chore(ci): replace scorecard.yml with reusable wrapper

[hyperpolymath]

Pins to hyperpolymath/standards#205 merge SHA e0caf11508a3989574713c78f5f444f2ce5e33ef. Replaces the canonical scorecard.yml with a thin wrapper. Closes the 5-candidate convergence set.

Estate audit: 258 deploys / 18% drift / 39% top-SHA share.

Part of estate-wide convergence campaign 2026-05-26 (standards#199 / #205).

[github-actions]

🔍 Hypatia Security Scan

Findings: 77 issues detected

Severity	Count
🔴 Critical	2
🟠 High	53
🟡 Medium	22

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in container-policy.yml",
    "type": "npermissions_typo",
    "file": "container-policy.yml",
    "action": "fix_typo",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Port.open spawn -- validate command before execution (1 occurrences, CWE-78)",
    "type": "elixir_port_open_shell",
    "file": "/home/runner/work/academic-workflow-suite/academic-workflow-suite/components/backend/lib/awap_backend/core_bridge.ex",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/academic-workflow-suite/academic-workflow-suite/components/office-addin/webpack.config.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (2 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/academic-workflow-suite/academic-workflow-suite/examples/demos/web-ui/app.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (24 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/academic-workflow-suite/academic-workflow-suite/monitoring/exporters/aws_exporter.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (1 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/academic-workflow-suite/academic-workflow-suite/components/core/src/feedback.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (5 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/academic-workflow-suite/academic-workflow-suite/components/core/src/security.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (2 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/academic-workflow-suite/academic-workflow-suite/components/core/src/config.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (2 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/academic-workflow-suite/academic-workflow-suite/components/core/src/events.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence