{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-206d71ef1a2e4e00", "name": "Stray `console.log` in TS/JS \u2014 tests/cli.test.ts:170", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tests/cli.test.ts:170"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c07db1ef0f0c24cb", "name": "TODO/FIXME marker in shipping code \u2014 src/nest/create-nest-configs.ts:41", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/nest/create-nest-configs.ts:41"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c7c1cd2331dcadbd", "name": "Insecure pattern 'node_child_process' in scripts/measure-rule-timing.mjs:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/measure-rule-timing.mjs:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dca8a4241499b2cf", "name": "Insecure pattern 'node_child_process' in scripts/check-peer-minimum.mjs:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/check-peer-minimum.mjs:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4bdab738fec39ca2", "name": "Insecure pattern 'node_child_process' in src/utils/cli/types.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/utils/cli/types.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a15631e23cc3e352", "name": "Insecure pattern 'node_child_process' in src/utils/cli/state/get-adoption-state-repo-root.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/utils/cli/state/get-adoption-state-repo-root.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15f654d68e92392b", "name": "Insecure pattern 'node_child_process' in src/utils/cli/eslint-run/run-git-command.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/utils/cli/eslint-run/run-git-command.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59c937476f458d79", "name": "Insecure pattern 'node_child_process' in src/utils/cli/eslint-run/run-eslint-json.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/utils/cli/eslint-run/run-eslint-json.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64192a3c67110d01", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2711288fdb4c648", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "69 tests / 372 src (ratio 0.19)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-473f3bb9d33799c5", "name": "Agent authority lacks a verifier contract: skills/skapxd-lint/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/skapxd-lint/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e5d12bf6a1d5bcb", "name": "Commented-code block (5 lines) in src/rules/no-floating-promises.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in src/rules/no-floating-promises.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-340a72b870a4e662", "name": "Commented-code block (7 lines) in src/rules/no-anonymous-condition.ts:11", "shortDescription": {"text": "Commented-code block (7 lines) in src/rules/no-anonymous-condition.ts:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5391defdd56efeee", "name": "Commented-code block (5 lines) in src/rules/untrusted-module-requires-adapter.ts:6", "shortDescription": {"text": "Commented-code block (5 lines) in src/rules/untrusted-module-requires-adapter.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-221e13db684c0839", "name": "Commented-code block (6 lines) in src/shared/configs/create-shared-configs.ts:26", "shortDescription": {"text": "Commented-code block (6 lines) in src/shared/configs/create-shared-configs.ts:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ca115954797fa958", "name": "Commented-code block (5 lines) in src/shared/configs/type-driven-rules.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in src/shared/configs/type-driven-rules.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9cbafd57a46fd533", "name": "Commented-code block (5 lines) in src/constants/default-export-allowed-file-patterns.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in src/constants/default-export-allowed-file-patterns.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-154aca8561674c8b", "name": "Commented-code block (6 lines) in src/utils/ast/is-literal-guard-comparison.ts:7", "shortDescription": {"text": "Commented-code block (6 lines) in src/utils/ast/is-literal-guard-comparison.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3ca347b8b789d554", "name": "Commented-code block (5 lines) in src/utils/options/get-strict-tsconfig-options.ts:13", "shortDescription": {"text": "Commented-code block (5 lines) in src/utils/options/get-strict-tsconfig-options.ts:13"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a5538f5088fa9adc", "name": "Commented-code block (5 lines) in src/utils/react/get-state-shape-smell.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in src/utils/react/get-state-shape-smell.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c89540d7baa78d96", "name": "Commented-code block (5 lines) in src/utils/react/is-expression-arrow-function.ts:2", "shortDescription": {"text": "Commented-code block (5 lines) in src/utils/react/is-expression-arrow-function.ts:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-983bd13660d3415e", "name": "Commented-code block (5 lines) in src/utils/imports/get-declared-alias-targets.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in src/utils/imports/get-declared-alias-targets.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b589c18f187b206e", "name": "Commented-code block (5 lines) in src/utils/rule-authoring/wrap-tseslint-rule.ts:11", "shortDescription": {"text": "Commented-code block (5 lines) in src/utils/rule-authoring/wrap-tseslint-rule.ts:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a84ddd1118362074", "name": "Commented-code block (5 lines) in src/utils/matching/matches-any-glob.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in src/utils/matching/matches-any-glob.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-160f5a95e1f9517d", "name": "Commented-code block (5 lines) in src/utils/async/has-abort-signal-option.ts:6", "shortDescription": {"text": "Commented-code block (5 lines) in src/utils/async/has-abort-signal-option.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8403845d41320e0e", "name": "Commented-code block (7 lines) in src/nest/create-nest-configs.ts:30", "shortDescription": {"text": "Commented-code block (7 lines) in src/nest/create-nest-configs.ts:30"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19775"}, "properties": {"repository": "skapxd/eslint-opinionated", "repoUrl": "https://github.com/skapxd/eslint-opinionated", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-206d71ef1a2e4e00", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tests/cli.test.ts:170"}, "properties": {"repobilityId": "388ab237a38543b9", "scanner": "scanner-primary", "fingerprint": "206d71ef1a2e4e00", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c07db1ef0f0c24cb", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/nest/create-nest-configs.ts:41"}, "properties": {"repobilityId": "f3a307fdf99d38a0", "scanner": "scanner-primary", "fingerprint": "c07db1ef0f0c24cb", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-c7c1cd2331dcadbd", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/measure-rule-timing.mjs:1"}, "properties": {"repobilityId": "17a91a0ccfa984d2", "scanner": "scanner-primary", "fingerprint": "c7c1cd2331dcadbd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/measure-rule-timing.mjs"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dca8a4241499b2cf", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/check-peer-minimum.mjs:1"}, "properties": {"repobilityId": "b79185143d928a16", "scanner": "scanner-primary", "fingerprint": "dca8a4241499b2cf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/check-peer-minimum.mjs"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4bdab738fec39ca2", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/utils/cli/types.ts:1"}, "properties": {"repobilityId": "1b4d235d3fa4d84d", "scanner": "scanner-primary", "fingerprint": "4bdab738fec39ca2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/utils/cli/types.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a15631e23cc3e352", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/utils/cli/state/get-adoption-state-repo-root.ts:1"}, "properties": {"repobilityId": "adfd88b58ee036a3", "scanner": "scanner-primary", "fingerprint": "a15631e23cc3e352", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/utils/cli/state/get-adoption-state-repo-root.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-15f654d68e92392b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/utils/cli/eslint-run/run-git-command.ts:1"}, "properties": {"repobilityId": "053ab479eafea498", "scanner": "scanner-primary", "fingerprint": "15f654d68e92392b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/utils/cli/eslint-run/run-git-command.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59c937476f458d79", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/utils/cli/eslint-run/run-eslint-json.ts:1"}, "properties": {"repobilityId": "2550c33027876d7a", "scanner": "scanner-primary", "fingerprint": "59c937476f458d79", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/utils/cli/eslint-run/run-eslint-json.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e5617d449b061f6", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a63b1fd6887cae9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e5617d449b061f6", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a63b1fd6887cae9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e5617d449b061f6", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a63b1fd6887cae9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-64192a3c67110d01", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "87338a8bfcb6f435", "scanner": "scanner-primary", "fingerprint": "64192a3c67110d01", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2711288fdb4c648", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "675921fa1c890864", "scanner": "scanner-primary", "fingerprint": "f2711288fdb4c648", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rule-timing.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-f2711288fdb4c648", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2ee83c21ed70e63e", "scanner": "scanner-primary", "fingerprint": "f2711288fdb4c648", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rule-timing.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-f2711288fdb4c648", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2de8f46015126075", "scanner": "scanner-primary", "fingerprint": "f2711288fdb4c648", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rule-timing.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-f2711288fdb4c648", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "903e7716c2a27e06", "scanner": "scanner-primary", "fingerprint": "f2711288fdb4c648", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rule-timing.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-f2711288fdb4c648", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "675921fa1c890864", "scanner": "scanner-primary", "fingerprint": "f2711288fdb4c648", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rule-timing.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-f2711288fdb4c648", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2ee83c21ed70e63e", "scanner": "scanner-primary", "fingerprint": "f2711288fdb4c648", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rule-timing.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-f2711288fdb4c648", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2de8f46015126075", "scanner": "scanner-primary", "fingerprint": "f2711288fdb4c648", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rule-timing.