ci: vendor validation scripts and remove remote action pins

[hyperpolymath]

Automated PR to fix CI after deleted actions.

[gitar-bot]

CI failed: CI failures caused by Gitleaks and Hypatia compliance scans detecting secrets and missing configuration/headers in the repository, alongside intermittent Erlang TLS certificate handshake errors downloading Rebar from builds.hex.pm.

Overview

Analysis of 5 CI logs revealed two primary categories of failures: change-related security/compliance gate failures (Gitleaks secret detection and Hypatia audit scanner finding unmasked secrets, missing SPDX headers, and workflow timeout issues), and infrastructure/dependency failures due to Erlang TLS handshake alerts (key_usage_mismatch) when attempting to fetch Rebar from hex.pm mirrors.

Failures

Gitleaks & Hypatia Compliance Gate Failures (confidence: high)

• Type: test
• Affected jobs: 90125229517, 90126037958, 90126233079
• Related to change: yes
• Root cause: Gitleaks detected 8 potential secrets in the repository, and the Hypatia scanner caught 8 unfiltered rule violations (including a critical secret in lib/evidence_graph/accounts.ex, missing SPDX headers in source files, and missing timeout_minutes in push-email-notify.yml) that failed the CI gate.
• Suggested fix: Remove or rotate hardcoded secrets, add SPDX headers where required, configure timeout_minutes on workflows, or update the baseline file if appropriate.

Erlang/Mix TLS Handshake Failure (confidence: high)

• Type: infrastructure
• Affected jobs: 90125227071, 90125228881
• Related to change: unclear
• Root cause: An SSL/TLS handshake error ({:tls_alert, {:unsupported_certificate, ...}}) with {key_usage_mismatch} occurred when the Erlang HTTP client attempted to download Rebar from builds.hex.pm.
• Suggested fix: Retry the affected jobs or update the Elixir/Erlang setup actions to a version compatible with updated mirror TLS requirements.

Summary

• Change-related failures: 3 jobs failed due to security/compliance scanner gates (Gitleaks and Hypatia).
• Infrastructure/flaky failures: 2 jobs failed due to upstream Erlang/Hex TLS certificate connectivity issues.
• Recommended action: Address the security findings and compliance violations flagged by Gitleaks and Hypatia in the codebase, and re-run jobs affected by the transient Hex mirror TLS handshake error.

Code Review ✅ Approved

Vendors validation scripts and removes remote action pins to fix CI workflows after deleted actions. No issues found.

Auto-approved: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR (configure)