Process completed with exit code 1.

Hypatia found 9 critical security issue(s) — blocking merge

[hypatia] Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (2 occurrences, CWE-494, line 144, 156)

[hypatia] workflow .github/workflows/hypatia-scan.yml uploads SARIF to code scanning but masks the scanner's failure (`|| true` / `|| echo 0`) and never asserts the findings artefact is a non-empty array. When the scanner fails, this uploads a SARIF with zero results, and GitHub AUTO-CLOSES every previously-open alert for that category — silently, with the job green.

[hypatia] Step uses `webfactory/ssh-agent` with `ssh-private-key: ${{ secrets.GITEA_SSH_KEY }}` but has no `if: secrets.GITEA_SSH_KEY != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.

[hypatia] Step uses `webfactory/ssh-agent` with `ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }}` but has no `if: secrets.DISROOT_SSH_KEY != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.

[hypatia] Step uses `webfactory/ssh-agent` with `ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }}` but has no `if: secrets.SOURCEHUT_SSH_KEY != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.

[hypatia] Step uses `webfactory/ssh-agent` with `ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}` but has no `if: secrets.CODEBERG_SSH_KEY != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.

[hypatia] Step uses `webfactory/ssh-agent` with `ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}` but has no `if: secrets.BITBUCKET_SSH_KEY != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.

[hypatia] Step uses `webfactory/ssh-agent` with `ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}` but has no `if: secrets.GITLAB_SSH_KEY != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.

[hypatia] Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.

[hypatia] Job runs `ossf/scorecard-action` with `publish_results: true` AND contains a `run:` step. The OSSF publish endpoint enforces "scorecard job must only have steps with uses" — the run-step presence will fail the publish step and the whole workflow. Move any `run:` step (e.g. threshold gate) into a `needs: scorecard` downstream job that consumes the SARIF via upload/download-artifact.

[hypatia] Job `estate-rules` in estate-rules.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `k9-validate` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `groove-check` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `empty-lint` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `eclexiaiser-validate` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `dogfood-summary` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `a2ml-validate` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `automerge` in dependabot-automerge.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `analyze` in codeql.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `trigger-boj` in boj-build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

panic-attack binary not available — skipping Patch Bridge

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"

panic-attack binary not available — skipping assail

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"