fix(ci): heal the three retirement-exposed check failures

[hyperpolymath]

Follow-up to #300, which merged before this heal commit reached the branch — main's E2E / Aspect / readme-derive are red until this lands.

• catalog.ex: fall back to the repo's own pinned schema mirror when the cartridges root has no sibling schemas/ dir (the E2E fixture catalog and ad-hoc BOJ_CARTRIDGES_PATH caches don't ship one) — BojRest.Catalog no longer crashes at boot.
• aspect_tests.sh: nullglob around the Aspect-4 cartridge loop so the retired tree audits zero cartridges instead of failing on a literal *; completeness gating lives in boj-server-cartridges.
• README.md: regenerated from README.adoc per the readme-derive recipe. Also clears a stale AGPL sentence Update README.adoc #284 removed from the adoc without rederiving (pre-existing fail-and-tell debt).

Verified locally: derived README.md is byte-identical to the check's expectation; catalog fallback path exercised by the fixture layout.

🤖 Generated with Claude Code

[github-actions]

🏁 path-claims bench

Commit 4f2a34f

Numbers

path-claims bench  (node v22.23.1)

  scenario                                              iters       ms        ns/op          ops/s
  --------------------------------------------------------------------------------------------------------------
  register: 10 active claims, 3 new paths               50000 iters    139 ms      2.79 µs/op    358.8k ops/s
  register: 100 active claims, 3 new paths              20000 iters    250 ms     12.54 µs/op     79.7k ops/s
  register: 1000 active claims, 3 new paths              5000 iters    792 ms    158.41 µs/op      6.3k ops/s
  register: 100 active claims, 20 new paths              5000 iters    299 ms     59.97 µs/op     16.7k ops/s

  pathsOverlap: deep diverge at segment 4             1000000 iters    124 ms     124.7 ns/op     8.02M ops/s
  pathsOverlap: short prefix match                    1000000 iters    107 ms     107.6 ns/op     9.30M ops/s

  refresh (existing claim)                             100000 iters      9 ms      97.1 ns/op    10.30M ops/s
  list (100 active claims)                              50000 iters    249 ms      4.99 µs/op    200.5k ops/s

  (Bench numbers depend on host; use deltas across commits, not absolute values.)

Host-dependent — compare deltas across commits, not absolute values.

[github-actions]

🔍 Hypatia Security Scan

Findings: 94 issues detected

Severity	Count
🔴 Critical	7
🟠 High	31
🟡 Medium	56

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in build.yml",
    "type": "missing_timeout_minutes",
    "file": "build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in pages-deploy.yml",
    "type": "missing_timeout_minutes",
    "file": "pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "believe_me undermines formal verification (4 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/boj-server/boj-server/src/abi/Boj/SafetyLemmas.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/nickel-validator.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "eval() -- arbitrary code execution (2 occurrences, CWE-94)",
    "type": "js_eval",
    "file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/security.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Deno -A grants all permissions -- use specific --allow-* flags (1 occurrences, CWE-250)",
    "type": "js_deno_all_perms",
    "file": "/home/runner/work/boj-server/boj-server/mcp-bridge/main.d.ts",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Zig @ptrCast performs unchecked pointer type conversion (1 occurrences, CWE-704)",
    "type": "zig_ptr_cast",
    "file": "/home/runner/work/boj-server/boj-server/ffi/zig/src/cartridge_shim.zig",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved 1 resolved / 1 findings

Fixes CI check failures by updating catalog schema fallback, aspect test nullglob handling, and regenerating the README. However, the schema fallback uses a compile-time macro which becomes a no-op in release builds.

✅ 1 resolved

✅ Bug: Schema fallback uses compile-time __DIR__, no-op in release

📄 elixir/lib/boj_rest/catalog.ex:65-79
The new fallback Path.expand("../../../schemas/cartridge-v1.json", __DIR__) resolves correctly for source-tree runs (E2E fixtures, dev), which is what this PR heals. But __DIR__ is expanded at compile time to the builder's source path (e.g. /build/elixir/lib/boj_rest), which does not exist in the deployed mix release container — releases ship compiled BEAM files, not elixir/lib/** sources, and schemas/ lives at repo root outside priv/. So if the cartridges root has no sibling schemas/ dir at runtime in prod, this fallback points at a nonexistent build path and load_schema/1 still raises, crashing BojRest.Catalog at boot — the exact failure the PR aims to prevent. Note container/Containerfile already copies the schema to /schemas/cartridge-v1.json and /app/schemas/cartridge-v1.json, but the code never looks there. Consider making the fallback release-aware (e.g. check /app/schemas and /schemas, or accept a configurable :schema_path/env var) instead of a source-relative __DIR__ path.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

---

Important

Your trial ends in 6 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}

[github-actions]

🔍 Hypatia Security Scan

Findings: 94 issues detected

Severity	Count
🔴 Critical	7
🟠 High	31
🟡 Medium	56

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in build.yml",
    "type": "missing_timeout_minutes",
    "file": "build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in pages-deploy.yml",
    "type": "missing_timeout_minutes",
    "file": "pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "believe_me undermines formal verification (4 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/boj-server/boj-server/src/abi/Boj/SafetyLemmas.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/nickel-validator.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "eval() -- arbitrary code execution (2 occurrences, CWE-94)",
    "type": "js_eval",
    "file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/security.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Deno -A grants all permissions -- use specific --allow-* flags (1 occurrences, CWE-250)",
    "type": "js_deno_all_perms",
    "file": "/home/runner/work/boj-server/boj-server/mcp-bridge/main.d.ts",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Zig @ptrCast performs unchecked pointer type conversion (1 occurrences, CWE-704)",
    "type": "zig_ptr_cast",
    "file": "/home/runner/work/boj-server/boj-server/ffi/zig/src/cartridge_shim.zig",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

✅ All code review findings resolved.

_{Configure merge blocking}