{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-dbd75cce33c2a1e2", "name": "Possibly dead Python function: forward_event", "shortDescription": {"text": "Possibly dead Python function: forward_event"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f620d4c5fcb4306", "name": "Possibly dead Python function: has_authentication", "shortDescription": {"text": "Possibly dead Python function: has_authentication"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7cfc9919fb6e5ff9", "name": "Possibly dead Python function: has_org_and_project", "shortDescription": {"text": "Possibly dead Python function: has_org_and_project"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47684eabe9aa5f0f", "name": "Possibly dead Python function: decorator", "shortDescription": {"text": "Possibly dead Python function: decorator"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-316b7c345bd12433", "name": "Possibly dead Python function: set_bytes", "shortDescription": {"text": "Possibly dead Python function: set_bytes"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15ae8dbb6d84ee3b", "name": "Possibly dead Python function: delete_dataset_async", "shortDescription": {"text": "Possibly dead Python function: delete_dataset_async"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-edf2f7b5969ae0ac", "name": "Possibly dead Python function: list_datasets_async", "shortDescription": {"text": "Possibly dead Python function: list_datasets_async"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b83665004de86ae", "name": "Possibly dead Python function: update_dataset_async", "shortDescription": {"text": "Possibly dead Python function: update_dataset_async"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6fc4998aa1455202", "name": "Possibly dead Python function: files_async", "shortDescription": {"text": "Possibly dead Python function: files_async"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a7b5e9482784282", "name": "Possibly dead Python function: delete_parse_async", "shortDescription": {"text": "Possibly dead Python function: delete_parse_async"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6335bbb81b211ab8", "name": "Possibly dead Python function: list_parse_results_async", "shortDescription": {"text": "Possibly dead Python function: list_parse_results_async"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-afd479a867b828b1", "name": "Possibly dead Python function: result_async", "shortDescription": {"text": "Possibly dead Python function: result_async"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3d20db3c7c5e4b7", "name": "Possibly dead Python function: list_archived", "shortDescription": {"text": "Possibly dead Python function: list_archived"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb072c3558fbbf3c", "name": "Possibly dead Python function: list_archived", "shortDescription": {"text": "Possibly dead Python function: list_archived"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e85098dab902d795", "name": "Possibly dead Python function: image_infos", "shortDescription": {"text": "Possibly dead Python function: image_infos"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf50a0141e4af34b", "name": "Possibly dead Python function: create_image_context_file", "shortDescription": {"text": "Possibly dead Python function: create_image_context_file"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d665c0ae29339e18", "name": "Possibly dead Python function: wait_futures", "shortDescription": {"text": "Possibly dead Python function: wait_futures"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7faa7225da4cd167", "name": "Possibly dead Python function: await_future", "shortDescription": {"text": "Possibly dead Python function: await_future"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2a060fe7adb6d90", "name": "Possibly dead Python function: run_future", "shortDescription": {"text": "Possibly dead Python function: run_future"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4871c195f42ab53", "name": "Possibly dead Python function: register_coroutine", "shortDescription": {"text": "Possibly dead Python function: register_coroutine"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b34e0de35c347b5", "name": "Possibly dead Python function: coroutine_to_future", "shortDescription": {"text": "Possibly dead Python function: coroutine_to_future"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe137134f0f2cf91", "name": "Stray `console.log` in TS/JS \u2014 typescript/src/http.ts:69", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 typescript/src/http.ts:69"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48cee5e1ac33fcb5", "name": "Insecure pattern 'eval_used' in README.md:183", "shortDescription": {"text": "Insecure pattern 'eval_used' in README.md:183"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9529da46d4b37223", "name": "Insecure pattern 'node_child_process' in typescript/scripts/prepare-package.mjs:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in typescript/scripts/prepare-package.mjs:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa3550e09c1baa12", "name": "Insecure pattern 'node_child_process' in typescript/scripts/build-native.mjs:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in typescript/scripts/build-native.mjs:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e243aafc7495894b", "name": "Insecure pattern 'node_child_process' in typescript/lib/runtime.cjs:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in typescript/lib/runtime.cjs:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c0b5f8c7c531473a", "name": "Insecure pattern 'node_child_process' in .github/workflows/publish_npm.yaml:137", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/workflows/publish_npm.yaml:137"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-872530877ea92048", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d2d2541c24d8c18e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "PyO3/maturin-action@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-45a8c477f90798a2", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-04283973288870ad", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73d609d65d683f45", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b1c64b92fa205ebd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-abe7359acf7ffba2", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c91f8fa4ff93214f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "dtolnay/rust-toolchain@stable can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42e1c37b6b4392b2", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-236e7285a745260e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3aec96b92b2671b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0697d58a797e11c2", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9e60ac367d2d5d7e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "aws-actions/configure-aws-credentials@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68e2ccbf8d8ff246", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-26d5f42189512f15", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d221445fb7ecfb9b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "PyO3/maturin-action@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2f9dbf560027db6b", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90653a617f236f1c", "name": "Very large file: tests/function_executor/test_run_allocation.py (1183 lines)", "shortDescription": {"text": "Very large file: tests/function_executor/test_run_allocation.py (1183 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-201e1be6ea31b884", "name": "Very large file: tests/function_executor/test_replay.py (1504 lines)", "shortDescription": {"text": "Very large file: tests/function_executor/test_replay.py (1504 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b94f179a174dec31", "name": "Very large file: crates/rust-cloud-sdk-py/src/lib.rs (3053 lines)", "shortDescription": {"text": "Very large file: crates/rust-cloud-sdk-py/src/lib.rs (3053 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-501a2023238a971c", "name": "Very large file: crates/cli/src/main.rs (2169 lines)", "shortDescription": {"text": "Very large file: crates/cli/src/main.rs (2169 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1821587b754bf82a", "name": "Very large file: crates/cloud-sdk/src/sandbox_images.rs (3190 lines)", "shortDescription": {"text": "Very large file: crates/cloud-sdk/src/sandbox_images.rs (3190 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d7eea7ccc0a853e", "name": "Very large file: crates/cloud-sdk/src/sandboxes/desktop.rs (1605 lines)", "shortDescription": {"text": "Very large file: crates/cloud-sdk/src/sandboxes/desktop.rs (1605 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-108526574d095161", "name": "Very large file: crates/cloud-sdk/src/applications/models.rs (1705 lines)", "shortDescription": {"text": "Very large file: crates/cloud-sdk/src/applications/models.rs (1705 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e7b8938fac346539", "name": "Very large file: src/tensorlake/sandbox/client.py (1438 lines)", "shortDescription": {"text": "Very large file: src/tensorlake/sandbox/client.py (1438 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e0dc99c2d791f12", "name": "Very large file: src/tensorlake/sandbox/sandbox.py (1372 lines)", "shortDescription": {"text": "Very large file: src/tensorlake/sandbox/sandbox.py (1372 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ede54638b38ce20", "name": "Very large file: src/tensorlake/applications/local/runner.py (1289 lines)", "shortDescription": {"text": "Very large file: src/tensorlake/applications/local/runner.py (1289 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 95 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f486b5c4c922fbb2", "name": "Legacy-named symbol `test_parse_accepts_files_from_files_v2` in tests/document_ai/test_parse.py:410", "shortDescription": {"text": "Legacy-named symbol `test_parse_accepts_files_from_files_v2` in tests/document_ai/test_parse.py:410"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bad668930ce79606", "name": "Legacy-named symbol `test_dataset_accepts_files_from_files_v2` in tests/document_ai/test_datasets.py:297", "shortDescription": {"text": "Legacy-named symbol `test_dataset_accepts_files_from_files_v2` in tests/document_ai/test_datasets.py:297"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-969e7925df2f8fd8", "name": "Commented-code block (9 lines) in tests/applications/test_output_propagation.py:18", "shortDescription": {"text": "Commented-code block (9 lines) in tests/applications/test_output_propagation.py:18"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c42dbb3148ee25fe", "name": "Commented-code block (5 lines) in tests/applications/test_application_manifest.py:310", "shortDescription": {"text": "Commented-code block (5 lines) in tests/applications/test_application_manifest.py:310"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e38932596292e73c", "name": "Legacy-named symbol `request_v1` in tests/applications/app_update/test_app_update.py:61", "shortDescription": {"text": "Legacy-named symbol `request_v1` in tests/applications/app_update/test_app_update.py:61"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3256ab32c3a103cd", "name": "Commented-code block (5 lines) in tests/function_executor/test_replay_sequential_workflow.py:301", "shortDescription": {"text": "Commented-code block (5 lines) in tests/function_executor/test_replay_sequential_workflow.py:301"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7d24f8964ef6a1ca", "name": "Commented-code block (5 lines) in tests/function_executor/test_replay.py:66", "shortDescription": {"text": "Commented-code block (5 lines) in tests/function_executor/test_replay.py:66"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f5394c103ce32fad", "name": "Commented-code block (5 lines) in typescript/src/sandbox-image.ts:115", "shortDescription": {"text": "Commented-code block (5 lines) in typescript/src/sandbox-image.ts:115"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a18134eea2d8cccb", "name": "Commented-code block (8 lines) in typescript/src/sandbox.ts:1062", "shortDescription": {"text": "Commented-code block (8 lines) in typescript/src/sandbox.ts:1062"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d238b4592801f6a2", "name": "Network/subprocess call without timeout or try/except \u2014 .github/scripts/verify_wheel.py:45", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 .github/scripts/verify_wheel.py:45"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fa9465327ba529e", "name": "Commented-code block (8 lines) in src/tensorlake/image/utils.py:35", "shortDescription": {"text": "Commented-code block (8 lines) in src/tensorlake/image/utils.py:35"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-46d1144f79a952ae", "name": "Stub function `_noop_emit` (body is just `pass`/`return`) \u2014 src/tensorlake/image/sandbox_builder.py:58", "shortDescription": {"text": "Stub function `_noop_emit` (body is just `pass`/`return`) \u2014 src/tensorlake/image/sandbox_builder.py:58"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-716d166730d67590", "name": "Stub function `api_key_id` (body is just `pass`/`return`) \u2014 src/tensorlake/cli/_common.py:65", "shortDescription": {"text": "Stub function `api_key_id` (body is just `pass`/`return`) \u2014 src/tensorlake/cli/_common.py:65"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-acd223c2b1a38927", "name": "Commented-code block (5 lines) in src/tensorlake/applications/user_data_serializer.py:21", "shortDescription": {"text": "Commented-code block (5 lines) in src/tensorlake/applications/user_data_serializer.py:21"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c1ea67e137b31449", "name": "Legacy-named symbol `model_copy` in src/tensorlake/applications/blob_store/blob_store.py:226", "shortDescription": {"text": "Legacy-named symbol `model_copy` in src/tensorlake/applications/blob_store/blob_store.py:226"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-458dfdf4ab617195", "name": "Commented-code block (5 lines) in src/tensorlake/applications/interface/retries.py:18", "shortDescription": {"text": "Commented-code block (5 lines) in src/tensorlake/applications/interface/retries.py:18"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-89459c0e4e65e8a4", "name": "Commented-code block (6 lines) in src/tensorlake/applications/interface/function.py:67", "shortDescription": {"text": "Commented-code block (6 lines) in src/tensorlake/applications/interface/function.py:67"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2a7e9edbaa16a466", "name": "Commented-code block (6 lines) in src/tensorlake/applications/remote/manifests/function_manifests.py:42", "shortDescription": {"text": "Commented-code block (6 lines) in src/tensorlake/applications/remote/manifests/function_manifests.py:42"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e035f80f7cca0ec6", "name": "Commented-code block (5 lines) in src/tensorlake/applications/remote/manifests/application.py:55", "shortDescription": {"text": "Commented-code block (5 lines) in src/tensorlake/applications/remote/manifests/application.py:55"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-45f3d76567fe70db", "name": "Legacy-named symbol `model_copy` in src/tensorlake/applications/local/value_store.py:39", "shortDescription": {"text": "Legacy-named symbol `model_copy` in src/tensorlake/applications/local/value_store.py:39"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb38b02816e63fca", "name": "Legacy-named symbol `model_copy` in src/tensorlake/applications/local/runner.py:831", "shortDescription": {"text": "Legacy-named symbol `model_copy` in src/tensorlake/applications/local/runner.py:831"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48a150cf47c0f015", "name": "Commented-code block (5 lines) in src/tensorlake/applications/local/runner.py:992", "shortDescription": {"text": "Commented-code block (5 lines) in src/tensorlake/applications/local/runner.py:992"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7a4a28804a055807", "name": "Stub function `log_message` (body is just `pass`/`return`) \u2014 src/tensorlake/applications/request_context/http_server/rou", "shortDescription": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 src/tensorlake/applications/request_context/http_server/router.py:94"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fec5cabd9fab0777", "name": "Commented-code block (9 lines) in src/tensorlake/applications/validation/validate.py:176", "shortDescription": {"text": "Commented-code block (9 lines) in src/tensorlake/applications/validation/validate.py:176"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aa5fc25fa5fda833", "name": "Commented-code block (5 lines) in src/tensorlake/applications/metadata/serialization.py:13", "shortDescription": {"text": "Commented-code block (5 lines) in src/tensorlake/applications/metadata/serialization.py:13"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ab8303b0be40d890", "name": "Commented-code block (5 lines) in src/tensorlake/function_executor/health_check.py:22", "shortDescription": {"text": "Commented-code block (5 lines) in src/tensorlake/function_executor/health_check.py:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c001ebb4376d9ee", "name": "Network/subprocess call without timeout or try/except \u2014 src/tensorlake/function_executor/health_check.py:36", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/tensorlake/function_executor/health_check.py:36"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de93a48ef9d938d3", "name": "Commented-code block (6 lines) in src/tensorlake/function_executor/proto/server_configuration.py:7", "shortDescription": {"text": "Commented-code block (6 lines) in src/tensorlake/function_executor/proto/server_configuration.py:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-89429f007ab7aee5", "name": "Commented-code block (19 lines) in src/tensorlake/function_executor/allocation_runner/strict_mode_replayer.py:168", "shortDescription": {"text": "Commented-code block (19 lines) in src/tensorlake/function_executor/allocation_runner/strict_mode_replayer.py:168"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2f23d5abb026f749", "name": "Legacy-named symbol `allocation_state_copy` in src/tensorlake/function_executor/allocation_runner/allocation_state_wrapp", "shortDescription": {"text": "Legacy-named symbol `allocation_state_copy` in src/tensorlake/function_executor/allocation_runner/allocation_state_wrapper.py:98"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-924a1567c5961380", "name": "Commented-code block (5 lines) in src/tensorlake/function_executor/allocation_runner/event_loop/event_loop.py:121", "shortDescription": {"text": "Commented-code block (5 lines) in src/tensorlake/function_executor/allocation_runner/event_loop/event_loop.py:121"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-65df07ab4020db79", "name": "18 env vars used in code but missing from .env.example", "shortDescription": {"text": "18 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CARGO_TARGET_DIR`, `INDEXIFY_NAMESPACE`, `TENSORLAKE_CLI_BUILD_TOOL`, `TENSORLAKE_CLI_TARGET_ID`, `TENSORLAKE_CLI_TARGET_TRIPLE`, `TENSORLAKE_CODE_ZIP_SAVE_PATH`, `TENSORLAKE_DEBUG`, `TENSORLAKE_DOCAI_URL_V2` + 10 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/tensorlake/cloud_client.py:upsert_application, src/tensorlake/applications/remote/api_client.py:upsert_application\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76a2f6818267a9a8", "name": "Near-duplicate function bodies in 8 places", "shortDescription": {"text": "Near-duplicate function bodies in 8 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/tensorlake/documentai/_extract.py:extract, src/tensorlake/documentai/_extract.py:extract, src/tensorlake/documentai/_extract.py:extract, src/tensorlake/documentai/_extract.py:extract\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ecd86354d3c142ad", "name": "Near-duplicate function bodies in 20 places", "shortDescription": {"text": "Near-duplicate function bodies in 20 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/tensorlake/documentai/_parse.py:parse, src/tensorlake/documentai/_parse.py:parse, src/tensorlake/documentai/_parse.py:parse, src/tensorlake/documentai/_parse.py:parse\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/tensorlake/sandbox/client.py:create, src/tensorlake/sandbox/client.py:create_and_connect, src/tensorlake/sandbox/async_client.py:create, src/tensorlake/sandbox/async_client.py:create_and_connect\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20980"}, "properties": {"repository": "tensorlakeai/tensorlake", "repoUrl": "https://github.com/tensorlakeai/tensorlake", "branch": "main"}, "results": [{"ruleId": "scanner-dbd75cce33c2a1e2", "level": "note", "message": {"text": "Possibly dead Python function: forward_event"}, "properties": {"repobilityId": "4b927ace79803a7a", "scanner": "scanner-primary", "fingerprint": "dbd75cce33c2a1e2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/image/sandbox_builder.py:243"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6f620d4c5fcb4306", "level": "note", "message": {"text": "Possibly dead Python function: has_authentication"}, "properties": {"repobilityId": "aba215d4701d8a66", "scanner": "scanner-primary", "fingerprint": "6f620d4c5fcb4306", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/cli/_common.py:93"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7cfc9919fb6e5ff9", "level": "note", "message": {"text": "Possibly dead Python function: has_org_and_project"}, "properties": {"repobilityId": "c6fc8d28ecaf0408", "scanner": "scanner-primary", "fingerprint": "7cfc9919fb6e5ff9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/cli/_common.py:96"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47684eabe9aa5f0f", "level": "note", "message": {"text": "Possibly dead Python function: decorator"}, "properties": {"repobilityId": "ffbcbc9bc189af1c", "scanner": "scanner-primary", "fingerprint": "47684eabe9aa5f0f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/utils/retries.py:54"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-316b7c345bd12433", "level": "note", "message": {"text": "Possibly dead Python function: set_bytes"}, "properties": {"repobilityId": "b69965eb99e4c091", "scanner": "scanner-primary", "fingerprint": "316b7c345bd12433", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/utils/cache.py:56"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-15ae8dbb6d84ee3b", "level": "note", "message": {"text": "Possibly dead Python function: delete_dataset_async"}, "properties": {"repobilityId": "e6008f0a89473208", "scanner": "scanner-primary", "fingerprint": "15ae8dbb6d84ee3b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/documentai/_datasets.py:150"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-edf2f7b5969ae0ac", "level": "note", "message": {"text": "Possibly dead Python function: list_datasets_async"}, "properties": {"repobilityId": "5d91ef75aaec670f", "scanner": "scanner-primary", "fingerprint": "edf2f7b5969ae0ac", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/documentai/_datasets.py:289"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6b83665004de86ae", "level": "note", "message": {"text": "Possibly dead Python function: update_dataset_async"}, "properties": {"repobilityId": "eadd5b3ed2f59f73", "scanner": "scanner-primary", "fingerprint": "6b83665004de86ae", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/documentai/_datasets.py:375"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6fc4998aa1455202", "level": "note", "message": {"text": "Possibly dead Python function: files_async"}, "properties": {"repobilityId": "f9cd59e4e85f3e7d", "scanner": "scanner-primary", "fingerprint": "6fc4998aa1455202", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/documentai/_files.py:71"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6a7b5e9482784282", "level": "note", "message": {"text": "Possibly dead Python function: delete_parse_async"}, "properties": {"repobilityId": "25a964f8feb90873", "scanner": "scanner-primary", "fingerprint": "6a7b5e9482784282", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/documentai/_parse.py:888"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6335bbb81b211ab8", "level": "note", "message": {"text": "Possibly dead Python function: list_parse_results_async"}, "properties": {"repobilityId": "db366d87c2fff949", "scanner": "scanner-primary", "fingerprint": "6335bbb81b211ab8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/documentai/_parse.py:972"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-afd479a867b828b1", "level": "note", "message": {"text": "Possibly