fix(ci): hypatia-scan.yml -- pass GITHUB_TOKEN, use --exit-zero (hype… #118

	# SPDX-License-Identifier: PMPL-1.0-or-later
	permissions:
	contents: read

	name: Guix/Nix Package Policy
	on: [push, pull_request]
	jobs:
	check:
	runs-on: ubuntu-latest
	steps:
	<<<<<<< HEAD
Check failure on line 11 in .github/workflows/guix-nix-policy.yml View workflow run for this annotation GitHub Actions / .github/workflows/guix-nix-policy.yml Invalid workflow file `You have an error in your yaml syntax on line 11`
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	=======
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
	>>>>>>> 2928af7 (chore: batch RSR compliance)
	- name: Enforce Guix primary / Nix fallback
	run: \|
	# Check for package manager files
	HAS_GUIX=$(find . -name "*.scm" -o -name ".guix-channel" -o -name "guix.scm" 2>/dev/null \| head -1)
	HAS_NIX=$(find . -name "*.nix" 2>/dev/null \| head -1)

	# Block new package-lock.json, yarn.lock, Gemfile.lock, etc.
	NEW_LOCKS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null \| grep -E 'package-lock\.json\|yarn\.lock\|Gemfile\.lock\|Pipfile\.lock\|poetry\.lock\|cargo\.lock' \|\| true)
	if [ -n "$NEW_LOCKS" ]; then
	echo "⚠️ Lock files detected. Prefer Guix manifests for reproducibility."
	fi

	# Prefer Guix, fallback to Nix
	if [ -n "$HAS_GUIX" ]; then
	echo "✅ Guix package management detected (primary)"
	elif [ -n "$HAS_NIX" ]; then
	echo "✅ Nix package management detected (fallback)"
	else
	echo "ℹ️ Consider adding guix.scm or flake.nix for reproducible builds"
	fi

	echo "✅ Package policy check passed"

Provide feedback