Push this scan report to nektos/act

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Issue title

## Code-quality scan: `nektos/act`

**Score: 64/100 (B-)**  ·  150 findings  ·  scanned 2026-06-05 08:30 UTC  ·  34,321 LOC

| Severity | Count |
|---|---|
| CRITICAL | 1 |
| HIGH | 103 |
| MEDIUM | 20 |
| LOW | 16 |

📊 [Full filterable report](https://repobility.com/scan/aac9bb52-1a7d-4860-b0f2-e656ed715089/)  ·  ![scorecard](https://repobility.com/scan/aac9bb52-1a7d-4860-b0f2-e656ed715089/report.png?v=1780648239-s2)

### Top findings

1. **CRITICAL** `generic-api-key` — Detected a Generic API Key, potentially exposing access to various services and sensitive 
   `pkg/container/testdata/docker-pull-options/config.json:4`
2. **HIGH** `SEC093` — Go: exec.Command with non-literal
   `pkg/gh/gh.go:20`
3. **HIGH** `SEC093` — Go: exec.Command with non-literal
   `pkg/container/host_environment.go:301`
4. **HIGH** `SEC085` — JS: child_process.exec with non-literal
   `pkg/container/host_environment.go:285`
5. **HIGH** `SEC085` — JS: child_process.exec with non-literal
   `pkg/container/container_types.go:51`

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/aac9bb52-1a7d-4860-b0f2-e656ed715089/_