fix: the Hypatia gate still could not fire -- the availability probe was unsatisfiable

[hyperpolymath]

The gate still could not fire — a second, independent route to a fake-clean result

The recent --exit-zero fix closed one route by which static-analysis-gate.yml produced a
falsely-clean hypatia-findings.json. Step-level verification of that merge showed there are two,
and this PR closes the other.

Fail on critical security findings gates on critical == 0 in hypatia-findings.json. Two separate
paths write a clean [] without the scanner ever reaching a verdict:

#	route	status
1	scan . > f.json 2>&1 folds stderr into the payload → jq fails → || echo '[]' fallback	fixed by the previous PR
2	the availability probe says the scanner is absent → scan step skipped → Create stub findings writes []	fixed here

Route 2, measured

- name: Clone and build Hypatia
  id: build
  continue-on-error: true          # every failure becomes "unavailable"
  run: |
    git clone ".../hypatia.git" "$HOME/hypatia" 2>/dev/null || true
    if [ -d "$HOME/hypatia/scanner" ]; then ... ready=true
    else echo "::notice::...not available"; ready=false; fi
- name: Run Hypatia scan
  if: steps.build.outputs.ready == 'true'
- name: Create stub findings (when Hypatia unavailable)
  if: steps.build.outputs.ready != 'true'
  run: echo "[]" > hypatia-findings.json     # <-- gate goes GREEN

Two defects, both failing closed to green:

• [ -d "$HOME/hypatia/scanner" ] is unsatisfiable. hyperpolymath/hypatia has no scanner/
  directory — its top-level dirs are lib cli clients config … tools tui verification verify. The
  test can never be true, so the scan step was always skipped.
• ${REPO_OWNER}/hypatia is a 404 for any owner but hyperpolymath
  (metadatastician/hypatia does not exist), so the clone silently failed under 2>/dev/null || true.

Evidence this was live, not theoretical

Job-step conclusions on the merge run of the previous PR, across the 11 repos it landed in:

Clone and build Hypatia = success | Run Hypatia scan = skipped | Create stub findings = success

for exactly a2ml-validate-action, hybrid-automation-router and gossamer, and for no others. A
census of the probe expression across all 91 staged workflow files predicted precisely those repos
(85 correct mix.exs probes, 3 scanner/, 3 ${REPO_OWNER}) — prediction and observation matched
file-for-file. Note Clone and build Hypatia = success is not evidence the scanner ran: the step
is continue-on-error: true.

What this PR changes

1. Probes [ -f "$HOME/hypatia/mix.exs" ] — the file the project actually has.
2. Hardcodes hyperpolymath/hypatia (and hyperpolymath/panic-attack) instead of ${REPO_OWNER}.
3. Turns the silent ::notice:: into a ::error:: annotation, so a genuinely unavailable scanner is
   visible in the run rather than passing quietly.

The vestigial mv hypatia ../hypatia-v2 is dropped: the scan step invokes
"$HOME/hypatia/hypatia-cli.sh", never the moved binary.

Deliberately NOT changed — a policy question for the owner

Unavailability still yields [] and a green check. Making it fail would mean any hypatia outage
reddens every repo at once; that is a real availability trade-off and an estate-wide policy call, not
something to decide inside one PR. The ::error:: annotation makes the situation loud in the
meantime. The principle at stake — a gate that cannot run must not report success — is raised
separately for a ruling.

[coderabbitai]

Warning

Review limit reached

Next included review available in 32 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 18c00c32-4442-4c84-8e1a-5b41aed26790

📥 Commits

Reviewing files that changed from the base of the PR and between 867a03d and 08b9ed2.

📒 Files selected for processing (1)

• .github/workflows/static-analysis-gate.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud