ci(no-js): warn-first no-JS scan + canonical no-JavaScript-source policy by hyperpolymath · Pull Request #347 · hyperpolymath/standards

hyperpolymath · 2026-06-02T17:56:43Z

Summary

Estate-wide no hand-authored JavaScript (source) rule plus its warn-first CI enforcement.

docs/NO-JAVASCRIPT-SOURCE-POLICY.adoc — canonical statement: estate-authored logic is AffineScript→typed-wasm or Rust+Zig→wasm; hand-authored .js/.jsx/.mjs/.cjs/.ts/.tsx is not an accepted destination. Tightens the earlier "no unnecessary JS" stance (standards#254).
.github/workflows/no-js-scan.yml — warn-first / non-blocking companion that reports the hand-authored JS/TS surface to the run summary. Excludes generated (*.res.js, *.res.mjs, lib/{js,es6,bs}, out, dist, .deno, generated/), vendored (node_modules, deps), and declaration (*.d.ts) files.

Relationship to existing enforcement: this defers to hypatia cicd_rules/javascript_detected as the authoritative hard-block — it does not override or duplicate it. hypatia blocks new JS in non-carve-out paths; this scan surfaces the full existing surface for migration visibility.

Surface reported in this repo: 29 files.

Notes

Warn-only: cannot fail the build. Flips to blocking per-repo, by owner decision, once a repo reaches zero.
Companion workflow also added to burble (14) and gossamer (0). paint-type pending write access (the hyperpolymath credential is read-only there).

Draft for review.

https://claude.ai/code/session_01CS2BLBL22WTTjmc1UmEGa2

Generated by Claude Code

Adds a non-blocking no-js-scan.yml reporting the hand-authored JS/TS surface (excludes generated/vendored/declaration files) plus docs/NO-JAVASCRIPT-SOURCE-POLICY.adoc as the canonical estate statement. Complements hypatia cicd_rules/javascript_detected (authoritative hard-block) without overriding it. Warn-first rollout per standards#254. https://claude.ai/code/session_01CS2BLBL22WTTjmc1UmEGa2

github-actions · 2026-06-02T18:08:09Z

🔍 Hypatia Security Scan

Findings: 202 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	95

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affinescript-verify.yml",
    "type": "missing_timeout_minutes",
    "file": "affinescript-verify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in changelog-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "changelog-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in deno-ci-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "deno-ci-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

https://claude.ai/code/session_01CS2BLBL22WTTjmc1UmEGa2

github-actions · 2026-06-02T18:21:30Z

🔍 Hypatia Security Scan

Findings: 202 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	95

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affinescript-verify.yml",
    "type": "missing_timeout_minutes",
    "file": "affinescript-verify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in changelog-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "changelog-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in deno-ci-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "deno-ci-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

github-actions · 2026-06-02T19:28:16Z

🔍 Hypatia Security Scan

Findings: 202 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	95

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affinescript-verify.yml",
    "type": "missing_timeout_minutes",
    "file": "affinescript-verify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in changelog-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "changelog-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in deno-ci-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "deno-ci-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath and others added 2 commits June 2, 2026 19:10

Merge branch 'main' into claude/awesome-mendel-tHDLR

fb66296

docs(no-js): record gossamer blocking flip in rollout status

12d3b7c

https://claude.ai/code/session_01CS2BLBL22WTTjmc1UmEGa2

hyperpolymath marked this pull request as ready for review June 2, 2026 18:14

hyperpolymath added 2 commits June 2, 2026 20:15

Merge branch 'main' into claude/awesome-mendel-tHDLR

eb7f676

Merge branch 'main' into claude/awesome-mendel-tHDLR

b336380

hyperpolymath merged commit 2b88f34 into main Jun 2, 2026
9 of 18 checks passed

hyperpolymath deleted the claude/awesome-mendel-tHDLR branch June 2, 2026 19:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci(no-js): warn-first no-JS scan + canonical no-JavaScript-source policy#347

ci(no-js): warn-first no-JS scan + canonical no-JavaScript-source policy#347
hyperpolymath merged 5 commits into
mainfrom
claude/awesome-mendel-tHDLR

hyperpolymath commented Jun 2, 2026

Uh oh!

github-actions Bot commented Jun 2, 2026

Uh oh!

github-actions Bot commented Jun 2, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jun 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

hyperpolymath commented Jun 2, 2026

Summary

Notes

Uh oh!

github-actions Bot commented Jun 2, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Jun 2, 2026

🔍 Hypatia Security Scan

Uh oh!

Uh oh!

github-actions Bot commented Jun 2, 2026

🔍 Hypatia Security Scan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants