ci(hypatia-scan): drop timeout-minutes from the reusable-caller job (the real 0-jobs fix)

[hyperpolymath]

The real root cause of nextgen- hypatia staying at 0-jobs* — and an apology: this is the fix that should have come first.

A job that calls a reusable workflow (jobs.<id>.uses:) may not declare timeout-minutes — it's only valid on normal (runs-on + steps) jobs. With it present, GitHub rejects the whole file as invalid:

(Line 32) Required property is missing: runs-on
(Line 33) Unexpected value 'uses'
(Line 34) Unexpected value 'secrets'

An unparseable workflow produces a run with 0 jobs — at every pin, regardless of permissions or repo settings. That's why nextgen-typing/nextgen-languages never moved off 0-jobs while eclexia/Axiom (which never had timeout-minutes on the caller) worked once repinned. The earlier "stale pin / actions: read / repo-settings" theories were all downstream of this parse failure.

Fix: remove timeout-minutes from the caller job. The reusable enforces its own per-job timeout (timeout-minutes: 20 inside hypatia-scan-reusable.yml), so nothing is lost.

Validated: workflow_dispatch on this branch now returns 204 queued (previously 422 failed to parse) — GitHub accepts the file and scheduled a real run. Builds on the merged #64 (repin + actions: read), which remain correct and necessary. (nextgen-typing also has its own inline "Hypatia neurosymbolic scan", unaffected.)

🤖 Generated with Claude Code

https://claude.ai/code/session_01PWMMxryCcPrAjJ8tuGvygG

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 30 issues detected

Severity	Count
🔴 Critical	1
🟠 High	17
🟡 Medium	12

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in rsr-antipattern.yml",
    "type": "unanchored_heading_regex",
    "file": "rsr-antipattern.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (3 occurrences, CWE-494)",
    "type": "shell_download_then_run",
    "file": "/home/runner/work/nextgen-typing/nextgen-typing/setup.sh",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "line": 24,
    "reason": "Secret found: Generic API key",
    "type": "secret_detected",
    "file": "/home/runner/work/nextgen-typing/nextgen-typing/.envrc",
    "action": "revoke_rotate_and_purge",
    "rule_module": "security_errors",
    "severity": "critical"
  },
  {
    "reason": "Nominal-only SAST in nextgen-typing: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/nextgen-typing/nextgen-typing",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  },
  {
    "reason": "Repository has 6 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): FuzzingID -- Fuzzing -- 7 day(s) old",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): MaintainedID -- Maintained -- 7 day(s) old",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Scorecard): CodeReviewID -- Code-Review -- 7 day(s) old",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence