{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-54037e52c58e02e3", "name": "Possibly dead Python function: async_subgraph_wrapper", "shortDescription": {"text": "Possibly dead Python function: async_subgraph_wrapper"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c1b42d20e955f50", "name": "Possibly dead Python function: sync_subgraph_wrapper", "shortDescription": {"text": "Possibly dead Python function: sync_subgraph_wrapper"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ada07d8a48084e06", "name": "Possibly dead Python function: patched_compile", "shortDescription": {"text": "Possibly dead Python function: patched_compile"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88db4624ca4e2009", "name": "Possibly dead Python function: wrapped_async_invoke", "shortDescription": {"text": "Possibly dead Python function: wrapped_async_invoke"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5ab97093dcec07e", "name": "Possibly dead Python function: wrapped_sync_invoke", "shortDescription": {"text": "Possibly dead Python function: wrapped_sync_invoke"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a39ee4bf6de8d0bc", "name": "Possibly dead Python function: patched_call_tool", "shortDescription": {"text": "Possibly dead Python function: patched_call_tool"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2c2a72fed515bcb", "name": "Possibly dead Python function: add_PolicyServiceServicer_to_server", "shortDescription": {"text": "Possibly dead Python function: add_PolicyServiceServicer_to_server"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f61410726f1d539c", "name": "Possibly dead Python function: check_policy_compliance", "shortDescription": {"text": "Possibly dead Python function: check_policy_compliance"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfeaafa29f005b44", "name": "Privileged port 19 in use", "shortDescription": {"text": "Privileged port 19 in use"}, "fullDescription": {"text": "Port 19 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d8dbd869aacd26bd", "name": "Privileged port 33 in use", "shortDescription": {"text": "Privileged port 33 in use"}, "fullDescription": {"text": "Port 33 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f560f1b73dbbf435", "name": "Insecure pattern 'direct_innerhtml_assignment' in docs/_overrides/main.html:100", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/_overrides/main.html:100"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b58d5b18b1188c74", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "PyO3/maturin-action@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a32c66ab4b95f79f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2cdb56e803560cf2", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "Chisanan232/GitHub-Action_Reusable_Workflows-Python/.github/workflows/rw_uv_run_test.yaml@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7ffa864aa80e13f8", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00ba477b762d4ce6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f55c708ac3363b20", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e8c2ddd13addf33", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04f7e36b286d8bf9", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc9e13fa01dd7236", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed4d52ce58fc0096", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "Chisanan232/GitHub-Action_Reusable_Workflows-Python/.github/workflows/rw_upload_test_cov_report.yaml@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aa093c1cb01bf7a5", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/download-artifact@v8 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-219c40ab3a2fc560", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "astral-sh/setup-uv@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 15 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 13 placeholder/mock markers across 5 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-499dbfdaed097a92", "name": "Agent authority lacks a verifier contract: .claude/skills/sdk-only-release/REFERENCE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/sdk-only-release/REFERENCE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e057c23b12300ba", "name": "Commented-code block (5 lines) in scripts/gen_proto.py:65", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/gen_proto.py:65"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2ac3c3dc44687444", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/gen_proto.py:61", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/gen_proto.py:61"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ede33617668da00", "name": "Network/subprocess call without timeout or try/except \u2014 agent_assembly/runtime.py:97", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 agent_assembly/runtime.py:97"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ebc5c715f2abc8e", "name": "Stub function `_noop_shutdown` (body is just `pass`/`return`) \u2014 agent_assembly/core/assembly.py:303", "shortDescription": {"text": "Stub function `_noop_shutdown` (body is just `pass`/`return`) \u2014 agent_assembly/core/assembly.py:303"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nagent_assembly/adapters/base.py:register_hooks, agent_assembly/adapters/base.py:register\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe1d9311d6aee734", "name": "Near-duplicate function bodies in 12 places", "shortDescription": {"text": "Near-duplicate function bodies in 12 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nagent_assembly/adapters/google_adk/adapter.py:process_agent_id, agent_assembly/adapters/google_adk/adapter.py:process_agent_id, agent_assembly/adapters/pydantic_ai/adapter.py:process_agent_id, agent_assembly/adapters/pydantic_ai/adapter.py:process_agent_id\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33a6b62e30ce7ab4", "name": "Near-duplicate function bodies in 6 places", "shortDescription": {"text": "Near-duplicate function bodies in 6 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nagent_assembly/adapters/google_adk/adapter.py:unregister_hooks, agent_assembly/adapters/crewai/adapter.py:unregister_hooks, agent_assembly/adapters/pydantic_ai/adapter.py:unregister_hooks, agent_assembly/adapters/openai_agents/adapter.py:unregister_hooks\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nagent_assembly/adapters/google_adk/patch.py:set_process_agent_id, agent_assembly/adapters/pydantic_ai/patch.py:set_process_agent_id, agent_assembly/adapters/openai_agents/patch.py:set_process_agent_id, agent_assembly/adapters/mcp/patch.py:set_process_agent_id\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nagent_assembly/adapters/pydantic_ai/patch.py:patched_run, agent_assembly/adapters/pydantic_ai/patch.py:patched_run_sync, agent_assembly/adapters/pydantic_ai/patch.py:patched_run\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23976"}, "properties": {"repository": "ai-agent-assembly/python-sdk", "repoUrl": "https://github.com/ai-agent-assembly/python-sdk", "branch": "main"}, "results": [{"ruleId": "scanner-54037e52c58e02e3", "level": "note", "message": {"text": "Possibly dead Python function: async_subgraph_wrapper"}, "properties": {"repobilityId": "bf4e4d35acf2ce46", "scanner": "scanner-primary", "fingerprint": "54037e52c58e02e3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_assembly/adapters/langgraph/patch.py:285"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0c1b42d20e955f50", "level": "note", "message": {"text": "Possibly dead Python function: sync_subgraph_wrapper"}, "properties": {"repobilityId": "781d07cb3097f04c", "scanner": "scanner-primary", "fingerprint": "0c1b42d20e955f50", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_assembly/adapters/langgraph/patch.py:298"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ada07d8a48084e06", "level": "note", "message": {"text": "Possibly dead Python function: patched_compile"}, "properties": {"repobilityId": "562de5ffedad263e", "scanner": "scanner-primary", "fingerprint": "ada07d8a48084e06", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_assembly/adapters/langgraph/patch.py:398"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-88db4624ca4e2009", "level": "note", "message": {"text": "Possibly dead Python function: wrapped_async_invoke"}, "properties": {"repobilityId": "92783c533f281cbf", "scanner": "scanner-primary", "fingerprint": "88db4624ca4e2009", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_assembly/adapters/langgraph/patch.py:432"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5ab97093dcec07e", "level": "note", "message": {"text": "Possibly dead Python function: wrapped_sync_invoke"}, "properties": {"repobilityId": "26a32f7c3e93a380", "scanner": "scanner-primary", "fingerprint": "d5ab97093dcec07e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_assembly/adapters/langgraph/patch.py:449"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a39ee4bf6de8d0bc", "level": "note", "message": {"text": "Possibly dead Python function: patched_call_tool"}, "properties": {"repobilityId": "7a7382887301d006", "scanner": "scanner-primary", "fingerprint": "a39ee4bf6de8d0bc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_assembly/adapters/mcp/patch.py:248"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2c2a72fed515bcb", "level": "note", "message": {"text": "Possibly dead Python function: add_PolicyServiceServicer_to_server"}, "properties": {"repobilityId": "56131b52747d7d4f", "scanner": "scanner-primary", "fingerprint": "f2c2a72fed515bcb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_assembly/proto/policy_pb2_grpc.py:96"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f61410726f1d539c", "level": "note", "message": {"text": "Possibly dead Python function: check_policy_compliance"}, "properties": {"repobilityId": "e3ecb5b305d95924", "scanner": "scanner-primary", "fingerprint": "f61410726f1d539c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent_assembly/client/gateway.py:121"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bfeaafa29f005b44", "level": "warning", "message": {"text": "Privileged port 19 in use"}, "properties": {"repobilityId": "a6b5b06deac36eac", "scanner": "scanner-primary", "fingerprint": "bfeaafa29f005b44", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_includes_e2e_test.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d8dbd869aacd26bd", "level": "warning", "message": {"text": "Privileged port 33 in use"}, "properties": {"repobilityId": "f08e29b4b53f7301", "scanner": "scanner-primary", "fingerprint": "d8dbd869aacd26bd", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci_includes_e2e_test.