{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-ed74baa15844a34e", "name": "Possibly dead Python function: vendor_rows", "shortDescription": {"text": "Possibly dead Python function: vendor_rows"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41cd87a1e6dadedd", "name": "Possibly dead Python function: unavailable_source_rows", "shortDescription": {"text": "Possibly dead Python function: unavailable_source_rows"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-abdfe009724e2384", "name": "Possibly dead Python function: source_coverage_rows", "shortDescription": {"text": "Possibly dead Python function: source_coverage_rows"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-867e2e22c368fe5b", "name": "Possibly dead Python function: vendor_rows", "shortDescription": {"text": "Possibly dead Python function: vendor_rows"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ad5692985e430a2", "name": "Possibly dead Python function: unavailable_source_rows", "shortDescription": {"text": "Possibly dead Python function: unavailable_source_rows"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8c7303b3d3830ad", "name": "Possibly dead Python function: source_coverage_rows", "shortDescription": {"text": "Possibly dead Python function: source_coverage_rows"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3dca65e0b1ab2503", "name": "Possibly dead Python function: vendor_rows", "shortDescription": {"text": "Possibly dead Python function: vendor_rows"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35d6479589c62da5", "name": "Possibly dead Python function: unavailable_source_rows", "shortDescription": {"text": "Possibly dead Python function: unavailable_source_rows"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a28c482e4a0cd40b", "name": "Possibly dead Python function: source_coverage_rows", "shortDescription": {"text": "Possibly dead Python function: source_coverage_rows"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5efdc9447b04c64f", "name": "Possibly dead Python function: require_api_key", "shortDescription": {"text": "Possibly dead Python function: require_api_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dac8e49d4197d2a3", "name": "Possibly dead Python function: git_show", "shortDescription": {"text": "Possibly dead Python function: git_show"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25841e278575f2ce", "name": "Possibly dead Python function: sort_key", "shortDescription": {"text": "Possibly dead Python function: sort_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d7817e12dad6a29", "name": "Possibly dead Python function: git_show", "shortDescription": {"text": "Possibly dead Python function: git_show"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-000d25444f2ceff0", "name": "Possibly dead Python function: disabled_fetcher", "shortDescription": {"text": "Possibly dead Python function: disabled_fetcher"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f99cf556106c60e9", "name": "Possibly dead Python function: is_redirecting_source", "shortDescription": {"text": "Possibly dead Python function: is_redirecting_source"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c2799f92144a9fc", "name": "Possibly dead Python function: git_show", "shortDescription": {"text": "Possibly dead Python function: git_show"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4c47f7bbd5a4f81", "name": "Possibly dead Python function: sort_key", "shortDescription": {"text": "Possibly dead Python function: sort_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9a466a53683898e0", "name": "Possibly dead Python function: git_show", "shortDescription": {"text": "Possibly dead Python function: git_show"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-953e0d62c7d57905", "name": "Possibly dead Python function: sort_key", "shortDescription": {"text": "Possibly dead Python function: sort_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd30bbc59d60402e", "name": "Possibly dead Python function: revert_materialization", "shortDescription": {"text": "Possibly dead Python function: revert_materialization"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e1839e8c8331d19", "name": "Possibly dead Python function: select_command", "shortDescription": {"text": "Possibly dead Python function: select_command"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-097e953883ed282a", "name": "Possibly dead Python function: validate_command", "shortDescription": {"text": "Possibly dead Python function: validate_command"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1a57888eb09e4e2", "name": "Possibly dead Python function: unavailable_source_types_for_vendor", "shortDescription": {"text": "Possibly dead Python function: unavailable_source_types_for_vendor"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76284c679ad3ff85", "name": "Possibly dead Python function: select_command", "shortDescription": {"text": "Possibly dead Python function: select_command"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8590186ee088c260", "name": "Possibly dead Python function: sort_key", "shortDescription": {"text": "Possibly dead Python function: sort_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28a7f352277939fc", "name": "Privileged port 7 in use", "shortDescription": {"text": "Privileged port 7 in use"}, "fullDescription": {"text": "Port 7 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3aa0d33f8d6e4833", "name": "Privileged port 17 in use", "shortDescription": {"text": "Privileged port 17 in use"}, "fullDescription": {"text": "Port 17 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ad0e8250e693ae7", "name": "Privileged port 23 in use", "shortDescription": {"text": "Privileged port 23 in use"}, "fullDescription": {"text": "Port 