From 33965bacd68acc8466b7a09dbb729deedf17f29b Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 13 May 2026 03:00:37 +0200
Subject: [PATCH] fix(ci): hypatia-scan.yml -- pass GITHUB_TOKEN, use
 --exit-zero (hyperpolymath/hypatia#213)

The Hypatia Security Scan workflow exits 1 on any findings (>= medium)
because lib/hypatia/cli.ex halts with System.halt(1). Under `set -e`,
that short-circuits the step before jq/artifact-upload/PR-comment run.

Mirrors hyperpolymath/hypatia#228:
* pass GITHUB_TOKEN so the Dependabot rule stops warning
* append --exit-zero so the downstream critical/high gate stays
  the explicit gate
* bump actions/upload-artifact to v4.6.2 (ea165f8d) to match the
  estate-wide pin

See hyperpolymath/hypatia#213 for the diagnosis.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .github/workflows/hypatia-scan.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 47f21d71..093e98a7 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -34,11 +34,14 @@ jobs:
 
       - name: Run Hypatia scan
         id: scan
+        env:
+          # Suppress the Dependabot "GITHUB_TOKEN not set" warning.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           echo "Scanning repository: ${{ github.repository }}"
 
           # Run scanner (exits non-zero when findings exist, which is expected)
-          HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.json || true
+          HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia-findings.json || true
 
           # Count findings (handle both flat array and nested structures)
           FINDING_COUNT=$(jq 'if type == "array" then length else 0 end' hypatia-findings.json 2>/dev/null || echo 0)
@@ -60,7 +63,7 @@ jobs:
           echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
 
       - name: Upload findings artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: hypatia-findings
           path: hypatia-findings.json