dead Python function: result_async"}, "properties": {"repobilityId": "9375e8e9e19d0f03", "scanner": "scanner-primary", "fingerprint": "afd479a867b828b1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/documentai/_parse.py:1043"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3d20db3c7c5e4b7", "level": "note", "message": {"text": "Possibly dead Python function: list_archived"}, "properties": {"repobilityId": "53251687e056e344", "scanner": "scanner-primary", "fingerprint": "b3d20db3c7c5e4b7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/sandbox/client.py:607"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fb072c3558fbbf3c", "level": "note", "message": {"text": "Possibly dead Python function: list_archived"}, "properties": {"repobilityId": "53251687e056e344", "scanner": "scanner-primary", "fingerprint": "fb072c3558fbbf3c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/sandbox/async_client.py:314"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e85098dab902d795", "level": "note", "message": {"text": "Possibly dead Python function: image_infos"}, "properties": {"repobilityId": "ee9944eb5cb60aee", "scanner": "scanner-primary", "fingerprint": "e85098dab902d795", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/applications/image.py:22"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bf50a0141e4af34b", "level": "note", "message": {"text": "Possibly dead Python function: create_image_context_file"}, "properties": {"repobilityId": "47ceb5a880d8e6d4", "scanner": "scanner-primary", "fingerprint": "bf50a0141e4af34b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/applications/image.py:37"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d665c0ae29339e18", "level": "note", "message": {"text": "Possibly dead Python function: wait_futures"}, "properties": {"repobilityId": "82d9ba8d010d40bc", "scanner": "scanner-primary", "fingerprint": "d665c0ae29339e18", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/applications/runtime_hooks.py:23"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7faa7225da4cd167", "level": "note", "message": {"text": "Possibly dead Python function: await_future"}, "properties": {"repobilityId": "e1bba5541dd0774e", "scanner": "scanner-primary", "fingerprint": "7faa7225da4cd167", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/applications/runtime_hooks.py:66"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2a060fe7adb6d90", "level": "note", "message": {"text": "Possibly dead Python function: run_future"}, "properties": {"repobilityId": "16a8d5fc6e92147a", "scanner": "scanner-primary", "fingerprint": "f2a060fe7adb6d90", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/applications/runtime_hooks.py:99"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f4871c195f42ab53", "level": "note", "message": {"text": "Possibly dead Python function: register_coroutine"}, "properties": {"repobilityId": "7c6809b526c8b5aa", "scanner": "scanner-primary", "fingerprint": "f4871c195f42ab53", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/applications/runtime_hooks.py:131"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9b34e0de35c347b5", "level": "note", "message": {"text": "Possibly dead Python function: coroutine_to_future"}, "properties": {"repobilityId": "47ac93af6308bec5", "scanner": "scanner-primary", "fingerprint": "9b34e0de35c347b5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tensorlake/applications/runtime_hooks.py:160"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe137134f0f2cf91", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 typescript/src/http.ts:69"}, "properties": {"repobilityId": "8806de70e26f2251", "scanner": "scanner-primary", "fingerprint": "fe137134f0f2cf91", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-48cee5e1ac33fcb5", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in README.md:183"}, "properties": {"repobilityId": "e44bf8409cbb7354", "scanner": "scanner-primary", "fingerprint": "48cee5e1ac33fcb5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "README.md"}, "region": {"startLine": 183}}}]}, {"ruleId": "scanner-9529da46d4b37223", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in typescript/scripts/prepare-package.mjs:4"}, "properties": {"repobilityId": "ff9263075a6e1667", "scanner": "scanner-primary", "fingerprint": "9529da46d4b37223", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "typescript/scripts/prepare-package.mjs"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-aa3550e09c1baa12", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in typescript/scripts/build-native.mjs:4"}, "properties": {"repobilityId": "61437c68cbefa253", "scanner": "scanner-primary", "fingerprint": "aa3550e09c1baa12", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "typescript/scripts/build-native.mjs"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-e243aafc7495894b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in typescript/lib/runtime.cjs:5"}, "properties": {"repobilityId": "26e9e6f1e2c2f54c", "scanner": "scanner-primary", "fingerprint": "e243aafc7495894b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "typescript/lib/runtime.cjs"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-c0b5f8c7c531473a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/workflows/publish_npm.yaml:137"}, "properties": {"repobilityId": "85e96eb0565bf171", "scanner": "scanner-primary", "fingerprint": "c0b5f8c7c531473a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 137}}}]}, {"ruleId": "scanner-872530877ea92048", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "d88880fbf186c8dc", "scanner": "scanner-primary", "fingerprint": "872530877ea92048", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_crates_io.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d2d2541c24d8c18e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b6b2580df58de061", "scanner": "scanner-primary", "fingerprint": "d2d2541c24d8c18e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_test_pypi.yaml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-d2d2541c24d8c18e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "58ff486f7c6773dd", "scanner": "scanner-primary", "fingerprint": "d2d2541c24d8c18e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_test_pypi.yaml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-d2d2541c24d8c18e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "48807d90806dfb3e", "scanner": "scanner-primary", "fingerprint": "d2d2541c24d8c18e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_test_pypi.yaml"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-d2d2541c24d8c18e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a76dce948d25822e", "scanner": "scanner-primary", "fingerprint": "d2d2541c24d8c18e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_test_pypi.yaml"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-d2d2541c24d8c18e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f8ee439f739ceccf", "scanner": "scanner-primary", "fingerprint": "d2d2541c24d8c18e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_test_pypi.yaml"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-d2d2541c24d8c18e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b6b2580df58de061", "scanner": "scanner-primary", "fingerprint": "d2d2541c24d8c18e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_test_pypi.yaml"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-d2d2541c24d8c18e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b6b2580df58de061", "scanner": "scanner-primary", "fingerprint": "d2d2541c24d8c18e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_test_pypi.yaml"}, "region": {"startLine": 121}}}]}, {"ruleId": "scanner-d2d2541c24d8c18e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "58ff486f7c6773dd", "scanner": "scanner-primary", "fingerprint": "d2d2541c24d8c18e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_test_pypi.yaml"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-d2d2541c24d8c18e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aae5084af7c371cb", "scanner": "scanner-primary", "fingerprint": "d2d2541c24d8c18e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_test_pypi.yaml"}, "region": {"startLine": 154}}}]}, {"ruleId": "scanner-d2d2541c24d8c18e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ca07ef3fc512d7a3", "scanner": "scanner-primary", "fingerprint": "d2d2541c24d8c18e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_test_pypi.yaml"}, "region": {"startLine": 161}}}]}, {"ruleId": "scanner-45a8c477f90798a2", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "913f74addaec4921", "scanner": "scanner-primary", "fingerprint": "45a8c477f90798a2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_test_pypi.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "841514cd051c1189", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0fb41bf6de4bd276", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "841514cd051c1189", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8596518e0bac9200", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "800fc1092bfa8814", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b3e1f6f961b204cf", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0fb41bf6de4bd276", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 159}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "841514cd051c1189", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 211}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8596518e0bac9200", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 218}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "800fc1092bfa8814", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 222}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b3e1f6f961b204cf", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 225}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0fb41bf6de4bd276", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 266}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ee0cc46075d76816", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 288}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4f9037eb4069e55", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 298}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4f9037eb4069e55", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 304}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4f9037eb4069e55", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 310}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4f9037eb4069e55", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 316}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4f9037eb4069e55", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 322}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4f9037eb4069e55", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 328}}}]}, {"ruleId": "scanner-04283973288870ad", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4f9037eb4069e55", "scanner": "scanner-primary", "fingerprint": "04283973288870ad", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 334}}}]}, {"ruleId": "scanner-73d609d65d683f45", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "9122cd24fd5db6b4", "scanner": "scanner-primary", "fingerprint": "73d609d65d683f45", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_npm.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b1c64b92fa205ebd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "54720be9c7af6b75", "scanner": "scanner-primary", "fingerprint": "b1c64b92fa205ebd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sandbox_local_tests.yaml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-b1c64b92fa205ebd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5f6fef07557d7199", "scanner": "scanner-primary", "fingerprint": "b1c64b92fa205ebd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sandbox_local_tests.yaml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-b1c64b92fa205ebd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "85642d03a430b707", "scanner": "scanner-primary", "fingerprint": "b1c64b92fa205ebd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sandbox_local_tests.yaml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-b1c64b92fa205ebd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d89bde8e0d0e96ea", "scanner": "scanner-primary", "fingerprint": "b1c64b92fa205ebd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sandbox_local_tests.yaml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-b1c64b92fa205ebd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "78e0e8172d3de6ad", "scanner": "scanner-primary", "fingerprint": "b1c64b92fa205ebd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sandbox_local_tests.yaml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-b1c64b92fa205ebd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "656b2ca65c536081", "scanner": "scanner-primary", "fingerprint": "b1c64b92fa205ebd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sandbox_local_tests.yaml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-b1c64b92fa205ebd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "02bc8180261e8e26", "scanner": "scanner-primary", "fingerprint": "b1c64b92fa205ebd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sandbox_local_tests.yaml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-b1c64b92fa205ebd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3effd4f7951017b2", "scanner": "scanner-primary", "fingerprint": "b1c64b92fa205ebd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sandbox_local_tests.yaml"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-b1c64b92fa205ebd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3effd4f7951017b2", "scanner": "scanner-primary", "fingerprint": "b1c64b92fa205ebd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sandbox_local_tests.yaml"}, "region": {"startLine": 177}}}]}, {"ruleId": "scanner-abe7359acf7ffba2", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "41bc0280881f5988", "scanner": "scanner-primary", "fingerprint": "abe7359acf7ffba2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sandbox_local_tests.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c91f8fa4ff93214f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "40b717ffeb631461", "scanner": "scanner-primary", "fingerprint": "c91f8fa4ff93214f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_cli.yaml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-c91f8fa4ff93214f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d0ff02cbbd081449", "scanner": "scanner-primary", "fingerprint": "c91f8fa4ff93214f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_cli.yaml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-c91f8fa4ff93214f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d8e96bf2413c92f", "scanner": "scanner-primary", "fingerprint": "c91f8fa4ff93214f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_cli.yaml"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-c91f8fa4ff93214f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "56ee09e0735b1fb7", "scanner": "scanner-primary", "fingerprint": "c91f8fa4ff93214f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_cli.yaml"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-42e1c37b6b4392b2", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a4def43e4db872ec", "scanner": "scanner-primary", "fingerprint": "42e1c37b6b4392b2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_cli.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-236e7285a745260e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "26503e0738b88f19", "scanner": "scanner-primary", "fingerprint": "236e7285a745260e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/typescript_sdk.yaml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-236e7285a745260e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9cedbf5c9c80efa7", "scanner": "scanner-primary", "fingerprint": "236e7285a745260e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/typescript_sdk.yaml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-236e7285a745260e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e30fad2346024b07", "scanner": "scanner-primary", "fingerprint": "236e7285a745260e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/typescript_sdk.yaml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-236e7285a745260e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "492b7da2fef91a30", "scanner": "scanner-primary", "fingerprint": "236e7285a745260e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/typescript_sdk.yaml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-236e7285a745260e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "26503e0738b88f19", "scanner": "scanner-primary", "fingerprint": "236e7285a745260e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/typescript_sdk.yaml"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-236e7285a745260e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9cedbf5c9c80efa7", "scanner": "scanner-primary", "fingerprint": "236e7285a745260e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/typescript_sdk.yaml"}, "region": {"startLine": 132}}}]}, {"ruleId": "scanner-236e7285a745260e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "492b7da2fef91a30", "scanner": "scanner-primary", "fingerprint": "236e7285a745260e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/typescript_sdk.yaml"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2551661978d1378", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "12d1c7b8f15a26ae", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b4d85909fd30ef14", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2551661978d1378", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "12d1c7b8f15a26ae", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "22a8aab9d8f496f9", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "22a8aab9d8f496f9", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2551661978d1378", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "12d1c7b8f15a26ae", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b4d85909fd30ef14", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6747967ce50b0c37", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6b23f572ce22ab20", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "315b1214f9a85388", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "17bc6e7122e68e04", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 155}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "78ebf36eb58798f7", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "78ebf36eb58798f7", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 188}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2551661978d1378", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 234}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "12d1c7b8f15a26ae", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 240}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b4d85909fd30ef14", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-c3aec96b92b2671b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6747967ce50b0c37", "scanner": "scanner-primary", "fingerprint": "c3aec96b92b2671b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 249}}}]}, {"ruleId": "scanner-0697d58a797e11c2", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "bb5efe58544a4253", "scanner": "scanner-primary", "fingerprint": "0697d58a797e11c2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/tests.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9e60ac367d2d5d7e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c96c58d0cec726cf", "scanner": "scanner-primary", "fingerprint": "9e60ac367d2d5d7e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/integration_test.yaml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-9e60ac367d2d5d7e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "42055e23d55b27b7", "scanner": "scanner-primary", "fingerprint": "9e60ac367d2d5d7e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/integration_test.yaml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-9e60ac367d2d5d7e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8aa3da91ad4b6171", "scanner": "scanner-primary", "fingerprint": "9e60ac367d2d5d7e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/integration_test.yaml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-68e2ccbf8d8ff246", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "d791326e7fe35eaf", "scanner": "scanner-primary", "fingerprint": "68e2ccbf8d8ff246", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/integration_test.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-26d5f42189512f15", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "86dad89d079631f9", "scanner": "scanner-primary", "fingerprint": "26d5f42189512f15", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/document_ai.yaml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-26d5f42189512f15", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "63bf48ba9f6ffefd", "scanner": "scanner-primary", "fingerprint": "26d5f42189512f15", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/document_ai.yaml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-26d5f42189512f15", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "216656561af5a903", "scanner": "scanner-primary", "fingerprint": "26d5f42189512f15", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/document_ai.yaml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-26d5f42189512f15", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "68e3584bebfb250c", "scanner": "scanner-primary", "fingerprint": "26d5f42189512f15", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/document_ai.yaml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-26d5f42189512f15", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "86dad89d079631f9", "scanner": "scanner-primary", "fingerprint": "26d5f42189512f15", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/document_ai.yaml"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-26d5f42189512f15", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "63bf48ba9f6ffefd", "scanner": "scanner-primary", "fingerprint": "26d5f42189512f15", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/document_ai.yaml"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-26d5f42189512f15", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "216656561af5a903", "scanner": "scanner-primary", "fingerprint": "26d5f42189512f15", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/document_ai.yaml"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-26d5f42189512f15", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "68e3584bebfb250c", "scanner": "scanner-primary", "fingerprint": "26d5f42189512f15", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/document_ai.yaml"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-d221445fb7ecfb9b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a2a5baf1e3414ce", "scanner": "scanner-primary", "fingerprint": "d221445fb7ecfb9b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_pypi.yaml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-d221445fb7ecfb9b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "61d703fde640748a", "scanner": "scanner-primary", "fingerprint": "d221445fb7ecfb9b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_pypi.yaml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-d221445fb7ecfb9b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2e54f8066827699", "scanner": "scanner-primary", "fingerprint": "d221445fb7ecfb9b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_pypi.yaml"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-d221445fb7ecfb9b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2713edbebf7f7eba", "scanner": "scanner-primary", "fingerprint": "d221445fb7ecfb9b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_pypi.yaml"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-d221445fb7ecfb9b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "668bcef31b66ffdf", "scanner": "scanner-primary", "fingerprint": "d221445fb7ecfb9b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_pypi.yaml"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-d221445fb7ecfb9b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a2a5baf1e3414ce", "scanner": "scanner-primary", "fingerprint": "d221445fb7ecfb9b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_pypi.yaml"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-d221445fb7ecfb9b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a2a5baf1e3414ce", "scanner": "scanner-primary", "fingerprint": "d221445fb7ecfb9b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_pypi.yaml"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-d221445fb7ecfb9b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "61d703fde640748a", "scanner": "scanner-primary", "fingerprint": "d221445fb7ecfb9b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_pypi.yaml"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-d221445fb7ecfb9b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7ac3671935a3c161", "scanner": "scanner-primary", "fingerprint": "d221445fb7ecfb9b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_pypi.yaml"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-d221445fb7ecfb9b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b67d84dc98ae41f8", "scanner": "scanner-primary", "fingerprint": "d221445fb7ecfb9b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_pypi.yaml"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-2f9dbf560027db6b", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "939aaf903aa58752", "scanner": "scanner-primary", "fingerprint": "2f9dbf560027db6b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish_pypi.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-90653a617f236f1c", "level": "note", "message": {"text": "Very large file: tests/function_executor/test_run_allocation.py (1183 lines)"}, "properties": {"repobilityId": "27828bd2aa29f31a", "scanner": "scanner-primary", "fingerprint": "90653a617f236f1c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-201e1be6ea31b884", "level": "note", "message": {"text": "Very large file: tests/function_executor/test_replay.py (1504 lines)"}, "properties": {"repobilityId": "68fa7d8246631e07", "scanner": "scanner-primary", "fingerprint": "201e1be6ea31b884", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b94f179a174dec31", "level": "note", "message": {"text": "Very large file: crates/rust-cloud-sdk-py/src/lib.rs (3053 lines)"}, "properties": {"repobilityId": "bc2812b15736b48b", "scanner": "scanner-primary", "fingerprint": "b94f179a174dec31", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-501a2023238a971c", "level": "note", "message": {"text": "Very large file: crates/cli/src/main.rs (2169 lines)"}, "properties": {"repobilityId": "db408a211044c33c", "scanner": "scanner-primary", "fingerprint": "501a2023238a971c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1821587b754bf82a", "level": "note", "message": {"text": "Very large file: crates/cloud-sdk/src/sandbox_images.rs (3190 lines)"}, "properties": {"repobilityId": "b03a5f814cc4525e", "scanner": "scanner-primary", "fingerprint": "1821587b754bf82a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7d7eea7ccc0a853e", "level": "note", "message": {"text": "Very large file: crates/cloud-sdk/src/sandboxes/desktop.rs (1605 lines)"}, "properties": {"repobilityId": "90a0ff04ad45d5ee", "scanner": "scanner-primary", "fingerprint": "7d7eea7ccc0a853e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-108526574d095161", "level": "note", "message": {"text": "Very large file: crates/cloud-sdk/src/applications/models.rs (1705 lines)"}, "properties": {"repobilityId": "86a8816c1725f27c", "scanner": "scanner-primary", "fingerprint": "108526574d095161", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e7b8938fac346539", "level": "note", "message": {"text": "Very large file: src/tensorlake/sandbox/client.py (1438 lines)"}, "properties": {"repobilityId": "1eeb82b445470510", "scanner": "scanner-primary", "fingerprint": "e7b8938fac346539", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8e0dc99c2d791f12", "level": "note", "message": {"text": "Very large file: src/tensorlake/sandbox/sandbox.py (1372 lines)"}, "properties": {"repobilityId": "4b5adf69a0936f5c", "scanner": "scanner-primary", "fingerprint": "8e0dc99c2d791f12", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1ede54638b38ce20", "level": "note", "message": {"text": "Very large file: src/tensorlake/applications/local/runner.py (1289 lines)"}, "properties": {"repobilityId": "5654ace3e3a4619d", "scanner": "scanner-primary", "fingerprint": "1ede54638b38ce20", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "79c1504ac618d3b8", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "bb515a047474afd7", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "89ab59f506110f40", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "58d3c02eb41b43ad", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-f486b5c4c922fbb2", "level": "note", "message": {"text": "Legacy-named symbol `test_parse_accepts_files_from_files_v2` in tests/document_ai/test_parse.py:410"}, "properties": {"repobilityId": "9f743a821f1b0f3f", "scanner": "scanner-primary", "fingerprint": "f486b5c4c922fbb2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bad668930ce79606", "level": "note", "message": {"text": "Legacy-named symbol `test_dataset_accepts_files_from_files_v2` in tests/document_ai/test_datasets.py:297"}, "properties": {"repobilityId": "5b0d65d823e4993b", "scanner": "scanner-primary", "fingerprint": "bad668930ce79606", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-969e7925df2f8fd8", "level": "none", "message": {"text": "Commented-code block (9 lines) in tests/applications/test_output_propagation.py:18"}, "properties": {"repobilityId": "003d664133b8a359", "scanner": "scanner-primary", "fingerprint": "969e7925df2f8fd8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c42dbb3148ee25fe", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/applications/test_application_manifest.py:310"}, "properties": {"repobilityId": "3237c097c7af6ffe", "scanner": "scanner-primary", "fingerprint": "c42dbb3148ee25fe", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e38932596292e73c", "level": "note", "message": {"text": "Legacy-named symbol `request_v1` in tests/applications/app_update/test_app_update.py:61"}, "properties": {"repobilityId": "aff88aa593cc053b", "scanner": "scanner-primary", "fingerprint": "e38932596292e73c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3256ab32c3a103cd", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/function_executor/test_replay_sequential_workflow.py:301"}, "properties": {"repobilityId": "d712e69c3e963751", "scanner": "scanner-primary", "fingerprint": "3256ab32c3a103cd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7d24f8964ef6a1ca", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/function_executor/test_replay.py:66"}, "properties": {"repobilityId": "c7a5d57e9eb7794b", "scanner": "scanner-primary", "fingerprint": "7d24f8964ef6a1ca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f5394c103ce32fad", "level": "none", "message": {"text": "Commented-code block (5 lines) in typescript/src/sandbox-image.ts:115"}, "properties": {"repobilityId": "c4994339573b5836", "scanner": "scanner-primary", "fingerprint": "f5394c103ce32fad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a18134eea2d8cccb", "level": "none", "message": {"text": "Commented-code block (8 lines) in typescript/src/sandbox.ts:1062"}, "properties": {"repobilityId": "d8aee2e25ba903ac", "scanner": "scanner-primary", "fingerprint": "a18134eea2d8cccb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d238b4592801f6a2", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 .github/scripts/verify_wheel.py:45"}, "properties": {"repobilityId": "18324fa7c27c8625", "scanner": "scanner-primary", "fingerprint": "d238b4592801f6a2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9fa9465327ba529e", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/tensorlake/image/utils.py:35"}, "properties": {"repobilityId": "9bb570e4bb8fb7c8", "scanner": "scanner-primary", "fingerprint": "9fa9465327ba529e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-46d1144f79a952ae", "level": "note", "message": {"text": "Stub function `_noop_emit` (body is just `pass`/`return`) \u2014 src/tensorlake/image/sandbox_builder.py:58"}, "properties": {"repobilityId": "88a2a1d3a9a22b0a", "scanner": "scanner-primary", "fingerprint": "46d1144f79a952ae", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-716d166730d67590", "level": "note", "message": {"text": "Stub function `api_key_id` (body is just `pass`/`return`) \u2014 