fix(baseline): file_pattern glob matching + jq scoping bugs

[hyperpolymath]

Summary

Two latent jq scoping bugs in baseline file_pattern matching:

1. f.file re-evaluates the identity inside map(select(...)) — . rebinds to each baseline entry, so f.file returned the baseline entry's .file field instead of the finding's. Fix: f as $finding | ... before entering the map.
2. .file_pattern inside test(arg) — test's argument is evaluated in the input's scope (the file string), so .file_pattern errored with "Cannot index string", silently swallowed by select() and treated truthy. This made file_pattern entries always-match. Fix: (.file_pattern? // null) as $pat | ... capture before test().

Both scripts/apply-baseline.sh and the inline in_baseline() helper in governance-reusable.yml had these bugs. Both now mirror the same corrected ** → .* / * → [^/]* glob → regex translation.

Adds scripts/tests/apply-baseline-test.sh — six regression cases that pin both bugs so they can't recur (exact match, glob match, over-match guard, single-* segment, slash-crossing, empty baseline).

Why this matters

The absolute-zero language-demo repo carries ~30 legitimate banned-language example files under examples/ (Java, Kotlin, Swift, Dart, Cobol, Erlang, Fortran, Lisp, …). Its main branch currently fails governance on every push because .hypatia-baseline.json file_pattern doesn't actually exempt anything. Same blocker: maa-framework #69 (Dependabot rust-toolchain bump) — vendored absolute-zero/examples/{java,kotlin}/*.{java,kt} files trip the language-policy step.

After this lands, both can use a single file_pattern: "examples/**" entry instead of per-file .hypatia-ignore enumeration.

Test plan

• scripts/tests/apply-baseline-test.sh — 6/6 pass locally
• End-to-end simulation of language-policy step against a fixture with examples/ baseline-exempted (Java enforce fails on src/RealCode.java, Swift enforce passes on examples/swift/*)
• CI on this PR
• Downstream: file follow-up PRs to absolute-zero (.hypatia-baseline.json with file_pattern) and maa-framework

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 118 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence