (2 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/valence-shell/valence-shell/proofs/idris2/src/Filesystem/Axioms.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "JSON decode without validation (1 occurrences, CWE-20)",
    "type": "json_decode_no_validation",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/mcp/src/Server.res",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Obj.magic bypassing type safety (2 occurrences, CWE-704)",
    "type": "obj_magic",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/mcp/src/bindings/Mcp.res",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/executable.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/arith.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (1 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/test_command.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/glob.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (2 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/process_sub.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "as_ptr exposes raw pointer that may dangle or alias unsafely (2 occurrences, CWE-676)",
    "type": "as_ptr",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/process_sub.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence