Static Analysis Gate

chore(ci): repoint push-email-notify to smtp-notify-action #132

Sign in to view logs

Triggered via pull request September 3, 2026 22:26

opened #52

chore/smtp-notify-action

Status Failure

Total duration 14m 18s

Artifacts 4

static-analysis-gate.yml

on: pull_request

panic-attack assail

Hypatia neurosymbolic scan

Patch Bridge CVE triage

Deposit findings for gitbot-fleet

Annotations

12 errors, 14 warnings, and 2 notices

Hypatia neurosymbolic scan

Process completed with exit code 1.

Hypatia neurosymbolic scan

Hypatia found 10 critical security issue(s) — blocking merge

Hypatia neurosymbolic scan: .machine_readable/6a2/ECOSYSTEM.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/ECOSYSTEM.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/6a2/META.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/META.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/6a2/STATE.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .machine_readable/STATE.a2ml#L1

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

Hypatia neurosymbolic scan: .envrc#L23

[hypatia] Secret found: Generic API key

Hypatia neurosymbolic scan: setup.sh#L1

[hypatia] Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (2 occurrences, CWE-494)

Hypatia neurosymbolic scan: .machine_readable/svc/k9/methodology-guard.k9.ncl#L1

[hypatia] K9 contractile missing pedigree section (1 occurrences, CWE-1104)

Hypatia neurosymbolic scan: instant-sync.yml#L1

[hypatia] Issue in instant-sync.yml

panic-attack assail

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Patch Bridge CVE triage

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Hypatia neurosymbolic scan

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02, erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Hypatia neurosymbolic scan: dogfood-gate.yml#L1

[hypatia] Issue in dogfood-gate.yml

Hypatia neurosymbolic scan: dogfood-gate.yml#L1

[hypatia] Issue in dogfood-gate.yml

Hypatia neurosymbolic scan: dogfood-gate.yml#L1

[hypatia] Issue in dogfood-gate.yml

Hypatia neurosymbolic scan: dogfood-gate.yml#L1

[hypatia] Issue in dogfood-gate.yml

Hypatia neurosymbolic scan: dogfood-gate.yml#L1

[hypatia] Issue in dogfood-gate.yml

Hypatia neurosymbolic scan: dependabot-automerge.yml#L1

[hypatia] Issue in dependabot-automerge.yml

Hypatia neurosymbolic scan: codeql.yml#L1

[hypatia] Issue in codeql.yml

Hypatia neurosymbolic scan: casket-pages.yml#L1

[hypatia] Issue in casket-pages.yml

Hypatia neurosymbolic scan: casket-pages.yml#L1

[hypatia] Issue in casket-pages.yml

Hypatia neurosymbolic scan: boj-build.yml#L1

[hypatia] Issue in boj-build.yml

Deposit findings for gitbot-fleet

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

panic-attack assail

panic-attack binary not available — skipping assail

Patch Bridge CVE triage

panic-attack binary not available — skipping Patch Bridge

Artifacts

Produced during runtime

Name	Size	Digest
bridge-report	218 Bytes	`sha256:65dce47c48b3b57b3f83608a9bd77415e9cb1b58e434d8ddc5f3a07b8e91f896`
hypatia-findings	1.51 KB	`sha256:f75bcfd12ed2d0889dc7d6d225e3de9493b5e12b1307fc699e4b5e94111629d7`
panic-attack-findings	171 Bytes	`sha256:1852b5896c9a098110a7c73ac6955cb9d42d0310fb698a8d9b5514c9243cbf48`
unified-findings	1.76 KB	`sha256:288a27690e8f69e9a7ae7aaceed8412bf1311668f3f146eb4e96625603901ff3`