security: prune stale .hypatia-ignore entries #77

Activity

1. hyperpolymath

   added

   automationBots, schedulers, dispatch, self-healing, fan-outBots, schedulers, dispatch, self-healing, fan-out

   choreRoutine maintenance with no behaviour changeRoutine maintenance with no behaviour change

   security

   on Aug 27, 2026
2. hyperpolymath

   added a commit that references this issue on Sep 26, 2026

   fix: resolve repository issues, port Lean FilesystemCNO, and unify Co…

   ...

   b7c780f
3. hyperpolymath commented on Sep 30, 2026

   

   hyperpolymath

   on Sep 30, 2026

   OwnerAuthor

   More actions

   This issue is fixed on main. The stale .hypatia-ignore entries were removed in b7c780f (#174, 2026-09-26). .hypatia-ignore now contains only its SPDX header and a note saying the ReScript entries and the removed examples/go|java|kotlin|swift paths were pruned for this issue.

   How I verified it: I ran a local scan of main at b7c780f with the hypatia escript from hyperpolymath/hypatia#883 (no Actions minutes used). No banned-language finding came back after the prune, so no entry was still doing any work.

   The residue from that scan is 75 findings: 2 critical, 3 high, 52 medium, 18 warn.

   Severity	Rule	Location	Note
   critical	believe_me	src/abi/AbsoluteZero/ABI/Proofs/DivMod.idr:92	Real proof debt
   critical	believe_me	src/abi/AbsoluteZero/ABI/Layout.idr:270	Real proof debt
   high	isabelle_oops	proofs/isabelle/OND.thy:16	Real proof debt
   high	unwrap_without_check	src/whitespace/src/lib.rs:169	Library code
   high	ada_pragma_suppress	examples/ada/balanced_ops.adb:126

   These are genuine findings, and they should be fixed in the code rather than ignored.

   The scan also turned up two false positives. Both were fixed in the scanner itself (hyperpolymath/hypatia#883), not by adding ignore entries here:

   • WH002, wiki-sync.yml: it said "safe to narrow contents: write", but scripts/wiki-sync.sh does the push that needs that permission. The rule now follows repo-local scripts. It now warns that narrowing would break the sync.
   • "No SECURITY.md": it fired even though SECURITY.adoc is present. Both policy checks now accept .md, .markdown, .adoc and .rst, in the repo root, .github/ or docs/.

   Closing as completed.

   🤖 Generated with Claude Code

   https://claude.ai/code/session_01QFphKkDVB9pUDSCD4bkz65
4. hyperpolymath

   closed this as completedon Sep 30, 2026
5. hyperpolymath

   added

   priority:p2Normal - queue itNormal - queue it

   scope:repoConfined to this repositoryConfined to this repository

   status:readyFully specified and ready to be picked upFully specified and ready to be picked up

   on Sep 30, 2026