Skip to content

chore(actions): relock drifted action pins (#8) #47

chore(actions): relock drifted action pins (#8)

chore(actions): relock drifted action pins (#8) #47

Triggered via push September 15, 2026 20:08
Status Failure
Total duration 51s
Artifacts 4
panic-attack assail
7s
panic-attack assail
Hypatia neurosymbolic scan
37s
Hypatia neurosymbolic scan
Patch Bridge CVE triage
7s
Patch Bridge CVE triage
Deposit findings for gitbot-fleet
6s
Deposit findings for gitbot-fleet
Fit to window
Zoom out
Zoom in

Annotations

12 errors, 14 warnings, and 2 notices
Hypatia neurosymbolic scan
Process completed with exit code 1.
Hypatia neurosymbolic scan
Hypatia found 2 critical security issue(s) — blocking merge
Hypatia neurosymbolic scan: ffi/zig/twitter/twitter.zig#L1
[hypatia] Zig @aligncast performs unchecked alignment cast (6 occurrences, CWE-704)
Hypatia neurosymbolic scan: ffi/zig/twitter/twitter.zig#L1
[hypatia] Zig @ptrCast performs unchecked pointer type conversion (9 occurrences, CWE-704)
Hypatia neurosymbolic scan: proofs/agda/Trigger/Epistemic.agda#L1
[hypatia] Agda postulate assumes without proof -- potential soundness hole (5 occurrences, CWE-704)
Hypatia neurosymbolic scan: proofs/agda/Trigger/API.agda#L1
[hypatia] Agda postulate assumes without proof -- potential soundness hole (8 occurrences, CWE-704)
Hypatia neurosymbolic scan: .github/workflows/scorecard.yml#L1
[hypatia] Required file missing (condition: public_repo)
Hypatia neurosymbolic scan: SECURITY.md#L1
[hypatia] Required file missing (condition: public_repo)
Hypatia neurosymbolic scan: secret-scanner.yml#L1
[hypatia] Required workflow `secret-scanner.yml` is absent from .github/workflows/. The estate baseline expects it; without it this repository is unscanned for whatever that workflow covers, and its absence is silent — no job fails, because no job runs.
Hypatia neurosymbolic scan: mirror.yml#L1
[hypatia] Required workflow `mirror.yml` is absent from .github/workflows/. The estate baseline expects it; without it this repository is unscanned for whatever that workflow covers, and its absence is silent — no job fails, because no job runs.
Hypatia neurosymbolic scan: scorecard.yml#L1
[hypatia] Required workflow `scorecard.yml` is absent from .github/workflows/. The estate baseline expects it; without it this repository is unscanned for whatever that workflow covers, and its absence is silent — no job fails, because no job runs.
Hypatia neurosymbolic scan: 0-AI-MANIFEST.a2ml#L1
[hypatia] Required file missing
panic-attack assail
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@v4.6.2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Patch Bridge CVE triage
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@v4.6.2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Hypatia neurosymbolic scan
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@v4.6.2, erlef/setup-beam@v1.20.4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Hypatia neurosymbolic scan: .github/workflows#L1
[hypatia] No secret-history scan is wired in this repository -- no call to `secret-scanner-reusable.yml` and no direct `gitleaks`/`trufflehog` invocation. A secret committed and later deleted is invisible to every working-tree scan, so this repository has no coverage for the class of leak that matters most. Fix: add a caller for `hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml`, which checks out at `fetch-depth: 0` and runs both a working-tree and a full-history pass.
Hypatia neurosymbolic scan: labels.yml#L1
[hypatia] Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: label-triage.yml#L1
[hypatia] Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: ada-ci.yml#L1
[hypatia] Job `zig-ffi` in ada-ci.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: ada-ci.yml#L1
[hypatia] Job `test` in ada-ci.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: ada-ci.yml#L1
[hypatia] Job `security` in ada-ci.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: ada-ci.yml#L1
[hypatia] Job `notifications` in ada-ci.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: ada-ci.yml#L1
[hypatia] Job `diagnostics` in ada-ci.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: ada-ci.yml#L1
[hypatia] Job `build` in ada-ci.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).
Hypatia neurosymbolic scan: ada-ci.yml#L1
[hypatia] No permissions declaration -- add permissions: read-all
Deposit findings for gitbot-fleet
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4.1.8, actions/upload-artifact@v4.6.2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
panic-attack assail
panic-attack binary not available — skipping assail
Patch Bridge CVE triage
panic-attack binary not available — skipping Patch Bridge

Artifacts

Produced during runtime
Name Size Digest
bridge-report
218 Bytes
sha256:a66d5a606cda3c2082843d0a53c8ac9ceeada938c3df759dcb4a9bafb0b23009
hypatia-findings
2.69 KB
sha256:6eab130c6a261784fd38f3072f9a4629b582acf0eabb9ab24385cee62ff975c6
panic-attack-findings
171 Bytes
sha256:5b42bec528fa81db109413916bbca231a4405cadb3681eb617eee0f7092d0e63
unified-findings
2.94 KB
sha256:a977ea967ad8e885641fd68a25dbeb647f5c5d026c41b2cb82f87656a8623e82