Process completed with exit code 1.

Hypatia found 6 critical security issue(s) — blocking merge

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] 1 workflow(s) missing permissions declaration in nimiser

[hypatia] Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (2 occurrences, CWE-494, line 144, 156)

[hypatia] Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.

[hypatia] Job `analyze` in codeql.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `deploy` in casket-pages.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `build` in casket-pages.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `trigger-boj` in boj-build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `zig-build` in abi-ffi-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `conformance` in abi-ffi-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] No permissions declaration -- add permissions: read-all

[hypatia] Action `github/codeql-action/analyze@v4.38.2` in codeql.yml is not pinned to a commit SHA — `v4.38.2` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.

[hypatia] Action `github/codeql-action/init@v4.38.2` in codeql.yml is not pinned to a commit SHA — `v4.38.2` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.

[hypatia] Action `haskell-actions/setup@v2.12.1` in casket-pages.yml is not pinned to a commit SHA — `v2.12.1` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.

panic-attack binary not available — skipping assail

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"