chore(ci): replace scorecard.yml with reusable wrapper

[hyperpolymath]

Pins to hyperpolymath/standards#205 merge SHA e0caf11508a3989574713c78f5f444f2ce5e33ef. Replaces the canonical scorecard.yml with a thin wrapper. Closes the 5-candidate convergence set.

Estate audit: 258 deploys / 18% drift / 39% top-SHA share.

Part of estate-wide convergence campaign 2026-05-26 (standards#199 / #205).

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[github-actions]

🔍 Hypatia Security Scan

Findings: 78 issues detected

Severity	Count
🔴 Critical	7
🟠 High	50
🟡 Medium	21

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Nickel file missing SPDX-License-Identifier header (1 occurrences, CWE-1104)",
    "type": "ncl_missing_spdx",
    "file": "/home/runner/work/aerie/aerie/configs/config.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (1 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/aerie/aerie/src/api/rust/src/redis_client.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Zig @ptrCast performs unchecked pointer type conversion (3 occurrences, CWE-704)",
    "type": "zig_ptr_cast",
    "file": "/home/runner/work/aerie/aerie/src/api/zig/smokeping_client.zig",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Zig @ptrCast performs unchecked pointer type conversion (3 occurrences, CWE-704)",
    "type": "zig_ptr_cast",
    "file": "/home/runner/work/aerie/aerie/src/api/zig/hyperglass_client.zig",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Zig @ptrCast performs unchecked pointer type conversion (3 occurrences, CWE-704)",
    "type": "zig_ptr_cast",
    "file": "/home/runner/work/aerie/aerie/src/api/zig/main.zig",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Zig @bitCast reinterprets bits without type checking (1 occurrences, CWE-704)",
    "type": "zig_bit_cast",
    "file": "/home/runner/work/aerie/aerie/src/api/zig/proof.zig",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "Zig @ptrCast performs unchecked pointer type conversion (2 occurrences, CWE-704)",
    "type": "zig_ptr_cast",
    "file": "/home/runner/work/aerie/aerie/src/api/zig/librespeed_client.zig",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Zig @ptrCast performs unchecked pointer type conversion (5 occurrences, CWE-704)",
    "type": "zig_ptr_cast",
    "file": "/home/runner/work/aerie/aerie/src/api/zig/verisim_client.zig",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "line": 220,
    "reason": "Secret found: Generic API key",
    "type": "secret_detected",
    "file": "/home/runner/work/aerie/aerie/src/api/zig/main.zig",
    "action": "revoke_rotate_and_purge",
    "rule_module": "security_errors",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence