chore: fill or remove RSR template placeholders

[hyperpolymath]

openssf-compliance.yml fails when any of the thirteen files it checks still contains a {{PLACEHOLDER}} token. This clears them, with no invention.

• Deleted the TEMPLATE INSTRUCTIONS (delete this block before publishing) comment — the template says to delete it, and it is where every legend line lived, so a large share of the reported tokens were the file documenting its own placeholders.
• Filled what the repository itself supplies: owner and repo from the git remote, project name, year, forge, main branch, contact email.
• Removed PGP and website lines. https://github.com/<user>.gpg returns HTTP 200 for every account; with no key uploaded the body is a stub reading "This user hasn't uploaded any GPG keys". No key is published for either account, and commit signing here is SSH — unrelated. The template sanctions this: "Optional: Remove sections that don't apply (e.g. PGP if you don't use it)."\n\nA security policy telling a researcher to encrypt to a key that does not exist is worse than one that does not mention encryption.\n\nWhere applicable, this also fixes a misrouted advisory URL. A previous just init copied already-filled templates out of squisher-corpus, so 51 repositories directed vulnerability reports to hyperpolymath/squisher-corpus — a repository unrelated to the code being reported, meaning the affected maintainer never saw them. Repointed from this repository's own git remote.

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: 4 failures across CI jobs due to a banned ReScript source file, a missing local dependency path in Cargo, an unresolved private GitHub Action, and an empty CodeQL JavaScript/TypeScript database.

Overview

Multiple distinct failures occurred across the CI run: a repository governance check failure on a banned ReScript file, a cargo manifest loading failure due to a missing local dependency path (gossamer-rs), an unresolved custom GitHub Actions workflow reference, and a CodeQL configuration error stemming from an empty JavaScript/TypeScript file set.

Failures

Hypatia Governance Banned Language File (confidence: high)

• Type: build
• Affected jobs: 90326093917
• Related to change: unclear
• Root cause: The repository contains a ReScript file (ui/src/RuntimeBridge.res), which violates the cicd_rules/banned_language_file governance rule.
• Suggested fix: Remove or migrate ui/src/RuntimeBridge.res to AffineScript, or add an explicit exemption in .hypatia-baseline.json.

Cargo Manifest Missing Local Dependency (confidence: high)

• Type: build
• Affected jobs: 90326168712
• Related to change: yes
• Root cause: Cargo failed to load the workspace manifest because dependency gossamer-rs points to a local path (/home/runner/work/docmatrix/gossamer/bindings/rust/Cargo.toml) that is not present in the CI environment.
• Suggested fix: Ensure the dependent repository/submodule is checked out in the workflow or update the dependency configuration in Cargo.toml.

Unresolved GitHub Action (confidence: high)

• Type: dependency
• Affected jobs: 90326092500
• Related to change: yes
• Root cause: The workflow references hyperpolymath/a2ml-validate-action, which could not be found or accessed.
• Suggested fix: Verify the action's repository name and ensure proper permissions/credentials or remove the reference.

CodeQL JavaScript/TypeScript Empty Database (confidence: high)

• Type: configuration
• Affected jobs: 90326092406
• Related to change: no
• Root cause: CodeQL analysis for javascript-typescript failed because no valid JS/TS source files were found in the repository.
• Suggested fix: Exclude javascript-typescript from the CodeQL workflow language matrix if the project contains no JavaScript or TypeScript code.

Summary

• Change-related failures: 2 failures (Cargo manifest missing local dependency gossamer-rs, and unresolved private GitHub Action hyperpolymath/a2ml-validate-action)
• Infrastructure/flaky failures: 0 failures
• Recommended action: Resolve the local dependency checkout or Cargo.toml path, fix or remove the inaccessible GitHub action reference, remove/migrate the banned ReScript file, and adjust the CodeQL language matrix.

Code Review ⚠️ Changes requested 1 resolved / 2 findings

Removes template placeholders to satisfy OpenSSF compliance checks, but the changes incorrectly rename guix.scm to reference squisher-corpus and introduce an MPL-2.0 license header mismatch against the package's PMPL-1.0-or-later license.

⚠️ Quality: License mismatch: SPDX header MPL-2.0 vs package PMPL-1.0-or-later

📄 guix.scm:1 📄 guix.scm:17

The SPDX header on line 1 still declares MPL-2.0, but the package license field was changed to PMPL-1.0-or-later (line 17). These now contradict each other, leaving the package's actual license ambiguous for downstream consumers and license scanners. Reconcile the two so the SPDX identifier and the package license agree.

✅ 1 resolved

✅ Bug: guix.scm renamed to squisher-corpus in the docmatrix repo

📄 guix.scm:2 📄 guix.scm:10 📄 guix.scm:14 📄 guix.scm:15 📄 guix.scm:16
This PR lives in the docmatrix repository and its stated goal is to repoint stray squisher-corpus references back to this repo (SECURITY.md correctly uses hyperpolymath/docmatrix). But guix.scm moves in the opposite direction: name, synopsis, description, and home-page were all changed from docmatrix to squisher-corpus (lines 2, 10, 14, 15, 16). The package now advertises the wrong identity and home-page, breaking guix shell -f guix.scm consumers. Revert these to docmatrix.

🤖 Prompt for agents

Code Review: Removes template placeholders to satisfy OpenSSF compliance checks, but the changes incorrectly rename guix.scm to reference squisher-corpus and introduce an MPL-2.0 license header mismatch against the package's PMPL-1.0-or-later license.

1. ⚠️ Quality: License mismatch: SPDX header MPL-2.0 vs package PMPL-1.0-or-later
   Files: guix.scm:1, guix.scm:17

   The SPDX header on line 1 still declares `MPL-2.0`, but the package license field was changed to `PMPL-1.0-or-later` (line 17). These now contradict each other, leaving the package's actual license ambiguous for downstream consumers and license scanners. Reconcile the two so the SPDX identifier and the package license agree.

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[github-actions]

🔍 Hypatia Security Scan

Findings: 57 issues detected

Severity	Count
🔴 Critical	0
🟠 High	37
🟡 Medium	20

View findings

[
  {
    "reason": "No test directory or test files found",
    "type": "no_tests",
    "file": "/home/runner/work/docmatrix/docmatrix",
    "action": "flag",
    "rule_module": "honest_completion",
    "severity": "high",
    "deduction": 20
  },
  {
    "reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
    "type": "codeql_language_matrix_mismatch",
    "file": "codeql.yml",
    "action": "switch_codeql_matrix_to_actions",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[gitar-bot]

⚠️ Quality: License mismatch: SPDX header MPL-2.0 vs package PMPL-1.0-or-later

The SPDX header on line 1 still declares MPL-2.0, but the package license field was changed to PMPL-1.0-or-later (line 17). These now contradict each other, leaving the package's actual license ambiguous for downstream consumers and license scanners. Reconcile the two so the SPDX identifier and the package license agree.

_{Was this helpful? React with 👍 / 👎}