23 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7cc2c9ce6db5c35c", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ad6a0208a17c5df", "name": "Dockerfile runs as root: services/openva_match_service/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: services/openva_match_service/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f9fcc4a62b1cd3a", "name": "Insecure pattern 'direct_innerhtml_assignment' in site/src/app.js:93", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in site/src/app.js:93"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95e34c9c5df0dfa0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-212f0dbc4a21a4b7", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bbf409d257b642b0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "softprops/action-gh-release@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06ab99a0068cc938", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c16aafc1febfc6df", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/download-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d8552a10bbd48aa", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09d94de5c1f3e19f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-692bd1833f3c263f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7fe2bce9538e531", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34e7b8aafb9c00d5", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "peter-evans/create-pull-request@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6dcb5c9f0aa29c20", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95d1cd2d24bd1681", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49d9bca7509462d5", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dad99732c09466c6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aaee0b260683b8f2", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f3725a8fcf08d0c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "peter-evans/create-pull-request@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0777e28e09b3aca8", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-668f583fccc3eb6b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cab1916e86d792d1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5733fba2de072f36", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f7c609cdffdc10f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v8 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fde138724462cc3b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d2c537f0534a8ba", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee81bea9071ccee6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3362ba15bc9515c2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-350ff91b510309d2", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-37c887c7838799a8", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa6f0614ef34bd66", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd588fb621543c45", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b47f6b3cb9437be", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63f45dada6045236", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b3165b5e9cb776b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/configure-pages@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d77a985b0965c5d2", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 202 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-227cb20b1b659621", "name": "Legacy-named symbol `test_pyproject_pins_mcp_below_v2` in tests/test_openva_mcp_metadata.py:63", "shortDescription": {"text": "Legacy-named symbol `test_pyproject_pins_mcp_below_v2` in tests/test_openva_mcp_metadata.py:63"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45e7462c29a06cab", "name": "`fetch()` without try/.catch or AbortSignal \u2014 site/src/app.js:121", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 site/src/app.js:121"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-50c59c2958fc12b8", "name": "Network/subprocess call without timeout or try/except \u2014 tools/openva/release_smoke.py:143", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/release_smoke.py:143"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02c507eb061c6923", "name": "Network/subprocess call without timeout or try/except \u2014 tools/openva/observation_automerge.py:58", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/observation_automerge.py:58"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35c527f0b2e7a73c", "name": "Network/subprocess call without timeout or try/except \u2014 tools/openva/machine_provisional_automerge.py:63", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/machine_provisional_automerge.py:63"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7587ad1d3a5f178c", "name": "Commented-code block (5 lines) in tools/openva/submission_verify.py:60", "shortDescription": {"text": "Commented-code block (5 lines) in tools/openva/submission_verify.py:60"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-80c3a9326fab1b7d", "name": "Network/subprocess call without timeout or try/except \u2014 tools/openva/quorum_promotion_automerge.py:59", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/quorum_promotion_automerge.py:59"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59a5c21c6c106319", "name": "Network/subprocess call without timeout or try/except \u2014 tools/openva/rollback_automerge.py:54", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/rollback_automerge.py:54"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2dde18de8374b724", "name": "Network/subprocess call without timeout or try/except \u2014 tools/openva/source_repair_automerge.py:59", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/source_repair_automerge.py:59"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9171fb7eb0aa6d83", "name": "Network/subprocess