ci(hypatia-scan): drop timeout-minutes from the reusable-caller job (the real 0-jobs fix)

[hyperpolymath]

The real root cause of nextgen- hypatia staying at 0-jobs* — and an apology: this is the fix that should have come first.

A job that calls a reusable workflow (jobs.<id>.uses:) may not declare timeout-minutes — it's only valid on normal (runs-on + steps) jobs. With it present, GitHub rejects the whole file as invalid:

(Line 32) Required property is missing: runs-on
(Line 33) Unexpected value 'uses'
(Line 34) Unexpected value 'secrets'

An unparseable workflow produces a run with 0 jobs — at every pin, regardless of permissions or repo settings. That's why nextgen-languages/nextgen-typing never moved off 0-jobs while eclexia/Axiom (which never had timeout-minutes on the caller) worked once repinned. The earlier "stale pin / actions: read / repo-settings" theories were all downstream of this parse failure.

Fix: remove timeout-minutes from the caller job. The reusable enforces its own per-job timeout (timeout-minutes: 20 inside hypatia-scan-reusable.yml), so nothing is lost.

Validated: workflow_dispatch on this branch now returns 204 queued (previously 422 failed to parse) — GitHub accepts the file and scheduled a real run. Builds on the merged #93/#64 (repin + actions: read), which remain correct and necessary.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PWMMxryCcPrAjJ8tuGvygG

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 26 issues detected

Severity	Count
🔴 Critical	3
🟠 High	14
🟡 Medium	9

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (3 occurrences, CWE-494)",
    "type": "shell_download_then_run",
    "file": "/home/runner/work/nextgen-languages/nextgen-languages/setup.sh",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "line": 114,
    "reason": "Secret found: Password",
    "type": "secret_detected",
    "file": "/home/runner/work/nextgen-languages/nextgen-languages/PANIC-ATTACK-TRIAGE.adoc",
    "action": "revoke_rotate_and_purge",
    "rule_module": "security_errors",
    "severity": "critical"
  },
  {
    "line": 124,
    "reason": "Secret found: Password",
    "type": "secret_detected",
    "file": "/home/runner/work/nextgen-languages/nextgen-languages/PANIC-ATTACK-TRIAGE.adoc",
    "action": "revoke_rotate_and_purge",
    "rule_module": "security_errors",
    "severity": "critical"
  },
  {
    "line": 125,
    "reason": "Secret found: Password",
    "type": "secret_detected",
    "file": "/home/runner/work/nextgen-languages/nextgen-languages/PANIC-ATTACK-TRIAGE.adoc",
    "action": "revoke_rotate_and_purge",
    "rule_module": "security_errors",
    "severity": "critical"
  },
  {
    "reason": "Repository has 4 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): TokenPermissionsID -- Token-Permissions -- 0 day(s) old",
    "type": "CSA001",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 18 day(s) old",
    "type": "CSA001",
    "file": "setup.sh",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): PinnedDependenciesID -- Pinned-Dependencies -- 18 day(s) old",
    "type": "CSA001",
    "file": "setup.sh",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence