Static Analysis Gate

fix: the Hypatia gate could never fire — 2>&1 made it unconditionally… #45

Sign in to view logs

Triggered via push September 4, 2026 01:34

main

Status Failure

Total duration 51s

Artifacts 4

static-analysis-gate.yml

on: push

panic-attack assail

Hypatia neurosymbolic scan

Patch Bridge CVE triage

Deposit findings for gitbot-fleet

Annotations

12 errors, 14 warnings, and 2 notices

Hypatia neurosymbolic scan

Process completed with exit code 1.

Hypatia neurosymbolic scan

Hypatia found 2 critical security issue(s) — blocking merge

Hypatia neurosymbolic scan: ffi/zig/twitter/twitter.zig#L1

[hypatia] Zig @aligncast performs unchecked alignment cast (6 occurrences, CWE-704)

Hypatia neurosymbolic scan: ffi/zig/twitter/twitter.zig#L1

[hypatia] Zig @ptrCast performs unchecked pointer type conversion (9 occurrences, CWE-704)

Hypatia neurosymbolic scan: proofs/agda/Trigger/Epistemic.agda#L1

[hypatia] Agda postulate assumes without proof -- potential soundness hole (5 occurrences, CWE-704)

Hypatia neurosymbolic scan: proofs/agda/Trigger/API.agda#L1

[hypatia] Agda postulate assumes without proof -- potential soundness hole (8 occurrences, CWE-704)

Hypatia neurosymbolic scan: .github/workflows/scorecard.yml#L1

[hypatia] Required file missing (condition: public_repo)

Hypatia neurosymbolic scan: SECURITY.md#L1

[hypatia] Required file missing (condition: public_repo)

Hypatia neurosymbolic scan: secret-scanner.yml#L1

[hypatia] Issue in secret-scanner.yml

Hypatia neurosymbolic scan: mirror.yml#L1

[hypatia] Issue in mirror.yml

Hypatia neurosymbolic scan: scorecard.yml#L1

[hypatia] Issue in scorecard.yml

Hypatia neurosymbolic scan: 0-AI-MANIFEST.a2ml#L1

[hypatia] Required file missing

panic-attack assail

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@v4.6.2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Patch Bridge CVE triage

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@v4.6.2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Hypatia neurosymbolic scan

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@v4.6.2, erlef/setup-beam@v1.20.4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Hypatia neurosymbolic scan: /home/runner/work/trigger/trigger#L1

[hypatia] No SECURITY.md found in trigger

Hypatia neurosymbolic scan: labels.yml#L1

[hypatia] Issue in labels.yml

Hypatia neurosymbolic scan: label-triage.yml#L1

[hypatia] Issue in label-triage.yml

Hypatia neurosymbolic scan: ada-ci.yml#L1

[hypatia] Issue in ada-ci.yml

Hypatia neurosymbolic scan: ada-ci.yml#L1

[hypatia] Issue in ada-ci.yml

Hypatia neurosymbolic scan: ada-ci.yml#L1

[hypatia] Issue in ada-ci.yml

Hypatia neurosymbolic scan: ada-ci.yml#L1

[hypatia] Issue in ada-ci.yml

Hypatia neurosymbolic scan: ada-ci.yml#L1

[hypatia] Issue in ada-ci.yml

Hypatia neurosymbolic scan: ada-ci.yml#L1

[hypatia] Issue in ada-ci.yml

Hypatia neurosymbolic scan: ada-ci.yml#L1

[hypatia] No permissions declaration -- add permissions: read-all

Deposit findings for gitbot-fleet

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4.1.8, actions/upload-artifact@v4.6.2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

panic-attack assail

panic-attack binary not available — skipping assail

Patch Bridge CVE triage

panic-attack binary not available — skipping Patch Bridge

Artifacts

Produced during runtime

Name	Size	Digest
bridge-report	218 Bytes	`sha256:c9bd9f07631d366699a5810b375a9949ed76d56af400688e6c5e91b49c33732e`
hypatia-findings	1.42 KB	`sha256:4d6b289d79a1c2563791900fc095ee5113fdf5d30f95a4e6e6c20a1e5490d9c0`
panic-attack-findings	171 Bytes	`sha256:f10e4088c3bb68ebed54c46156b86bbbaa235a669626f76327ef9b58caf4cab7`
unified-findings	1.67 KB	`sha256:ef76c89f4092441a00f014a7e41ab6f57b601e45f2cc4765c61975aea8645de7`