ci(hypatia-scan): repin reusable to merge-commit SHA (orphan-SHA fix)

[hyperpolymath]

Summary

The hypatia-scan.yml wrapper pins to 97df762... — the PR-branch commit of standards#193, not its merge commit. After the squash-merge, that PR-branch SHA was orphaned. GitHub Actions can no longer resolve the reusable, so every hypatia-scan run fails at parse stage (jobs: [], banner: "This run likely failed because of a workflow file issue").

Diagnosis

• Old pin: 97df762107501909f50bb770e9bc200b6c415600 — PR-branch commit on standards#193 (orphaned).
• New pin: 915139d73560e65a8240b8fc7768698658502c89 — actual merge-commit on standards/main.

Verification:

$ gh api repos/hyperpolymath/standards/compare/main...97df762
{ "status": "diverged", "ahead_by": 1, "behind_by": 24 }
$ gh api repos/hyperpolymath/standards/compare/main...915139d7
{ "status": "behind", "ahead_by": 0, "behind_by": 1 }

File content at both SHAs is byte-identical; only the reachability differs.

Estate scope

This is one of ~100 PRs in the sweep (gh search code "@97df762" --owner hyperpolymath returned 100 hits). Reusables-campaign closure track. See hyperpolymath/standards#220 for the closure audit doc.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 45 issues detected

Severity	Count
🔴 Critical	4
🟠 High	16
🟡 Medium	25

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Nickel file missing SPDX-License-Identifier header (1 occurrences, CWE-1104)",
    "type": "ncl_missing_spdx",
    "file": "/home/runner/work/panic-attack/panic-attack/reports/panic-attack-20260211180017.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/src/attestation/chain.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/attestation/evidence.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/ambush/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (3 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/kanren/strategy.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (3 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/axial/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "expect() in hot path (4 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/src/assail/analyzer.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (4 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/panic-attack/panic-attack/benches/scan_bench.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/benches/scan_bench.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[hyperpolymath]

Closed as superseded: main already carries a newer SHA at the workflow location(s) this PR proposes to update. Rebasing would regress main. Refile against current main if a future repin is needed. (ERR-PR-001 — auto-closed via fix-close-obsolete-pr.sh.)