chore(governance): declare the banned-language migration backlog

[hyperpolymath]

The Language / package anti-pattern policy gate is failing on 9 file(s) in languages estate policy bans.

The gate is correct. These really are banned languages. But deleting the files would destroy working code without porting it, and porting is a project rather than a sweep — so this uses the mechanism the gate's own failure message names:

(declare an exemption via .hypatia-ignore or an inline # hypatia:ignore cicd_rules/banned_language_file pragma if intentional)

following the precedent already set in hyperpolymath/echidna.

Every path is listed individually, never a wildcard. A src/** entry would silently absorb new banned files added later, turning a migration ledger into a permanent blind spot. Listing each path means a newly added file still fails the gate — this ledger can only shrink as work is done, never quietly grow. It therefore doubles as the migration worklist.

Inventory taken 2026-08-06 across all 424 estate repositories: 13,206 banned-language files in 117 repos, though ~9,800 of those are vendored upstream copies (the ReScript toolchain, github/linguist) rather than estate code.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 200 issues detected

Severity	Count
🔴 Critical	1
🟠 High	25
🟡 Medium	174

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v4.1.7 needs attention",
    "type": "unpinned_action",
    "file": "boj-build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.3.1 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action SonarSource/sonarqube-scan-action@v8.1.0 needs attention",
    "type": "unpinned_action",
    "file": "build.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4.1.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action haskell-actions/setup@v2.7.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/cache@v4.3.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/configure-pages@v5.0.0 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/upload-pages-artifact@v3.0.1 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/deploy-pages@v4.0.5 needs attention",
    "type": "unpinned_action",
    "file": "casket-pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence