Process completed with exit code 1.

Hypatia found 7 critical security issue(s) — blocking merge

[hypatia] CI policy requires a retired descriptile path; align the check with .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (2 occurrences, CWE-494)

[hypatia] workflow .github/workflows/dependabot-automerge.yml:51 gates on `github.actor == 'dependabot[bot]'` — `github.actor` is the run-triggering user, which an attacker controls on `pull_request_target` from a fork

[hypatia] Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.

[hypatia] job in .github/workflows/release.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring

[hypatia] job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring

[hypatia] Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Action `softprops/action-gh-release@v3.0.3` in release.yml is not pinned to a commit SHA — `v3.0.3` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.

[hypatia] Action `editorconfig-checker/action-editorconfig-checker@v3.0.0` in quality.yml is not pinned to a commit SHA — `v3.0.0` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.

[hypatia] Action `hyperpolymath/smtp-notify-action@v0.3.0` in push-email-notify.yml is not pinned to a commit SHA — `v0.3.0` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.

[hypatia] Action `actions/deploy-pages@v5.0.1` in pages.yml is not pinned to a commit SHA — `v5.0.1` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.

[hypatia] Action `github/codeql-action/analyze@v4.38.0` in codeql.yml is not pinned to a commit SHA — `v4.38.0` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.

[hypatia] Action `github/codeql-action/init@v4.38.0` in codeql.yml is not pinned to a commit SHA — `v4.38.0` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.

panic-attack binary not available — skipping assail