ci(release): swap retired macos-13 runner for macos-15-intel

[hyperpolymath]

The macos-13 GitHub-hosted runner image was deprecated 2025-09-22 and fully unsupported from 2025-12-04 (actions/runner-images#13046, #13402, #13634). Any matrix entry pinning runner: macos-13 (or runs-on: macos-13) now queues forever — there is no runner.

Replacement is macos-15-intel: the current Intel x64 standard runner per the actions/runner-images README, stable GA image. Avoided macos-26-intel (still stabilising — had an arm-label regression in runner-images#14112 as recently as 2026-05-19) and -large SKUs (unwanted cost for OSS).

Estate-wide sweep precedent: hyperpolymath/affinescript#292 (merged today, sha 26cdb43) made the same one-line swap on that repo's release.yml. This is the same fix, propagated.

Refs hyperpolymath/affinescript#292, actions/runner-images#13046.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

🔍 Hypatia Security Scan

Findings: 19 issues detected

Severity	Count
🔴 Critical	0
🟠 High	4
🟡 Medium	15

View findings

[
  {
    "reason": "Required file missing",
    "type": "missing",
    "file": "0-AI-MANIFEST.a2ml",
    "action": "create",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "No test directory or test files found",
    "type": "no_tests",
    "file": "/home/runner/work/casket-ssg/casket-ssg",
    "action": "flag",
    "rule_module": "honest_completion",
    "severity": "high",
    "deduction": 20
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Nominal-only SAST in casket-ssg: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/casket-ssg/casket-ssg",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  },
  {
    "reason": "Repository has 1 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "References STATE.scm -- should be .machine_readable/6a2/STATE.a2ml",
    "type": "SD007",
    "file": ".claude/CLAUDE.md",
    "action": "update_reference",
    "rule_module": "structural_drift",
    "severity": "medium"
  },
  {
    "reason": "References META.scm -- should be .machine_readable/6a2/META.a2ml",
    "type": "SD007",
    "file": ".claude/CLAUDE.md",
    "action": "update_reference",
    "rule_module": "structural_drift",
    "severity": "medium"
  },
  {
    "reason": "References ECOSYSTEM.scm -- should be .machine_readable/6a2/ECOSYSTEM.a2ml",
    "type": "SD007",
    "file": ".claude/CLAUDE.md",
    "action": "update_reference",
    "rule_module": "structural_drift",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence