[hypatia] Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (2 occurrences, CWE-494, line 144, 156)

[hypatia] from_raw constructs types from raw pointers without safety checks (2 occurrences, CWE-676, line 32, 48)

[hypatia] Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.

[hypatia] workflow .github/workflows/security-policy.yml:26 step `Security checks` swallows non-zero exit via `|| true` — failures will be masked

[hypatia] workflow .github/workflows/openssf-compliance.yml:84 step `Check no unfilled placeholder tokens in required files` swallows non-zero exit via `|| true` — failures will be masked

[hypatia] workflow .github/workflows/wellknown-enforcement.yml:138 step `Mixed content check` swallows non-zero exit via `|| true` — failures will be masked

[hypatia] workflow .github/workflows/quality.yml:36 step `EditorConfig check` swallows non-zero exit via `continue-on-error: true` — failures will be masked

[hypatia] workflow .github/workflows/quality.yml:26 step `Check file permissions` swallows non-zero exit via `|| true` — failures will be masked

[hypatia] job `notify` in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` or declare its egress — review outbound-egress monitoring

[hypatia] job `trigger-boj` in .github/workflows/boj-build.yml references `secrets.*` but does not install `step-security/harden-runner` or declare its egress — review outbound-egress monitoring

[hypatia] job `dispatch` in .github/workflows/instant-sync.yml references `secrets.*` but does not install `step-security/harden-runner` or declare its egress — review outbound-egress monitoring

[hypatia] Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

[hypatia] Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).

panic-attack binary not available — skipping Patch Bridge

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"

panic-attack binary not available — skipping assail

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"