fix(governance): honour .hypatia-ignore / inline pragma in banned-language checks

[hyperpolymath]

Root cause

The shared governance-reusable.ymlLanguage / package anti-pattern policy job enforces the TypeScript ban with a full exemption mechanism, but the ReScript / Go / Python checks were crude find one-liners with no escape. They ignored the estate's declared machine-readable exemption — .hypatia-ignore rule cicd_rules/banned_language_file and the inline # hypatia:ignore … cicd_rules/banned_language_file pragma — even though the Hypatia scanner itself honours it.

Per the Explicit-Escape Principle (Refs standards#72): re-emergence of a banned default despite a declared, tool-honoured escape is a tooling defect, not a policy violation.

Symptom this fixes

hyperpolymath/hypatia#270 (a 1-line CI pin) and transitively #271 are BLOCKED because two intentionally-exempted criterion bench scripts (scripts/check-bench-regression.py, scripts/update-bench-baselines.py — carrying the inline pragma, listed in .hypatia-ignore, documented in .hypatia-exemptions.md, used by tests.yml) trip this shared gate. The defect is estate-wide; fixing it here resolves every consumer of the shared bundle.

Change

Replaces the three crude checks with a single exemption-aware step. A file is exempt from cicd_rules/banned_language_file iff it is listed in .hypatia-ignore for that rule or carries the inline pragma in its first 8 lines.

Verification (dry-run, bash -eo pipefail)

• Only-exempt files present → PASS (the [campaign #253] STEP 5 — LARGER BATCH: 8+ manifest repos #270/[campaign #254] STEP 3 — PORTS: physical migration of "portable now" subset, smallest-first #271 case)
• A non-exempt .py added → FAIL (enforcement preserved)
• Clean repo, zero banned files → PASS (no grep -v/pipefail false-fail; the old behaviour was preserved via || true)

Refs standards#72

[github-actions]

🔍 Hypatia Security Scan

Findings: 101 issues detected

Severity	Count
🔴 Critical	63
🟠 High	28
🟡 Medium	10

⚠️Action Required: Critical security issues found!

View findings

[
{
"reason": "Issue in quality.yml",
"type": "missing_workflow",
"file": "quality.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in security-policy.yml",
"type": "missing_workflow",
"file": "security-policy.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
"type": "unpinned_action",
"file": "governance-reusable.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Python file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
"type": "believe_me",
"file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
},
{
"reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
"type": "js_wildcard_cors",
"file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
}
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence