ci: wire the merge-orchestration CVE/bump gate (bridge-gate.yml)

[hyperpolymath]

Replicates the merge-orchestration CVE/bump gate into panic-attack's own CI (pilot landed in reposystem#114; design in hypatia#459). Meta change — it edits CI — so it's for your review, not auto-merged.

This repo is the Patch-Bridge, so the gate builds it from source here and self-triages its own dependency tree (fine). .github/workflows/bridge-gate.yml runs on dependabot/renovate bump PRs: B3 (nix → fail) + B1 (reachable unmitigable CVE → fail). A clean patch/minor CVE-clear bump passes. SHA-pinned checkout, env-only context, timeout-minutes. Verdict logic was tested in hypatia#459.

After merge (your call): add bridge-gate to required status checks to make a fail block; @dependabot rebase existing bump PRs to run it on them.

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 59 issues detected

Severity	Count
🔴 Critical	6
🟠 High	15
🟡 Medium	38

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in governance.yml",
    "type": "missing_timeout_minutes",
    "file": "governance.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in hypatia-scan.yml",
    "type": "missing_timeout_minutes",
    "file": "hypatia-scan.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "missing_timeout_minutes",
    "file": "mirror.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in release.yml",
    "type": "missing_timeout_minutes",
    "file": "release.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in rust-ci.yml",
    "type": "missing_timeout_minutes",
    "file": "rust-ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_timeout_minutes",
    "file": "secret-scanner.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (3 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/axial/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence