Process completed with exit code 1.

Hypatia found 6 critical security issue(s) — blocking merge

[hypatia] CI policy requires a retired descriptile path; align the check with .machine_readable/descriptiles/

[hypatia] CI policy requires a retired descriptile path; align the check with .machine_readable/descriptiles/

[hypatia] CI policy requires a retired descriptile path; align the check with .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] Descriptile in retired location -- must be in .machine_readable/descriptiles/

[hypatia] workflow .github/workflows/dependabot-automerge.yml performs a write (push/commit/release/PR) but grants no `contents: write` at the workflow level or any job level — the write will be denied at run time.

[hypatia] job in .github/workflows/release.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring

[hypatia] job in .github/workflows/sonarqube.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring

[hypatia] job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring

[hypatia] job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring

[hypatia] Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Action `SonarSource/sonarqube-scan-action@v8.2.2` in sonarqube.yml is not pinned to a commit SHA — `v8.2.2` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.

[hypatia] Action `haskell-actions/setup@v2.12.1` in pages.yml is not pinned to a commit SHA — `v2.12.1` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.

[hypatia] Action `github/codeql-action/analyze@v4.38.1` in codeql.yml is not pinned to a commit SHA — `v4.38.1` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.

[hypatia] Action `github/codeql-action/init@v4.38.1` in codeql.yml is not pinned to a commit SHA — `v4.38.1` is a tag, and a tag can be moved to a different commit. Pin it to a full 40-character commit SHA, with the version in a trailing comment.

panic-attack binary not available — skipping assail

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"

panic-attack binary not available — skipping Patch Bridge

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"