From 1444316c3e086aad82a065caa90fa83ad25bf90b Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 6 Aug 2026 13:51:05 +0100 Subject: [PATCH] chore(hypatia): acknowledge 39 findings in the baseline MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `Validate Hypatia Baseline` gate fails on any finding not acknowledged in .hypatia-baseline.json, at threshold `info` — so every existing finding blocks every pull request, including ones that touch none of it. Ruling: acknowledge the current findings and KEEP the threshold at `info`, so only NEW findings block from here. That preserves the gate's strictness rather than lowering the bar estate-wide, and records the debt explicitly instead of hiding it. Entries were taken from the gate's own job output — the findings it actually produced, tagged `baseline_status: "new"` — rather than from a local scanner that might be a different version. Only those entries are added; findings already matched by the existing baseline are left alone so their severity_override values are not lost. Types covered: DependencyPinning, SD005, expect_in_hot_path, unpinned_action. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .hypatia-baseline.json | 234 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 234 insertions(+) diff --git a/.hypatia-baseline.json b/.hypatia-baseline.json index dab2a9e2..136e335c 100644 --- a/.hypatia-baseline.json +++ b/.hypatia-baseline.json @@ -208,5 +208,239 @@ "rule_module": "cicd_rules", "type": "banned_language_file", "file": "bots/gsbot/tests/unit/test_services.py" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/accessibilitybot/src/analyzers/alt_text.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/accessibilitybot/src/analyzers/aria.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/accessibilitybot/src/analyzers/forms.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/accessibilitybot/src/analyzers/keyboard.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/accessibilitybot/src/analyzers/language.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/accessibilitybot/src/analyzers/media.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/accessibilitybot/src/analyzers/semantic.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/cipherbot/src/analyzers/dns.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/cipherbot/src/analyzers/hashing.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/cipherbot/src/analyzers/password.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/cipherbot/src/analyzers/rng.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/cipherbot/src/analyzers/signatures.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/cipherbot/src/analyzers/symmetric.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/echidnabot/src/dispatcher/echidna_client.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/echidnabot/src/scheduler/limiter.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/finishingbot/src/analyzers/claims.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/glambot/src/analyzers/accessibility.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "bots/gsbot/src/services.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "robot-repo-automaton/src/hypatia.rs" + }, + { + "severity": "medium", + "rule_module": "code_safety", + "type": "expect_in_hot_path", + "file": "shared-context/benches/fleet_benchmarks.rs" + }, + { + "severity": "medium", + "rule_module": "scorecard", + "type": "DependencyPinning", + "file": "." + }, + { + "severity": "critical", + "rule_module": "structural_drift", + "type": "SD005", + "file": ".claude/worktrees/actions-policy" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "boj-build.yml" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "casket-pages.yml" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "codeql.yml" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "dogfood-gate.yml" + }, + { + "severity": "high", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "dogfood-gate.yml" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "e2e.yml" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "hypatia-dispatch-intake.yml" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "inbox-steward.yml" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "instant-sync.yml" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "learning-loop.yml" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "pages.yml" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "panicbot-sweep.yml" + }, + { + "severity": "high", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "panicbot-sweep.yml" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "push-email-notify.yml" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "repo-integrity-guard.yml" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "rust.yml" + }, + { + "severity": "medium", + "rule_module": "workflow_audit", + "type": "unpinned_action", + "file": "supervised-fleet-scan.yml" } ]