WH008 secrets: inherit (4) is the estate's standard reusable-caller convention — accepted pattern. WH013 (2) on the mirror workflows is a false positive (pushes go to FOREIGN repos via PAT, not GITHUB_TOKEN contents). WH006 on codeql.yml analyze-js is a false positive (a uses: caller job cannot carry timeout-minutes; the reusable itself has 20).
Acknowledged in .hypatia-baseline.json (hypatia triage 2026-09-22, expires 2026-12-22) by the main-red fix-forward. This issue is the tracking item; closing it requires either remediating the instances or renewing the acknowledgement.
Instances (7):
workflow_hardening/WH006 warn — .github/workflows/codeql.yml
workflow .github/workflows/codeql.yml:43 job analyze-js has no timeout-minutes: — defaults to 360 min on hangworkflow_hardening/WH013 high — .github/workflows/github-backup-mirror-reusable.yml
workflow .github/workflows/github-backup-mirror-reusable.yml performs a write (push/commit/release/PR) but grants no contents: write at the workflow level or any job level — the write will be denied at run time.workflow_hardening/WH008 warn — .github/workflows/governance.yml
workflow .github/workflows/governance.yml:20 uses secrets: inherit — forwards every caller secret to the reusable workflowworkflow_hardening/WH008 warn — .github/workflows/hypatia-scan.yml
workflow .github/workflows/hypatia-scan.yml:30 uses secrets: inherit — forwards every caller secret to the reusable workflowworkflow_hardening/WH013 high — .github/workflows/mirror-reusable.yml
workflow .github/workflows/mirror-reusable.yml performs a write (push/commit/release/PR) but grants no contents: write at the workflow level or any job level — the write will be denied at run time.workflow_hardening/WH008 warn — .github/workflows/mirror.yml
workflow .github/workflows/mirror.yml:18 uses secrets: inherit — forwards every caller secret to the reusable workflowworkflow_hardening/WH008 warn — .github/workflows/secret-scanner.yml
workflow .github/workflows/secret-scanner.yml:49 uses secrets: inherit — forwards every caller secret to the reusable workflow
WH008
secrets: inherit(4) is the estate's standard reusable-caller convention — accepted pattern. WH013 (2) on the mirror workflows is a false positive (pushes go to FOREIGN repos via PAT, not GITHUB_TOKEN contents). WH006 on codeql.ymlanalyze-jsis a false positive (auses:caller job cannot carry timeout-minutes; the reusable itself has 20).Acknowledged in
.hypatia-baseline.json(hypatia triage 2026-09-22, expires 2026-12-22) by the main-red fix-forward. This issue is the tracking item; closing it requires either remediating the instances or renewing the acknowledgement.Instances (7):
workflow_hardening/WH006warn —.github/workflows/codeql.ymlworkflow .github/workflows/codeql.yml:43 job
analyze-jshas notimeout-minutes:— defaults to 360 min on hangworkflow_hardening/WH013high —.github/workflows/github-backup-mirror-reusable.ymlworkflow .github/workflows/github-backup-mirror-reusable.yml performs a write (push/commit/release/PR) but grants no
contents: writeat the workflow level or any job level — the write will be denied at run time.workflow_hardening/WH008warn —.github/workflows/governance.ymlworkflow .github/workflows/governance.yml:20 uses
secrets: inherit— forwards every caller secret to the reusable workflowworkflow_hardening/WH008warn —.github/workflows/hypatia-scan.ymlworkflow .github/workflows/hypatia-scan.yml:30 uses
secrets: inherit— forwards every caller secret to the reusable workflowworkflow_hardening/WH013high —.github/workflows/mirror-reusable.ymlworkflow .github/workflows/mirror-reusable.yml performs a write (push/commit/release/PR) but grants no
contents: writeat the workflow level or any job level — the write will be denied at run time.workflow_hardening/WH008warn —.github/workflows/mirror.ymlworkflow .github/workflows/mirror.yml:18 uses
secrets: inherit— forwards every caller secret to the reusable workflowworkflow_hardening/WH008warn —.github/workflows/secret-scanner.ymlworkflow .github/workflows/secret-scanner.yml:49 uses
secrets: inherit— forwards every caller secret to the reusable workflow