fix(ci): clear hypatia's red checks (try_update, Dependabot lock entries, rustls, baseline)

[hyperpolymath]

Summary

This PR clears four red gates on main (fabe659) in one commit.

Red check	Decisive log line	Fix
Cargo check + clippy + fmt / Clippy	use of deprecated method std::sync::atomic::Atomic::<u32>::fetch_update: renamed to try_update (-D warnings, Rust 1.99)	cli/src/app_state.rs:58: fetch_update → try_update. Same semantics; available since Rust 1.95.
governance / Actions lockfile verify	##[error]actions-lock gate: lockfile verification FAILED (exit 1) (ref-changed: Dependabot bumped uses: refs without updating the lock)	Re-recorded the four bumped refs in .github/workflows/actions.lock against their commit SHAs, and removed an unreferenced github/codeql-action@b96794f entry.
Dependabot (runs 37471485821, 37471490175)	security_update_not_possible for rustls GHSA-2mjx-qc3c-rqvc (alerts #35, #36)	Bumped rustls 0.23.40 → 0.23.45 in Cargo.lock and scripts/ci-tools/Cargo.lock. 0.23.45 resolves fine. Transitive bumps: rustls-webpki 0.103.15, aws-lc-rs 1.18.1, aws-lc-sys 0.45.0.
governance / Validate Hypatia Baseline	##[error]Gate failed: 12 unfiltered finding(s) at or above 'info'.	9 × unpinned_action came from the stale lock and clear with the lock fix: the pinned scanner is lockfile-aware. 3 × secret_detected at lib/hypatia/scanner_suppression.ex:360,361,363 were quoted secret: / password = examples in a doc comment; I reworded the comment so it carries no quoted literal. No baseline entry was added and the gate is not weakened.

Not addressed (owner items): mirror-* (standards#950); Codeac (third-party App).

Closes: no issue; found by the 2026-10-06 red-CI census.

Type of change

• 🐛 Bug fix (non-breaking change that fixes an issue): the deprecation build break and the stale lockfile
• ✨ New feature: not applicable
• 💥 Breaking change: not applicable. try_update is behaviour-identical, and the dependency bumps are patch/minor.
• 🕳️ Soundness fix: not applicable. No rule logic changed; only a comment in scanner_suppression.ex.
• 📖 Documentation: the one doc-comment rewording has the same meaning and is listed above as part of the baseline fix.
• 🧹 Refactor / tech debt: not applicable
• ⚡ Performance: not applicable
• 🔧 Build / CI / tooling

📌 New pins

Head SHA: 7937dff

.github/workflows/actions.lock. Each commit was checked with gh api repos/O/R/git/commits/<sha> (200). Owner and repo ids are unchanged. None of the new versions has transitive uses:.

• taiki-e/install-action v2.87.18 → v2.87.22 = 83ac0ad63c0167e6f06796fab0fce28db1bf3db0, in build-gossamer-gui.yml, ci.yml, security-policy.yml and tests.yml
• haskell-actions/setup v2.12.0 → v2.12.1 = 0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d, in ci.yml (the commit, not tag object 0f7370cc)
• ruby/setup-ruby v1.324.0 → v1.327.0 = 14594264cd68ce8a2345dd349bc3d138a4ef85c8, in quality.yml
• trufflesecurity/trufflehog v3.97.6 → v3.97.9 = 4dd8831c5f12599465d4d45c3c447b4018a34c85, in security-policy.yml
• removed: github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63, which is no longer referenced by codeql.yml or security-policy.yml

Lockfile records: rustls 0.23.45, rustls-webpki 0.103.15, aws-lc-rs 1.18.1, aws-lc-sys 0.45.0 (Cargo.lock). In scripts/ci-tools/Cargo.lock: rustls 0.23.45 and rustls-webpki 0.103.15.

No uses: lines changed. Dependabot had already bumped them on main.

How has this been verified?

• cargo +1.99.0 fmt --all -- --check returned rc 0.
• cargo +1.99.0 clippy --workspace --all-targets --locked -- -D warnings returned rc 0, both before and after the lock bump. Positive control: the same command on the original fetch_update failed with the deprecation error (rc 101).
• cargo clippy --locked -D warnings for scripts/ci-tools returned rc 0. cargo check --workspace --all-targets --locked finished.
• gh actions-lock --verify (v0.1.6) on origin/main reported 6 of 32 workflows failed. On this branch it prints only Scanning 32 workflows, with no failures.
• Baseline gate, reproduced locally with the same pinned scanner the gate uses (hypatia 0e913426, built with mix escript.build), then HYPATIA_FORMAT=json hypatia-cli.sh scan ., path relativisation, and standards scripts/apply-baseline.sh … blocking:
  • origin/main tree: 12 kept findings (the same 9 unpinned_action and 3 secret_detected as CI), rc 1. This is the planted positive.
  • this branch's tree: 0 kept findings, rc 0.
  • With BLOCKING_THRESHOLD=info (CI's threshold), main printed Gate failed: 12 unfiltered finding(s) at or above 'info' (rc 1) and this branch returned rc 0.
• grep -rn b96794f .github/ finds nothing on this branch, so no uses: line still names the removed codeql-action ref. The positive control grep -c 83ac0ad actions.lock returns 1.
• Toolchain floor for try_update: there is no rust-toolchain file and no rust-version in any Cargo.toml, and every workflow's dtolnay/rust-toolchain step uses toolchain: stable. No job runs a pre-1.95 compiler.
• A regex sweep of scanner_suppression.ex for the three form-ambiguous secret patterns now matches only lines the scanner already suppresses: line 275 (inline directive), plus a shell-expansion example, an env-default example and a test- fixture example. Line 275 was never reported.

Checklist

• My commits are signed (git commit -S). %G? shows G.
• I ran the project's own checks/tests locally and they pass: fmt, clippy, check, actions-lock verify and the baseline gate, as above. mix test was not run; the only Elixir change is a comment.
• New files carry the correct SPDX-License-Identifier: not applicable, no new files.
• Docs are updated, and no public claim now overstates what the code does. The reworded comment states the same rule.
• I have not introduced a soundness hole. No suppression or baseline entry was added. The secret findings were removed at the source, so any real credential in that file still fails the gate.

Notes for reviewers

• I edited the lock by hand. gh actions-lock rewrite mode was not used.
• The baseline gate runs hypatia pinned at 0e913426 (2026-09-06). That version predates the comment-masking logic now on main, which is why a doc comment was reported as critical.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d287bcd0-770f-4b2f-b6ea-986199e06a84

📥 Commits

Reviewing files that changed from the base of the PR and between fabe659 and 7937dff.

⛔ Files ignored due to path filters (3)

• .github/workflows/actions.lock is excluded by !**/*.lock
• Cargo.lock is excluded by !**/*.lock
• scripts/ci-tools/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• cli/src/app_state.rs
• lib/hypatia/scanner_suppression.ex

 ____________________________________________________________
< When you say, “I meant to do that,” I totally believe you. >
 ------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• 🔴 Error committing to branch - (🔄 Check to retry)
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Add Carrot credits or activate Agent usage billing to use Autopilot

[coderabbitai]

❌ Failed to create Coding Agent finishing-touch task. Please try again.