fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329

[hyperpolymath]

Part of estate-wide standards#426 remediation - Batch 11 SHA update to fix Bug A and Bug B in reusable workflows.

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[github-actions]

🔍 Hypatia Security Scan

Findings: 41 issues detected

Severity	Count
🔴 Critical	10
🟠 High	18
🟡 Medium	13

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (1 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/valence-shell/valence-shell/proofs/agda/FilesystemModel.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (2 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/valence-shell/valence-shell/proofs/idris2/src/Filesystem/Axioms.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "JSON decode without validation (1 occurrences, CWE-20)",
    "type": "json_decode_no_validation",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/mcp/src/Server.res",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Obj.magic bypassing type safety (2 occurrences, CWE-704)",
    "type": "obj_magic",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/mcp/src/bindings/Mcp.res",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (16 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/commands.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "as_ptr exposes raw pointer that may dangle or alias unsafely (6 occurrences, CWE-676)",
    "type": "as_ptr",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/commands.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (4 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/parser.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (2 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/process_sub.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "as_ptr exposes raw pointer that may dangle or alias unsafely (2 occurrences, CWE-676)",
    "type": "as_ptr",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/process_sub.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (1 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/valence-shell/valence-shell/impl/rust-cli/src/test_command.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence