From 6384280f28e55006133646d0fb30b1cdd91bcd98 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 27 Jul 2026 14:31:10 +0100
Subject: [PATCH] fix(ci): unblock the now-honest static-analysis gate and the
 Idris2 CI job
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two failures surfaced once this branch's changes ran for real.

1. .envrc — Hypatia critical "secret_detected"

   This branch converts the Hypatia step in static-analysis-gate.yml from a
   fake gate into a real one: on main the scanner build carries
   `continue-on-error: true`, the scan is skipped unless `ready == 'true'`,
   and unparseable output is overwritten with `[]` — so the gate passes
   without ever scanning. Pinning the scanner and failing on critical
   findings makes it genuine, and the first thing it caught was:

       .envrc:24  # export API_KEY="..."

   A commented-out placeholder, so a false positive — but the fix is to stop
   writing assignment-shaped comments rather than to suppress the finding.
   The guidance is preserved in prose, pointing at the gitignored .env.

   The seven `high` findings do not gate and are left for separate triage.

2. ci.yml — Zig setup failed in the Idris2 container

   The pinned idris2-pack image ships no xz binary, so setup-zig's .tar.xz
   download died with "tar (child): xz: Cannot exec: No such file or
   directory". Installs xz-utils first, guarded by a command -v check.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .envrc                   |  5 +++--
 .github/workflows/ci.yml | 12 ++++++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/.envrc b/.envrc
index 42936b3..8b6df59 100644
--- a/.envrc
+++ b/.envrc
@@ -20,8 +20,9 @@ fi
 # Project environment variables
 export PROJECT_NAME="Haec"
 export RSR_TIER="infrastructure"
-# export DATABASE_URL="..."
-# export API_KEY="..."
+# Project secrets (DATABASE_URL, API_KEY, ...) belong in .env, which is
+# gitignored and sourced below. Do not add them here: .envrc is committed,
+# and assignment-shaped comments trip secret scanners.
 
 # Source .env if it exists (gitignored)
 dotenv_if_exists
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 02a4a1f..1d2d5e2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,6 +26,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # The pinned idris2-pack image ships no xz binary, so setup-zig's
+      # .tar.xz download fails with "tar (child): xz: Cannot exec".
+      - name: Install xz (needed to unpack the Zig tarball)
+        shell: bash
+        run: |
+          set -euo pipefail
+          if ! command -v xz >/dev/null 2>&1; then
+            apt-get update -qq
+            apt-get install -y -qq --no-install-recommends xz-utils
+          fi
+          xz --version | head -1
+
       - name: Set up Zig
         uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
         with: