Static Analysis Gate

fix: the Hypatia gate could never fire — 2>&1 made it unconditionally vacuous #44

Sign in to view logs

Re-run triggered September 3, 2026 15:48

#7

fix/hypatia-vacuous-gate

Status Failure

Total duration 1m 4s

Artifacts 4

static-analysis-gate.yml

on: pull_request

panic-attack assail

Hypatia neurosymbolic scan

Patch Bridge CVE triage

Deposit findings for gitbot-fleet

Annotations

12 errors, 14 warnings, and 2 notices

Hypatia neurosymbolic scan

Process completed with exit code 1.

Hypatia neurosymbolic scan

Hypatia found 2 critical security issue(s) — blocking merge

Hypatia neurosymbolic scan: ffi/zig/twitter/twitter.zig#L1

[hypatia] Zig @aligncast performs unchecked alignment cast (6 occurrences, CWE-704)

Hypatia neurosymbolic scan: ffi/zig/twitter/twitter.zig#L1

[hypatia] Zig @ptrCast performs unchecked pointer type conversion (9 occurrences, CWE-704)

Hypatia neurosymbolic scan: proofs/agda/Trigger/Epistemic.agda#L1

[hypatia] Agda postulate assumes without proof -- potential soundness hole (5 occurrences, CWE-704)

Hypatia neurosymbolic scan: proofs/agda/Trigger/API.agda#L1

[hypatia] Agda postulate assumes without proof -- potential soundness hole (8 occurrences, CWE-704)

Hypatia neurosymbolic scan: .github/workflows/scorecard.yml#L1

[hypatia] Required file missing (condition: public_repo)

Hypatia neurosymbolic scan: SECURITY.md#L1

[hypatia] Required file missing (condition: public_repo)

Hypatia neurosymbolic scan: secret-scanner.yml#L1

[hypatia] Issue in secret-scanner.yml

Hypatia neurosymbolic scan: mirror.yml#L1

[hypatia] Issue in mirror.yml

Hypatia neurosymbolic scan: scorecard.yml#L1

[hypatia] Issue in scorecard.yml

Hypatia neurosymbolic scan: 0-AI-MANIFEST.a2ml#L1

[hypatia] Required file missing

Patch Bridge CVE triage

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@v4.6.2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Hypatia neurosymbolic scan

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@v4.6.2, erlef/setup-beam@v1.20.4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Hypatia neurosymbolic scan: /home/runner/work/trigger/trigger#L1

[hypatia] No SECURITY.md found in trigger

Hypatia neurosymbolic scan: labels.yml#L1

[hypatia] Issue in labels.yml

Hypatia neurosymbolic scan: label-triage.yml#L1

[hypatia] Issue in label-triage.yml

Hypatia neurosymbolic scan: ada-ci.yml#L1

[hypatia] Issue in ada-ci.yml

Hypatia neurosymbolic scan: ada-ci.yml#L1

[hypatia] Issue in ada-ci.yml

Hypatia neurosymbolic scan: ada-ci.yml#L1

[hypatia] Issue in ada-ci.yml

Hypatia neurosymbolic scan: ada-ci.yml#L1

[hypatia] Issue in ada-ci.yml

Hypatia neurosymbolic scan: ada-ci.yml#L1

[hypatia] Issue in ada-ci.yml

Hypatia neurosymbolic scan: ada-ci.yml#L1

[hypatia] Issue in ada-ci.yml

Hypatia neurosymbolic scan: ada-ci.yml#L1

[hypatia] No permissions declaration -- add permissions: read-all

panic-attack assail

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@v4.6.2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Deposit findings for gitbot-fleet

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4.1.8, actions/upload-artifact@v4.6.2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Patch Bridge CVE triage

panic-attack binary not available — skipping Patch Bridge

panic-attack assail

panic-attack binary not available — skipping assail

Artifacts

Produced during runtime

Name	Size	Digest
bridge-report	218 Bytes	`sha256:8dce9ae81db2d0c0af41d30a2deed17664d149115c3ac08e7e272d27ec46901f`
hypatia-findings	1.42 KB	`sha256:ce4249068f163dd25c7c0bd6079c1bf0c08fcd637f8e659066d5342b9f7632dd`
panic-attack-findings	171 Bytes	`sha256:5f6a9de8a727e1f4e01cb4ee5351b9252193e885c328d021559740d243bb72fb`
unified-findings	1.67 KB	`sha256:1237ab01ff0723dba3c4e0ec1307ea8d6dfdca132cb97babc44a3ab9b6206c76`