fix(ci): bump a2ml/k9-validate-action pins to canonical

[hyperpolymath]

Re-sync stale dogfood-gate.yml action pins to canonical (template-source already merged: rsr-template-repo#56 / v3-templater#75 / reposystem#50).

a2ml-validate-action -> 59145c7 (off the exit-127-broken 86c6da6)
k9-validate-action -> 2d96f43

Refs hyperpolymath/standards#85

[github-actions]

🔍 Hypatia Security Scan

Findings: 21 issues detected

Severity	Count
🔴 Critical	4
🟠 High	6
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action ocaml/setup-ocaml@v3 needs attention",
    "type": "unpinned_action",
    "file": "affinescript-canary.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "No permissions declaration -- add permissions: read-all",
    "type": "missing_permissions",
    "file": "elixir-ci.yml",
    "action": "add_permissions",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "binary_to_term without :safe option -- deserialization attack (1 occurrences, CWE-502)",
    "type": "elixir_send_unsanitised",
    "file": "/home/runner/work/burble/burble/server/lib/burble/media/lmdb_playout.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "SSL verify_none disables certificate validation -- MITM risk (1 occurrences, CWE-295)",
    "type": "elixir_no_ssl_verify",
    "file": "/home/runner/work/burble/burble/server/lib/burble/bridges/mumble.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "believe_me undermines formal verification (2 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/burble/burble/src/interface/abi/Foreign.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Nickel file missing SPDX-License-Identifier header (1 occurrences, CWE-1104)",
    "type": "ncl_missing_spdx",
    "file": "/home/runner/work/burble/burble/configs/config.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "Lock.unwrap() without poison handling (14 occurrences, CWE-754)",
    "type": "lock_unwrap",
    "file": "/home/runner/work/burble/burble/tools/selur-compose/crates/selur-compose-driver/src/mock.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence