Repository navigation

Static Analysis Gate

fix: the Hypatia gate could never fire — the defects that made it unconditionally vacuous #197

Sign in to view logs

Triggered via pull request September 3, 2026 03:44

opened #98

fix/hypatia-gate-repair

Status Failure

Total duration 10m 27s

Artifacts 4

static-analysis-gate.yml

on: pull_request

panic-attack assail

Hypatia neurosymbolic scan

Patch Bridge CVE triage

Deposit findings for gitbot-fleet

Annotations

11 errors, 10 warnings, and 2 notices

Hypatia neurosymbolic scan

Process completed with exit code 1.

Hypatia neurosymbolic scan

Hypatia found 7 critical security issue(s) — blocking merge

Hypatia neurosymbolic scan: .machine_readable/6a2/PLAYBOOK.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/6a2/NEUROSYM.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/6a2/AGENTIC.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/6a2/ECOSYSTEM.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/6a2/META.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/6a2/STATE.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .envrc#L23

[hypatia] Secret found: Generic API key

Hypatia neurosymbolic scan: setup.sh#L1

[hypatia] Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (2 occurrences, CWE-494)

Hypatia neurosymbolic scan: rsr-antipattern.yml#L1

[hypatia] Issue in rsr-antipattern.yml

Patch Bridge CVE triage

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@v4.6.2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

panic-attack assail

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@v4.6.2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Hypatia neurosymbolic scan

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@v4.6.2, erlef/setup-beam@v1.20.4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Hypatia neurosymbolic scan: README.adoc#L1

[hypatia] References retired .machine_readable/6a2/ -- should be .machine_readable/descriptiles/

Hypatia neurosymbolic scan: 0-AI-MANIFEST.a2ml#L1

[hypatia] References retired .machine_readable/6a2/ -- should be .machine_readable/descriptiles/

Hypatia neurosymbolic scan: /home/runner/work/nextgen-typing/nextgen-typing#L1

[hypatia] 19 workflow(s) with tag-pinned (not SHA-pinned) actions in nextgen-typing

Hypatia neurosymbolic scan: push-email-notify.yml#L1

[hypatia] Issue in push-email-notify.yml

Hypatia neurosymbolic scan: labels.yml#L1

[hypatia] Issue in labels.yml

Hypatia neurosymbolic scan: label-triage.yml#L1

[hypatia] Issue in label-triage.yml

Deposit findings for gitbot-fleet

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4.1.8, actions/upload-artifact@v4.6.2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Patch Bridge CVE triage

panic-attack binary not available — skipping Patch Bridge

panic-attack assail

panic-attack binary not available — skipping assail

Artifacts

Produced during runtime

Name	Size	Digest
bridge-report	218 Bytes	`sha256:da525f934fbfccd8cf6178043f33382b8a7cb93dd25a0d992445e0cf25b38cc8`
hypatia-findings	928 Bytes	`sha256:31fad52fab104dbe5cc2c88cfa7c67ba005794b6c7c7225433b45e446a5f2585`
panic-attack-findings	171 Bytes	`sha256:e60e067e5f4b28c5e03f2aaa2b3b778ae08dff1965f1366c6a7688eed1b4e238`
unified-findings	1.15 KB	`sha256:642920e2daac5a8692f2aa3143f235dfe50539cea9a66dd696ebadea417d0429`