src/tensorlake/cli/_common.py:65"}, "properties": {"repobilityId": "31a3a1254399a1cd", "scanner": "scanner-primary", "fingerprint": "716d166730d67590", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-acd223c2b1a38927", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/tensorlake/applications/user_data_serializer.py:21"}, "properties": {"repobilityId": "b1972a6218bc981e", "scanner": "scanner-primary", "fingerprint": "acd223c2b1a38927", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c1ea67e137b31449", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in src/tensorlake/applications/blob_store/blob_store.py:226"}, "properties": {"repobilityId": "490b554a808daf0c", "scanner": "scanner-primary", "fingerprint": "c1ea67e137b31449", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-458dfdf4ab617195", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/tensorlake/applications/interface/retries.py:18"}, "properties": {"repobilityId": "19fb906a48ed7f0b", "scanner": "scanner-primary", "fingerprint": "458dfdf4ab617195", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-89459c0e4e65e8a4", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/tensorlake/applications/interface/function.py:67"}, "properties": {"repobilityId": "447a063becdc6e5b", "scanner": "scanner-primary", "fingerprint": "89459c0e4e65e8a4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2a7e9edbaa16a466", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/tensorlake/applications/remote/manifests/function_manifests.py:42"}, "properties": {"repobilityId": "c4b23dd1a6809dc8", "scanner": "scanner-primary", "fingerprint": "2a7e9edbaa16a466", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e035f80f7cca0ec6", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/tensorlake/applications/remote/manifests/application.py:55"}, "properties": {"repobilityId": "af15efd871d6dd99", "scanner": "scanner-primary", "fingerprint": "e035f80f7cca0ec6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-45f3d76567fe70db", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in src/tensorlake/applications/local/value_store.py:39"}, "properties": {"repobilityId": "962861f6cdfd4f3a", "scanner": "scanner-primary", "fingerprint": "45f3d76567fe70db", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bb38b02816e63fca", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in src/tensorlake/applications/local/runner.py:831"}, "properties": {"repobilityId": "bc63bfdd24caaa6e", "scanner": "scanner-primary", "fingerprint": "bb38b02816e63fca", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-48a150cf47c0f015", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/tensorlake/applications/local/runner.py:992"}, "properties": {"repobilityId": "e9b9f36cfc0c0dad", "scanner": "scanner-primary", "fingerprint": "48a150cf47c0f015", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7a4a28804a055807", "level": "note", "message": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 src/tensorlake/applications/request_context/http_server/router.py:94"}, "properties": {"repobilityId": "159ac3f1e4fdecd9", "scanner": "scanner-primary", "fingerprint": "7a4a28804a055807", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-fec5cabd9fab0777", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/tensorlake/applications/validation/validate.py:176"}, "properties": {"repobilityId": "393903fca9fac91c", "scanner": "scanner-primary", "fingerprint": "fec5cabd9fab0777", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aa5fc25fa5fda833", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/tensorlake/applications/metadata/serialization.py:13"}, "properties": {"repobilityId": "65b36d27b26f4e05", "scanner": "scanner-primary", "fingerprint": "aa5fc25fa5fda833", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ab8303b0be40d890", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/tensorlake/function_executor/health_check.py:22"}, "properties": {"repobilityId": "903aa12f026e7f58", "scanner": "scanner-primary", "fingerprint": "ab8303b0be40d890", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c001ebb4376d9ee", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/tensorlake/function_executor/health_check.py:36"}, "properties": {"repobilityId": "c44655538433b3e6", "scanner": "scanner-primary", "fingerprint": "2c001ebb4376d9ee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-de93a48ef9d938d3", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/tensorlake/function_executor/proto/server_configuration.py:7"}, "properties": {"repobilityId": "790d4f4b64682a0a", "scanner": "scanner-primary", "fingerprint": "de93a48ef9d938d3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-89429f007ab7aee5", "level": "none", "message": {"text": "Commented-code block (19 lines) in src/tensorlake/function_executor/allocation_runner/strict_mode_replayer.py:168"}, "properties": {"repobilityId": "9243654cb304302d", "scanner": "scanner-primary", "fingerprint": "89429f007ab7aee5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2f23d5abb026f749", "level": "note", "message": {"text": "Legacy-named symbol `allocation_state_copy` in src/tensorlake/function_executor/allocation_runner/allocation_state_wrapper.py:98"}, "properties": {"repobilityId": "4b368b545a8be358", "scanner": "scanner-primary", "fingerprint": "2f23d5abb026f749", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-924a1567c5961380", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/tensorlake/function_executor/allocation_runner/event_loop/event_loop.py:121"}, "properties": {"repobilityId": "9ac098dece353f71", "scanner": "scanner-primary", "fingerprint": "924a1567c5961380", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-65df07ab4020db79", "level": "note", "message": {"text": "18 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5e334d56f52c02e1", "scanner": "scanner-primary", "fingerprint": "65df07ab4020db79", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f79313f8fabbc318", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-76a2f6818267a9a8", "level": "note", "message": {"text": "Near-duplicate function bodies in 8 places"}, "properties": {"repobilityId": "71a2b4c0acba1c11", "scanner": "scanner-primary", "fingerprint": "76a2f6818267a9a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "212b973d75ad5fc5", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "50ba5c99b0ffdcc6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6a417d729c3db002", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-76a2f6818267a9a8", "level": "note", "message": {"text": "Near-duplicate function bodies in 8 places"}, "properties": {"repobilityId": "1f9c508b49c0a533", "scanner": "scanner-primary", "fingerprint": "76a2f6818267a9a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8dd2e3410615d12f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4fc093a74ddfbf7f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-ecd86354d3c142ad", "level": "note", "message": {"text": "Near-duplicate function bodies in 20 places"}, "properties": {"repobilityId": "d7ad8a79621a54c7", "scanner": "scanner-primary", "fingerprint": "ecd86354d3c142ad", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d402d999358d37e3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5e852fd16b9a0603", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "509398b6634d3a81", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-76a2f6818267a9a8", "level": "note", "message": {"text": "Near-duplicate function bodies in 8 places"}, "properties": {"repobilityId": "9b9232dbd7aa2c7d", "scanner": "scanner-primary", "fingerprint": "76a2f6818267a9a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-76a2f6818267a9a8", "level": "note", "message": {"text": "Near-duplicate function bodies in 8 places"}, "properties": {"repobilityId": "85a1525032446463", "scanner": "scanner-primary", "fingerprint": "76a2f6818267a9a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2bde15680b614b08", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "9b2b85e02ea5e57b", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "64b5908739d63078", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ddbeddfb68b2d68b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "71fc9b4c1dc56b6e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c757ac9b722bf508", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}