call without timeout or try/except \u2014 tools/openva/quarantine_automerge.py:57", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/quarantine_automerge.py:57"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0bb0de752bf3b8bc", "name": "Network/subprocess call without timeout or try/except \u2014 tools/openva/machine_provisional_controller.py:28", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/machine_provisional_controller.py:28"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad1f2c0971b89ce0", "name": "10 env vars used in code but missing from .env.example", "shortDescription": {"text": "10 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `GITHUB_EVENT_NAME`, `GITHUB_JOB`, `GITHUB_REF`, `GITHUB_REF_NAME`, `GITHUB_REF_TYPE`, `GITHUB_REPOSITORY`, `GITHUB_RUN_ATTEMPT`, `GITHUB_RUN_ID` + 2 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nintegrations/mcp/openva_mcp/openva_mcp/snapshot.py:read_bytes, integrations/mcp/openva_mcp/openva_mcp/snapshot.py:read_bytes, integrations/mcp/openva_mcp/openva_mcp/snapshot.py:read_bytes\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nadapters/python/openva_pack_reader/openva_pack_reader/reader.py:load_json, adapters/python/openva_pack_reader/openva_pack_reader/reader.py:load\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsite/build.py:source_health_key, tools/openva/source_repair_plan.py:evidence_key, tools/openva/source_repair_partition.py:evidence_key, tools/openva/source_repair_automerge.py:evidence_key\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33a6b62e30ce7ab4", "name": "Near-duplicate function bodies in 6 places", "shortDescription": {"text": "Near-duplicate function bodies in 6 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ntools/openva/missing_vendor_bridge.py:load_json, tools/openva/materialization_envelope.py:load_json, tools/openva/source_discovery.py:load_json, tools/openva/contribution_promotion_materializer.py:load_json\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-122053f21232d80c", "name": "Near-duplicate function bodies in 14 places", "shortDescription": {"text": "Near-duplicate function bodies in 14 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ntools/openva/release_smoke.py:load_json, tools/openva/source_review_decisions.py:load_json, tools/openva/source_health_public_snapshot.py:load_json, tools/openva/source_observation_ledger.py:load_json\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0027e313ade46c8f", "name": "Near-duplicate function bodies in 7 places", "shortDescription": {"text": "Near-duplicate function bodies in 7 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ntools/openva/field_provenance.py:load_yaml, tools/openva/source_health.py:load_yaml, tools/openva/entity_stubs.py:load_yaml, tools/openva/coverage_audit.py:load_yaml\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-380b7cb95b387b9c", "name": "Near-duplicate function bodies in 11 places", "shortDescription": {"text": "Near-duplicate function bodies in 11 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ntools/openva/bot_observability.py:load_yaml, tools/openva/bot_chatops.py:load_yaml, tools/openva/bot_ops_smoke.py:load_yaml, tools/openva/bot_calibration.py:load_yaml\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aed41d6d66696588", "name": "Unused endpoint: GET /pack/meta", "shortDescription": {"text": "Unused endpoint: GET /pack/meta"}, "fullDescription": {"text": "`services/openva_match_service/openva_match_service/app.py` declares `GET /pack/meta` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c436869d081bf12", "name": "Unused endpoint: POST /match", "shortDescription": {"text": "Unused endpoint: POST /match"}, "fullDescription": {"text": "`services/openva_match_service/openva_match_service/app.py` declares `POST /match` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21161"}, "properties": {"repository": "thedanieltan/open-vendor-assurance", "repoUrl": "https://github.com/thedanieltan/open-vendor-assurance", "branch": "main"}, "results": [{"ruleId": "scanner-ed74baa15844a34e", "level": "note", "message": {"text": "Possibly dead Python function: vendor_rows"}, "properties": {"repobilityId": "af95e04004f2ac8b", "scanner": "scanner-primary", "fingerprint": "ed74baa15844a34e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/python/openva_sqlite_export/openva_sqlite_export/exporter.py:78"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41cd87a1e6dadedd", "level": "note", "message": {"text": "Possibly dead Python function: unavailable_source_rows"}, "properties": {"repobilityId": "a50bb9007396eb14", "scanner": "scanner-primary", "fingerprint": "41cd87a1e6dadedd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/python/openva_sqlite_export/openva_sqlite_export/exporter.py:92"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-abdfe009724e2384", "level": "note", "message": {"text": "Possibly dead Python function: source_coverage_rows"}, "properties": {"repobilityId": "1c6c96d7d3df2e3a", "scanner": "scanner-primary", "fingerprint": "abdfe009724e2384", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/python/openva_sqlite_export/openva_sqlite_export/exporter.py:101"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-867e2e22c368fe5b", "level": "note", "message": {"text": "Possibly dead Python function: vendor_rows"}, "properties": {"repobilityId": "af95e04004f2ac8b", "scanner": "scanner-primary", "fingerprint": "867e2e22c368fe5b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/python/openva_csv_export/openva_csv_export/exporter.py:152"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5ad5692985e430a2", "level": "note", "message": {"text": "Possibly dead Python function: unavailable_source_rows"}, "properties": {"repobilityId": "a50bb9007396eb14", "scanner": "scanner-primary", "fingerprint": "5ad5692985e430a2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/python/openva_csv_export/openva_csv_export/exporter.py:166"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8c7303b3d3830ad", "level": "note", "message": {"text": "Possibly dead Python function: source_coverage_rows"}, "properties": {"repobilityId": "1c6c96d7d3df2e3a", "scanner": "scanner-primary", "fingerprint": "a8c7303b3d3830ad", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/python/openva_csv_export/openva_csv_export/exporter.py:175"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3dca65e0b1ab2503", "level": "note", "message": {"text": "Possibly dead Python function: vendor_rows"}, "properties": {"repobilityId": "af95e04004f2ac8b", "scanner": "scanner-primary", "fingerprint": "3dca65e0b1ab2503", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/python/openva_jsonl_export/openva_jsonl_export/exporter.py:36"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-35d6479589c62da5", "level": "note", "message": {"text": "Possibly dead Python function: unavailable_source_rows"}, "properties": {"repobilityId": "a50bb9007396eb14", "scanner": "scanner-primary", "fingerprint": "35d6479589c62da5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/python/openva_jsonl_export/openva_jsonl_export/exporter.py:54"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a28c482e4a0cd40b", "level": "note", "message": {"text": "Possibly dead Python function: source_coverage_rows"}, "properties": {"repobilityId": "1c6c96d7d3df2e3a", "scanner": "scanner-primary", "fingerprint": "a28c482e4a0cd40b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/python/openva_jsonl_export/openva_jsonl_export/exporter.py:63"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5efdc9447b04c64f", "level": "note", "message": {"text": "Possibly dead Python function: require_api_key"}, "properties": {"repobilityId": "44e8e9840fc57179", "scanner": "scanner-primary", "fingerprint": "5efdc9447b04c64f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/openva_match_service/openva_match_service/app.py:103"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dac8e49d4197d2a3", "level": "note", "message": {"text": "Possibly dead Python function: git_show"}, "properties": {"repobilityId": "1ff608fe005eda36", "scanner": "scanner-primary", "fingerprint": "dac8e49d4197d2a3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/observation_automerge.py:57"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-25841e278575f2ce", "level": "note", "message": {"text": "Possibly dead Python function: sort_key"}, "properties": {"repobilityId": "ac2a4181eae38738", "scanner": "scanner-primary", "fingerprint": "25841e278575f2ce", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/github_actions_artifacts.py:34"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8d7817e12dad6a29", "level": "note", "message": {"text": "Possibly dead Python function: git_show"}, "properties": {"repobilityId": "1ff608fe005eda36", "scanner": "scanner-primary", "fingerprint": "8d7817e12dad6a29", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/machine_provisional_automerge.py:62"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-000d25444f2ceff0", "level": "note", "message": {"text": "Possibly dead Python function: disabled_fetcher"}, "properties": {"repobilityId": "aab8504dedb92e09", "scanner": "scanner-primary", "fingerprint": "000d25444f2ceff0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/submission_verify.py:584"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f99cf556106c60e9", "level": "note", "message": {"text": "Possibly dead Python function: is_redirecting_source"}, "properties": {"repobilityId": "f944c381cb6e18a0", "scanner": "scanner-primary", "fingerprint": "f99cf556106c60e9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/strict_growth_redirects.py:60"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9c2799f92144a9fc", "level": "note", "message": {"text": "Possibly dead Python function: git_show"}, "properties": {"repobilityId": "1ff608fe005eda36", "scanner": "scanner-primary", "fingerprint": "9c2799f92144a9fc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/quorum_promotion_automerge.py:58"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f4c47f7bbd5a4f81", "level": "note", "message": {"text": "Possibly dead Python function: sort_key"}, "properties": {"repobilityId": "ac2a4181eae38738", "scanner": "scanner-primary", "fingerprint": "f4c47f7bbd5a4f81", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/source_review_triage.py:206"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9a466a53683898e0", "level": "note", "message": {"text": "Possibly dead Python function: git_show"}, "properties": {"repobilityId": "1ff608fe005eda36", "scanner": "scanner-primary", "fingerprint": "9a466a53683898e0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/rollback_automerge.py:53"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-953e0d62c7d57905", "level": "note", "message": {"text": "Possibly dead Python function: sort_key"}, "properties": {"repobilityId": "ac2a4181eae38738", "scanner": "scanner-primary", "fingerprint": "953e0d62c7d57905", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/source_repair_partition.py:106"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dd30bbc59d60402e", "level": "note", "message": {"text": "Possibly dead Python function: revert_materialization"}, "properties": {"repobilityId": "e1dceba4c8135b98", "scanner": "scanner-primary", "fingerprint": "dd30bbc59d60402e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/rollback.py:144"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7e1839e8c8331d19", "level": "note", "message": {"text": "Possibly dead Python function: select_command"}, "properties": {"repobilityId": "8cd12132a6bb29ee", "scanner": "scanner-primary", "fingerprint": "7e1839e8c8331d19", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/maintenance_lifecycle.py:155"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-097e953883ed282a", "level": "note", "message": {"text": "Possibly dead Python function: validate_command"}, "properties": {"repobilityId": "1a4c72d8a28c8253", "scanner": "scanner-primary", "fingerprint": "097e953883ed282a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/maintenance_lifecycle.py:211"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f1a57888eb09e4e2", "level": "note", "message": {"text": "Possibly dead Python function: unavailable_source_types_for_vendor"}, "properties": {"repobilityId": "2dd9a4f10b2833d5", "scanner": "scanner-primary", "fingerprint": "f1a57888eb09e4e2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/source_discovery.py:195"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-76284c679ad3ff85", "level": "note", "message": {"text": "Possibly dead Python function: select_command"}, "properties": {"repobilityId": "8cd12132a6bb29ee", "scanner": "scanner-primary", "fingerprint": "76284c679ad3ff85", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/candidate_promotion_lifecycle.py:142"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8590186ee088c260", "level": "note", "message": {"text": "Possibly dead Python function: sort_key"}, "properties": {"repobilityId": "ac2a4181eae38738", "scanner": "scanner-primary", "fingerprint": "8590186ee088c260", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/openva/source_repair_sweep.py:155"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28a7f352277939fc", "level": "warning", "message": {"text": "Privileged port 7 in use"}, "properties": {"repobilityId": "428a6faecc63b5d6", "scanner": "scanner-primary", "fingerprint": "28a7f352277939fc", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/autonomous-catalog-growth.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3aa0d33f8d6e4833", "level": "warning", "message": {"text": "Privileged port 17 in use"}, "properties": {"repobilityId": "0bf38fb8f89ec589", "scanner": "scanner-primary", "fingerprint": "3aa0d33f8d6e4833", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/autonomous-catalog-growth.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2ad0e8250e693ae7", "level": "warning", "message": {"text": "Privileged port 23 in use"}, "properties": {"repobilityId": "a1230e3dfc4becfa", "scanner": "scanner-primary", "fingerprint": "2ad0e8250e693ae7", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/autonomous-catalog-growth.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7cc2c9ce6db5c35c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "f8ac083dcbd73aff", "scanner": "scanner-primary", "fingerprint": "7cc2c9ce6db5c35c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "integrations/mcp/openva_mcp/Dockerfile"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-0ad6a0208a17c5df", "level": "warning", "message": {"text": "Dockerfile runs as root: services/openva_match_service/Dockerfile"}, "properties": {"repobilityId": "29a2b33b95f9e6e2", "scanner": "scanner-primary", "fingerprint": "0ad6a0208a17c5df", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-3f9fcc4a62b1cd3a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in site/src/app.js:93"}, "properties": {"repobilityId": "7df3814f529a0026", "scanner": "scanner-primary", "fingerprint": "3f9fcc4a62b1cd3a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "site/src/app.js"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-95e34c9c5df0dfa0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "198fd9560e9cebb1", "scanner": "scanner-primary", "fingerprint": "95e34c9c5df0dfa0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/catalog-maintenance-pr.yml"}, "region": {"startLine": 213}}}]}, {"ruleId": "scanner-212f0dbc4a21a4b7", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "f4659d33ea7fc60f", "scanner": "scanner-primary", "fingerprint": "212f0dbc4a21a4b7", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/catalog-maintenance-pr.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bbf409d257b642b0", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ded9348d43b9ed0b", "scanner": "scanner-primary", "fingerprint": "bbf409d257b642b0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-downloads.yml"}, "region": {"startLine": 150}}}]}, {"ruleId": "scanner-06ab99a0068cc938", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b1c3d4652a6044d6", "scanner": "scanner-primary", "fingerprint": "06ab99a0068cc938", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-downloads.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c16aafc1febfc6df", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "597692b91040411c", "scanner": "scanner-primary", "fingerprint": "c16aafc1febfc6df", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/source-refinement-scan.yml"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-c16aafc1febfc6df", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "597692b91040411c", "scanner": "scanner-primary", "fingerprint": "c16aafc1febfc6df", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/source-refinement-scan.yml"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-c16aafc1febfc6df", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f53ce26c2e92bf46", "scanner": "scanner-primary", "fingerprint": "c16aafc1febfc6df", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/source-refinement-scan.yml"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-c16aafc1febfc6df", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f53ce26c2e92bf46", "scanner": "scanner-primary", "fingerprint": "c16aafc1febfc6df", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/source-refinement-scan.yml"}, "region": {"startLine": 251}}}]}, {"ruleId": "scanner-4d8552a10bbd48aa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ebcdfb4296d2a85c", "scanner": "scanner-primary", "fingerprint": "4d8552a10bbd48aa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/source-refinement-queue.