chore(hypatia): acknowledge current findings in the baseline - #45
Conversation
The `Validate Hypatia Baseline` gate fails on any finding not acknowledged in .hypatia-baseline.json, at threshold `info` — so every existing finding blocks every pull request, including ones that touch none of it. Ruling: acknowledge the current findings and KEEP the threshold at `info`, so only NEW findings block from here. That preserves the gate's strictness rather than lowering the bar estate-wide, and records the debt explicitly instead of hiding it. Entries were taken from the gate's own job output — the findings it actually produced, tagged `baseline_status: "new"` — rather than from a local scanner that might be a different version. Only those entries are added; findings already matched by the existing baseline are left alone so their severity_override values are not lost. Types covered: SD009, StaticAnalysis, codeql_language_matrix_mismatch, codeql_missing_actions_language, missing_timeout_minutes, secret_action_without_presence_gate. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review✅ ApprovedAcknowledges 14 existing security findings in the Hypatia baseline configuration to unblock pull requests without lowering the gate threshold. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 4 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
The
Validate Hypatia Baselinegate fails on any finding not acknowledged in.hypatia-baseline.json, at thresholdinfo— so every existing finding blocks every pull request, including ones that touch none of it. This is the single largest true blocker in the estate backlog (14 PRs).Ruling: acknowledge the current findings and keep the threshold at
info, so only NEW findings block from here. That preserves the gate's strictness rather than lowering the bar estate-wide, and records the debt explicitly instead of hiding it.Entries were taken from the gate's own job output — the findings it actually produced, tagged
baseline_status: "new"— rather than from a local scanner that might be a different version. Only those entries are added; findings already matched by the existing baseline are untouched, so theirseverity_overridevalues are not lost.Four keys only (
severity,rule_module,type,file): the baseline schema is a closed key set validated in jq byapply-baseline.sh, and any extra key makes the whole file invalid.tracking_issueis omitted rather than invented — it is validated against anowner/repo#Nshape.🤖 Generated with Claude Code