Repository navigation

Static Analysis Gate

fix: the Hypatia gate could never fire — the defects that made it unconditionally vacuous #130

Sign in to view logs

Triggered via pull request September 3, 2026 03:45

opened #51

fix/hypatia-gate-repair

Status Failure

Total duration 9m 39s

Artifacts 4

static-analysis-gate.yml

on: pull_request

panic-attack assail

Hypatia neurosymbolic scan

Patch Bridge CVE triage

Deposit findings for gitbot-fleet

Annotations

12 errors, 14 warnings, and 2 notices

Hypatia neurosymbolic scan

Process completed with exit code 1.

Hypatia neurosymbolic scan

Hypatia found 10 critical security issue(s) — blocking merge

Hypatia neurosymbolic scan: .machine_readable/6a2/ECOSYSTEM.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/ECOSYSTEM.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/6a2/META.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/META.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/6a2/STATE.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/STATE.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .envrc#L23

[hypatia] Secret found: Generic API key

Hypatia neurosymbolic scan: setup.sh#L1

[hypatia] Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (2 occurrences, CWE-494)

Hypatia neurosymbolic scan: .machine_readable/svc/k9/methodology-guard.k9.ncl#L1

[hypatia] K9 contractile missing pedigree section (1 occurrences, CWE-1104)

Hypatia neurosymbolic scan: instant-sync.yml#L1

[hypatia] Issue in instant-sync.yml

panic-attack assail

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Patch Bridge CVE triage

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Hypatia neurosymbolic scan

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02, erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Hypatia neurosymbolic scan: dogfood-gate.yml#L1

[hypatia] Issue in dogfood-gate.yml

Hypatia neurosymbolic scan: dogfood-gate.yml#L1

[hypatia] Issue in dogfood-gate.yml

Hypatia neurosymbolic scan: dogfood-gate.yml#L1

[hypatia] Issue in dogfood-gate.yml

Hypatia neurosymbolic scan: dogfood-gate.yml#L1

[hypatia] Issue in dogfood-gate.yml

Hypatia neurosymbolic scan: dogfood-gate.yml#L1

[hypatia] Issue in dogfood-gate.yml

Hypatia neurosymbolic scan: dependabot-automerge.yml#L1

[hypatia] Issue in dependabot-automerge.yml

Hypatia neurosymbolic scan: codeql.yml#L1

[hypatia] Issue in codeql.yml

Hypatia neurosymbolic scan: casket-pages.yml#L1

[hypatia] Issue in casket-pages.yml

Hypatia neurosymbolic scan: casket-pages.yml#L1

[hypatia] Issue in casket-pages.yml

Hypatia neurosymbolic scan: boj-build.yml#L1

[hypatia] Issue in boj-build.yml

Deposit findings for gitbot-fleet

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

panic-attack assail

panic-attack binary not available — skipping assail

Patch Bridge CVE triage

panic-attack binary not available — skipping Patch Bridge

Artifacts

Produced during runtime

Name	Size	Digest
bridge-report	218 Bytes	`sha256:5b281014b4c85d2f942a80f4a3689df4347506a5a8a079983293390050454c2e`
hypatia-findings	1.53 KB	`sha256:87e54a0bf6b4edba90a39032ee21178a5754f607ba4a1a9adc4c06ec8b2dde41`
panic-attack-findings	171 Bytes	`sha256:2ce783da6acc8feeed26e143f26e8cdeb4d0343d730d86b3902c92087436689d`
unified-findings	1.78 KB	`sha256:adb08507e25732ad09671f0ad46fe7e67c5a3f4d8485bc41a4542f0442d37eee`