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-f2711288fdb4c648", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "903e7716c2a27e06", "scanner": "scanner-primary", "fingerprint": "f2711288fdb4c648", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rule-timing.yml"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-f2711288fdb4c648", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "675921fa1c890864", "scanner": "scanner-primary", "fingerprint": "f2711288fdb4c648", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rule-timing.yml"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-f2711288fdb4c648", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2ee83c21ed70e63e", "scanner": "scanner-primary", "fingerprint": "f2711288fdb4c648", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rule-timing.yml"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-f2711288fdb4c648", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2de8f46015126075", "scanner": "scanner-primary", "fingerprint": "f2711288fdb4c648", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rule-timing.yml"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-f2711288fdb4c648", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "53b99f233d423ec8", "scanner": "scanner-primary", "fingerprint": "f2711288fdb4c648", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rule-timing.yml"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-f2711288fdb4c648", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "53b99f233d423ec8", "scanner": "scanner-primary", "fingerprint": "f2711288fdb4c648", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rule-timing.yml"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "6d941546a40dc245", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "fd2ca68393f56035", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "5ed7386db365eeb0", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "7e560743c3acbf51", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-473f3bb9d33799c5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/skapxd-lint/SKILL.md"}, "properties": {"repobilityId": "a346eb26a212a03f", "scanner": "scanner-primary", "fingerprint": "473f3bb9d33799c5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/skapxd-lint/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e5d12bf6a1d5bcb", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/rules/no-floating-promises.ts:3"}, "properties": {"repobilityId": "e755d00cc8954c51", "scanner": "scanner-primary", "fingerprint": "2e5d12bf6a1d5bcb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-340a72b870a4e662", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/rules/no-anonymous-condition.ts:11"}, "properties": {"repobilityId": "af922e2861ed52fe", "scanner": "scanner-primary", "fingerprint": "340a72b870a4e662", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5391defdd56efeee", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/rules/untrusted-module-requires-adapter.ts:6"}, "properties": {"repobilityId": "2707be8c63a79851", "scanner": "scanner-primary", "fingerprint": "5391defdd56efeee", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-221e13db684c0839", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/shared/configs/create-shared-configs.ts:26"}, "properties": {"repobilityId": "f404f285509ab179", "scanner": "scanner-primary", "fingerprint": "221e13db684c0839", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ca115954797fa958", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/shared/configs/type-driven-rules.ts:3"}, "properties": {"repobilityId": "afb7f3e9ff966c10", "scanner": "scanner-primary", "fingerprint": "ca115954797fa958", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9cbafd57a46fd533", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/constants/default-export-allowed-file-patterns.ts:1"}, "properties": {"repobilityId": "1cee741325a1e807", "scanner": "scanner-primary", "fingerprint": "9cbafd57a46fd533", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-154aca8561674c8b", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/utils/ast/is-literal-guard-comparison.ts:7"}, "properties": {"repobilityId": "12f3078c9ec87389", "scanner": "scanner-primary", "fingerprint": "154aca8561674c8b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3ca347b8b789d554", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/utils/options/get-strict-tsconfig-options.ts:13"}, "properties": {"repobilityId": "5e6e21a4cc940f40", "scanner": "scanner-primary", "fingerprint": "3ca347b8b789d554", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a5538f5088fa9adc", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/utils/react/get-state-shape-smell.ts:5"}, "properties": {"repobilityId": "54921008ffd8ddfc", "scanner": "scanner-primary", "fingerprint": "a5538f5088fa9adc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c89540d7baa78d96", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/utils/react/is-expression-arrow-function.ts:2"}, "properties": {"repobilityId": "899f8a0490eb79b3", "scanner": "scanner-primary", "fingerprint": "c89540d7baa78d96", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-983bd13660d3415e", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/utils/imports/get-declared-alias-targets.ts:5"}, "properties": {"repobilityId": "251c59c43c57adc8", "scanner": "scanner-primary", "fingerprint": "983bd13660d3415e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b589c18f187b206e", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/utils/rule-authoring/wrap-tseslint-rule.ts:11"}, "properties": {"repobilityId": "f170e7f5cf51e4b2", "scanner": "scanner-primary", "fingerprint": "b589c18f187b206e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a84ddd1118362074", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/utils/matching/matches-any-glob.ts:3"}, "properties": {"repobilityId": "01330df8d5f256b9", "scanner": "scanner-primary", "fingerprint": "a84ddd1118362074", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-160f5a95e1f9517d", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/utils/async/has-abort-signal-option.ts:6"}, "properties": {"repobilityId": "09b0f813ae56428d", "scanner": "scanner-primary", "fingerprint": "160f5a95e1f9517d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8403845d41320e0e", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/nest/create-nest-configs.ts:30"}, "properties": {"repobilityId": "c1796eac65e17795", "scanner": "scanner-primary", "fingerprint": "8403845d41320e0e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}