chore(governance): declare the banned-language migration backlog - #42
Merged
Conversation
The "Language / package anti-pattern policy" gate is failing on 5
file(s) in banned languages (5 rescript).
The gate is CORRECT — these really are languages estate policy bans. But
deleting them would destroy working code without porting it, so this uses the
mechanism the gate's own failure message names:
(declare an exemption via .hypatia-ignore ... if intentional)
Every path is listed individually rather than by wildcard. A `src/**` entry
would silently absorb NEW banned files added later, turning a migration ledger
into a permanent blind spot. Listing each path means a newly added file still
fails the gate: this ledger can only shrink as work is done.
It therefore doubles as the migration worklist.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedDeclares the banned-language migration backlog by explicitly listing 5 exempted file paths in the policy configuration. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 4 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
|
|
🔍 Hypatia Security ScanFindings: 43 issues detected
View findings[
{
"reason": "No test directory or test files found",
"type": "no_tests",
"file": "/home/runner/work/formatrix-docs/formatrix-docs",
"action": "flag",
"rule_module": "honest_completion",
"severity": "high",
"deduction": 20
},
{
"reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
"type": "codeql_language_matrix_mismatch",
"file": "codeql.yml",
"action": "switch_codeql_matrix_to_actions",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in push-email-notify.yml",
"type": "missing_timeout_minutes",
"file": "push-email-notify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in mirror.yml",
"type": "secret_action_without_presence_gate",
"file": "mirror.yml",
"action": "webfactory/ssh-agent",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in mirror.yml",
"type": "secret_action_without_presence_gate",
"file": "mirror.yml",
"action": "webfactory/ssh-agent",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in mirror.yml",
"type": "secret_action_without_presence_gate",
"file": "mirror.yml",
"action": "webfactory/ssh-agent",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in mirror.yml",
"type": "secret_action_without_presence_gate",
"file": "mirror.yml",
"action": "webfactory/ssh-agent",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in mirror.yml",
"type": "secret_action_without_presence_gate",
"file": "mirror.yml",
"action": "webfactory/ssh-agent",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in mirror.yml",
"type": "secret_action_without_presence_gate",
"file": "mirror.yml",
"action": "webfactory/ssh-agent",
"rule_module": "workflow_audit",
"severity": "high"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
🔍 Hypatia Security ScanFindings: 40 issues detected
View findings[
{
"reason": "No test directory or test files found",
"type": "no_tests",
"file": "/home/runner/work/formatrix-docs/formatrix-docs",
"action": "flag",
"rule_module": "honest_completion",
"severity": "high",
"deduction": 20
},
{
"reason": "Issue in push-email-notify.yml",
"type": "missing_timeout_minutes",
"file": "push-email-notify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in mirror.yml",
"type": "secret_action_without_presence_gate",
"file": "mirror.yml",
"action": "webfactory/ssh-agent",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in mirror.yml",
"type": "secret_action_without_presence_gate",
"file": "mirror.yml",
"action": "webfactory/ssh-agent",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in mirror.yml",
"type": "secret_action_without_presence_gate",
"file": "mirror.yml",
"action": "webfactory/ssh-agent",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in mirror.yml",
"type": "secret_action_without_presence_gate",
"file": "mirror.yml",
"action": "webfactory/ssh-agent",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in mirror.yml",
"type": "secret_action_without_presence_gate",
"file": "mirror.yml",
"action": "webfactory/ssh-agent",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in mirror.yml",
"type": "secret_action_without_presence_gate",
"file": "mirror.yml",
"action": "webfactory/ssh-agent",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 18 day(s) old",
"type": "CSA001",
"file": ".github/workflows/pages.yml",
"action": "review",
"rule_module": "code_scanning_alerts",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Language / package anti-pattern policy gate is failing on 5 file(s) in languages estate policy bans.
The gate is correct. These really are banned languages. But deleting the files would destroy working code without porting it, and porting is a project rather than a sweep — so this uses the mechanism the gate's own failure message names:
following the precedent already set in
hyperpolymath/echidna.Every path is listed individually, never a wildcard. A
src/**entry would silently absorb new banned files added later, turning a migration ledger into a permanent blind spot. Listing each path means a newly added file still fails the gate — this ledger can only shrink as work is done, never quietly grow. It therefore doubles as the migration worklist.Inventory taken 2026-08-06 across all 424 estate repositories: 13,206 banned-language files in 117 repos, though ~9,800 of those are vendored upstream copies (the ReScript toolchain, github/linguist) rather than estate code.
🤖 Generated with Claude Code