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f560f1b73dbbf435", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/_overrides/main.html:100"}, "properties": {"repobilityId": "1fcb1fa334918d10", "scanner": "scanner-primary", "fingerprint": "f560f1b73dbbf435", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/_overrides/main.html"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-b58d5b18b1188c74", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2bcff570cf8c36f1", "scanner": "scanner-primary", "fingerprint": "b58d5b18b1188c74", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-python.yml"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-b58d5b18b1188c74", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0f602f9cf4427f1a", "scanner": "scanner-primary", "fingerprint": "b58d5b18b1188c74", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-python.yml"}, "region": {"startLine": 153}}}]}, {"ruleId": "scanner-b58d5b18b1188c74", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2bcff570cf8c36f1", "scanner": "scanner-primary", "fingerprint": "b58d5b18b1188c74", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-python.yml"}, "region": {"startLine": 194}}}]}, {"ruleId": "scanner-b58d5b18b1188c74", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0f602f9cf4427f1a", "scanner": "scanner-primary", "fingerprint": "b58d5b18b1188c74", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-python.yml"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-b58d5b18b1188c74", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2bcff570cf8c36f1", "scanner": "scanner-primary", "fingerprint": "b58d5b18b1188c74", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-python.yml"}, "region": {"startLine": 265}}}]}, {"ruleId": "scanner-b58d5b18b1188c74", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0f602f9cf4427f1a", "scanner": "scanner-primary", "fingerprint": "b58d5b18b1188c74", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-python.yml"}, "region": {"startLine": 290}}}]}, {"ruleId": "scanner-b58d5b18b1188c74", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2bcff570cf8c36f1", "scanner": "scanner-primary", "fingerprint": "b58d5b18b1188c74", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-python.yml"}, "region": {"startLine": 330}}}]}, {"ruleId": "scanner-b58d5b18b1188c74", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0f602f9cf4427f1a", "scanner": "scanner-primary", "fingerprint": "b58d5b18b1188c74", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-python.yml"}, "region": {"startLine": 336}}}]}, {"ruleId": "scanner-b58d5b18b1188c74", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2bcff570cf8c36f1", "scanner": "scanner-primary", "fingerprint": "b58d5b18b1188c74", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-python.yml"}, "region": {"startLine": 376}}}]}, {"ruleId": "scanner-b58d5b18b1188c74", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0f602f9cf4427f1a", "scanner": "scanner-primary", "fingerprint": "b58d5b18b1188c74", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-python.yml"}, "region": {"startLine": 382}}}]}, {"ruleId": "scanner-b58d5b18b1188c74", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "afdaeafcb52d676a", "scanner": "scanner-primary", "fingerprint": "b58d5b18b1188c74", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-python.yml"}, "region": {"startLine": 409}}}]}, {"ruleId": "scanner-b58d5b18b1188c74", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ee13d65d833f4bcc", "scanner": "scanner-primary", "fingerprint": "b58d5b18b1188c74", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-python.yml"}, "region": {"startLine": 415}}}]}, {"ruleId": "scanner-b58d5b18b1188c74", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0f602f9cf4427f1a", "scanner": "scanner-primary", "fingerprint": "b58d5b18b1188c74", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-python.yml"}, "region": {"startLine": 445}}}]}, {"ruleId": "scanner-a32c66ab4b95f79f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ffc6dd3da684bda3", "scanner": "scanner-primary", "fingerprint": "a32c66ab4b95f79f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-python.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2cdb56e803560cf2", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "b6b73b37fd024848", "scanner": "scanner-primary", "fingerprint": "2cdb56e803560cf2", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_build_and_test.yaml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-2cdb56e803560cf2", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "b6b73b37fd024848", "scanner": "scanner-primary", "fingerprint": "2cdb56e803560cf2", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_build_and_test.yaml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-2cdb56e803560cf2", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "b6b73b37fd024848", "scanner": "scanner-primary", "fingerprint": "2cdb56e803560cf2", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_build_and_test.yaml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-2cdb56e803560cf2", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "501ae0db1beb9a6f", "scanner": "scanner-primary", "fingerprint": "2cdb56e803560cf2", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_build_and_test.yaml"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-2cdb56e803560cf2", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "501ae0db1beb9a6f", "scanner": "scanner-primary", "fingerprint": "2cdb56e803560cf2", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_build_and_test.yaml"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-2cdb56e803560cf2", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "501ae0db1beb9a6f", "scanner": "scanner-primary", "fingerprint": "2cdb56e803560cf2", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_build_and_test.yaml"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-2cdb56e803560cf2", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "501ae0db1beb9a6f", "scanner": "scanner-primary", "fingerprint": "2cdb56e803560cf2", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_build_and_test.yaml"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-2cdb56e803560cf2", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "501ae0db1beb9a6f", "scanner": "scanner-primary", "fingerprint": "2cdb56e803560cf2", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_build_and_test.yaml"}, "region": {"startLine": 154}}}]}, {"ruleId": "scanner-7ffa864aa80e13f8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "52bff002dbf85459", "scanner": "scanner-primary", "fingerprint": "7ffa864aa80e13f8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/native-core-build.