Skip to content

fix(gates): gate on the DEED grammar, per the template and standards#837 #199

fix(gates): gate on the DEED grammar, per the template and standards#837

fix(gates): gate on the DEED grammar, per the template and standards#837 #199

Triggered via pull request September 21, 2026 14:06
Status Failure
Total duration 6h 43m 48s
Artifacts 3

static-analysis-gate.yml

on: pull_request
panic-attack assail
8s
panic-attack assail
Hypatia neurosymbolic scan
35s
Hypatia neurosymbolic scan
Deposit findings for gitbot-fleet
7s
Deposit findings for gitbot-fleet
Fit to window
Zoom out
Zoom in

Annotations

11 errors, 10 warnings, and 4 notices
Hypatia neurosymbolic scan
Process completed with exit code 1.
Hypatia neurosymbolic scan
Hypatia found 6 critical security issue(s) — blocking merge
Hypatia neurosymbolic scan: .machine_readable/6a2/PLAYBOOK.a2ml#L1
[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/
Hypatia neurosymbolic scan: .machine_readable/6a2/NEUROSYM.a2ml#L1
[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/
Hypatia neurosymbolic scan: .machine_readable/6a2/AGENTIC.a2ml#L1
[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/
Hypatia neurosymbolic scan: .machine_readable/6a2/ECOSYSTEM.a2ml#L1
[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/
Hypatia neurosymbolic scan: .machine_readable/6a2/META.a2ml#L1
[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/
Hypatia neurosymbolic scan: .machine_readable/6a2/STATE.a2ml#L1
[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/
Hypatia neurosymbolic scan: src/interface/ffi/src/main.zig#L1
[hypatia] Zig @aligncast performs unchecked alignment cast (9 occurrences, CWE-704)
Hypatia neurosymbolic scan: src/interface/ffi/src/main.zig#L1
[hypatia] Zig @ptrCast performs unchecked pointer type conversion (11 occurrences, CWE-704)
Hypatia neurosymbolic scan: instant-sync.yml#L1
[hypatia] Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.
Hypatia neurosymbolic scan: dogfood-gate.yml#L1
[hypatia] Job `k9-validate` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: dogfood-gate.yml#L1
[hypatia] Job `groove-check` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: dogfood-gate.yml#L1
[hypatia] Job `empty-lint` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: dogfood-gate.yml#L1
[hypatia] Job `eclexiaiser-validate` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: dogfood-gate.yml#L1
[hypatia] Job `dogfood-summary` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: dogfood-gate.yml#L1
[hypatia] Job `a2ml-validate` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: codeql.yml#L1
[hypatia] Job `analyze` in codeql.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: casket-pages.yml#L1
[hypatia] Job `deploy` in casket-pages.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: casket-pages.yml#L1
[hypatia] Job `build` in casket-pages.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: boj-build.yml#L1
[hypatia] Job `trigger-boj` in boj-build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
panic-attack assail
panic-attack binary not available — skipping assail
panic-attack assail
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
Hypatia neurosymbolic scan
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
Deposit findings for gitbot-fleet
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"

Artifacts

Produced during runtime
Name Size Digest
hypatia-findings
2.16 KB
sha256:3dc7550853a12ccf04c1c21d044ab9d2bfbcc4cfcfb7b5a1e19fed39b75ff98b
panic-attack-findings
171 Bytes
sha256:83b30bad52f8e653418bfbe172ce870df3a4f6ae1cd231980451073a538d3c0f
unified-findings
2.34 KB
sha256:341a8691d72dd3cbeafee3668cdb237b0616b10ce57f419351014e42156ca8bd