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-7ffa864aa80e13f8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "17c40e9d1750f1e5", "scanner": "scanner-primary", "fingerprint": "7ffa864aa80e13f8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/native-core-build.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-7ffa864aa80e13f8", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1c218d2ea98d02c8", "scanner": "scanner-primary", "fingerprint": "7ffa864aa80e13f8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/native-core-build.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-7ffa864aa80e13f8", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "935788e6038c873f", "scanner": "scanner-primary", "fingerprint": "7ffa864aa80e13f8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/native-core-build.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-00ba477b762d4ce6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "426093fd09c38384", "scanner": "scanner-primary", "fingerprint": "00ba477b762d4ce6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/documentation.yaml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-00ba477b762d4ce6", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8e5158feff081d32", "scanner": "scanner-primary", "fingerprint": "00ba477b762d4ce6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/documentation.yaml"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-00ba477b762d4ce6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "426093fd09c38384", "scanner": "scanner-primary", "fingerprint": "00ba477b762d4ce6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/documentation.yaml"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-00ba477b762d4ce6", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8e5158feff081d32", "scanner": "scanner-primary", "fingerprint": "00ba477b762d4ce6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/documentation.yaml"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-00ba477b762d4ce6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "426093fd09c38384", "scanner": "scanner-primary", "fingerprint": "00ba477b762d4ce6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/documentation.yaml"}, "region": {"startLine": 140}}}]}, {"ruleId": "scanner-00ba477b762d4ce6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "48c6ba55e15fd40a", "scanner": "scanner-primary", "fingerprint": "00ba477b762d4ce6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/documentation.yaml"}, "region": {"startLine": 150}}}]}, {"ruleId": "scanner-00ba477b762d4ce6", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8e5158feff081d32", "scanner": "scanner-primary", "fingerprint": "00ba477b762d4ce6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/documentation.yaml"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-f55c708ac3363b20", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "cdd7627057fdbcce", "scanner": "scanner-primary", "fingerprint": "f55c708ac3363b20", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/documentation.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e8c2ddd13addf33", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4bebc768b6f81e9f", "scanner": "scanner-primary", "fingerprint": "1e8c2ddd13addf33", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-backfill.yaml"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-1e8c2ddd13addf33", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b6905a3b7fa09a7f", "scanner": "scanner-primary", "fingerprint": "1e8c2ddd13addf33", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-backfill.yaml"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-04f7e36b286d8bf9", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "3a70fd9d5aa4936f", "scanner": "scanner-primary", "fingerprint": "04f7e36b286d8bf9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-backfill.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc9e13fa01dd7236", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e48c23ea203b36cc", "scanner": "scanner-primary", "fingerprint": "fc9e13fa01dd7236", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/type-check.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-fc9e13fa01dd7236", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6afe45c21aa39654", "scanner": "scanner-primary", "fingerprint": "fc9e13fa01dd7236", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/type-check.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-fc9e13fa01dd7236", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e48c23ea203b36cc", "scanner": "scanner-primary", "fingerprint": "fc9e13fa01dd7236", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/type-check.yml"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-fc9e13fa01dd7236", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6afe45c21aa39654", "scanner": "scanner-primary", "fingerprint": "fc9e13fa01dd7236", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/type-check.yml"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-ed4d52ce58fc0096", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "ec2fc29d65bb9166", "scanner": "scanner-primary", "fingerprint": "ed4d52ce58fc0096", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_run_all_test_and_record.yaml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-ed4d52ce58fc0096", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "ec2fc29d65bb9166", "scanner": "scanner-primary", "fingerprint": "ed4d52ce58fc0096", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_run_all_test_and_record.yaml"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-ed4d52ce58fc0096", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "ec2fc29d65bb9166", "scanner": "scanner-primary", "fingerprint": "ed4d52ce58fc0096", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_run_all_test_and_record.yaml"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-ed4d52ce58fc0096", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "ec2fc29d65bb9166", "scanner": "scanner-primary", "fingerprint": "ed4d52ce58fc0096", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_run_all_test_and_record.yaml"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-ed4d52ce58fc0096", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "ec2fc29d65bb9166", "scanner": "scanner-primary", "fingerprint": "ed4d52ce58fc0096", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_run_all_test_and_record.yaml"}, "region": {"startLine": 133}}}]}, {"ruleId": "scanner-aa093c1cb01bf7a5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "160b4d8d77806bbf", "scanner": "scanner-primary", "fingerprint": "aa093c1cb01bf7a5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_run_all_test_and_record.yaml"}, "region": {"startLine": 162}}}]}, {"ruleId": "scanner-aa093c1cb01bf7a5", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2b2a4413973eb830", "scanner": "scanner-primary", "fingerprint": "aa093c1cb01bf7a5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rw_run_all_test_and_record.yaml"}, "region": {"startLine": 177}}}]}, {"ruleId": "scanner-219c40ab3a2fc560", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5b707be032289921", "scanner": "scanner-primary", "fingerprint": "219c40ab3a2fc560", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmarks.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-219c40ab3a2fc560", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fe72fc5ecc24c338", "scanner": "scanner-primary", "fingerprint": "219c40ab3a2fc560", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmarks.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "f602a87c4444ff35", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "c174f4abcf3c9e00", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "21f035064ab7161b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-499dbfdaed097a92", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/sdk-only-release/REFERENCE.md"}, "properties": {"repobilityId": "75047d1736458f00", "scanner": "scanner-primary", "fingerprint": "499dbfdaed097a92", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/sdk-only-release/REFERENCE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4e057c23b12300ba", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/gen_proto.py:65"}, "properties": {"repobilityId": "877c696eb66eeb18", "scanner": "scanner-primary", "fingerprint": "4e057c23b12300ba", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2ac3c3dc44687444", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/gen_proto.py:61"}, "properties": {"repobilityId": "f24e57916627b503", "scanner": "scanner-primary", "fingerprint": "2ac3c3dc44687444", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7ede33617668da00", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 agent_assembly/runtime.py:97"}, "properties": {"repobilityId": "12dddfbb83549763", "scanner": "scanner-primary", "fingerprint": "7ede33617668da00", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8ebc5c715f2abc8e", "level": "note", "message": {"text": "Stub function `_noop_shutdown` (body is just `pass`/`return`) \u2014 agent_assembly/core/assembly.py:303"}, "properties": {"repobilityId": "176bfa2f4836be1b", "scanner": "scanner-primary", "fingerprint": "8ebc5c715f2abc8e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "dfed7a42da2c841b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-fe1d9311d6aee734", "level": "note", "message": {"text": "Near-duplicate function bodies in 12 places"}, "properties": {"repobilityId": "f49b0b703df4de53", "scanner": "scanner-primary", "fingerprint": "fe1d9311d6aee734", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-33a6b62e30ce7ab4", "level": "note", "message": {"text": "Near-duplicate function bodies in 6 places"}, "properties": {"repobilityId": "1cd457f56c8cc02f", "scanner": "scanner-primary", "fingerprint": "33a6b62e30ce7ab4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d852cd3eb609922e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "4fc56e48812ebb51", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "975c4c28baeb85ec", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "89e9798d4fdd8dd3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1bc864d3c6c22bad", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2a9401e5a01d059b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ab30891b3aad83ee", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2ed90bb3fac0cc3d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0ebc1f384c0709ea", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f318e26aab352d9e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "19a7efe445ef2f50", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5b3eb41ed899781a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "094f063ed4e52101", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fdb334d4dd57181c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "58e7a9e09d886e2c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f8f464175deb5c4b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}