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-09d94de5c1f3e19f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "322e5a137306a5ca", "scanner": "scanner-primary", "fingerprint": "09d94de5c1f3e19f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/catalog-maintenance.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-692bd1833f3c263f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9c77e1bda6f1aea6", "scanner": "scanner-primary", "fingerprint": "692bd1833f3c263f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/catalog-growth-discovery.yml"}, "region": {"startLine": 368}}}]}, {"ruleId": "scanner-692bd1833f3c263f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9c77e1bda6f1aea6", "scanner": "scanner-primary", "fingerprint": "692bd1833f3c263f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/catalog-growth-discovery.yml"}, "region": {"startLine": 418}}}]}, {"ruleId": "scanner-f7fe2bce9538e531", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "87a6ec1f659bd63a", "scanner": "scanner-primary", "fingerprint": "f7fe2bce9538e531", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/observe-report.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-34e7b8aafb9c00d5", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bc669da69e9442fe", "scanner": "scanner-primary", "fingerprint": "34e7b8aafb9c00d5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/contribution-intake-agent.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-34e7b8aafb9c00d5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "33dc9d88cda7201a", "scanner": "scanner-primary", "fingerprint": "34e7b8aafb9c00d5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/contribution-intake-agent.yml"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-34e7b8aafb9c00d5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ccf79e2d9bcac70e", "scanner": "scanner-primary", "fingerprint": "34e7b8aafb9c00d5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/contribution-intake-agent.yml"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-6dcb5c9f0aa29c20", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "23a358b0725cf1bc", "scanner": "scanner-primary", "fingerprint": "6dcb5c9f0aa29c20", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/contribution-intake-agent.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-95d1cd2d24bd1681", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3464ae9f0a15d845", "scanner": "scanner-primary", "fingerprint": "95d1cd2d24bd1681", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/source-maintenance-report.yml"}, "region": {"startLine": 340}}}]}, {"ruleId": "scanner-95d1cd2d24bd1681", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3464ae9f0a15d845", "scanner": "scanner-primary", "fingerprint": "95d1cd2d24bd1681", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/source-maintenance-report.yml"}, "region": {"startLine": 384}}}]}, {"ruleId": "scanner-95d1cd2d24bd1681", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3464ae9f0a15d845", "scanner": "scanner-primary", "fingerprint": "95d1cd2d24bd1681", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/source-maintenance-report.yml"}, "region": {"startLine": 407}}}]}, {"ruleId": "scanner-49d9bca7509462d5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "331c435ec7c498c8", "scanner": "scanner-primary", "fingerprint": "49d9bca7509462d5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bot-dashboard-issue.yml"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-49d9bca7509462d5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "331c435ec7c498c8", "scanner": "scanner-primary", "fingerprint": "49d9bca7509462d5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bot-dashboard-issue.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-dad99732c09466c6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69e469aa92f0de71", "scanner": "scanner-primary", "fingerprint": "dad99732c09466c6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/candidate-promotion-pr.yml"}, "region": {"startLine": 448}}}]}, {"ruleId": "scanner-dad99732c09466c6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69e469aa92f0de71", "scanner": "scanner-primary", "fingerprint": "dad99732c09466c6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/candidate-promotion-pr.yml"}, "region": {"startLine": 470}}}]}, {"ruleId": "scanner-dad99732c09466c6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69e469aa92f0de71", "scanner": "scanner-primary", "fingerprint": "dad99732c09466c6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/candidate-promotion-pr.yml"}, "region": {"startLine": 621}}}]}, {"ruleId": "scanner-dad99732c09466c6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69e469aa92f0de71", "scanner": "scanner-primary", "fingerprint": "dad99732c09466c6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/candidate-promotion-pr.yml"}, "region": {"startLine": 633}}}]}, {"ruleId": "scanner-dad99732c09466c6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69e469aa92f0de71", "scanner": "scanner-primary", "fingerprint": "dad99732c09466c6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/candidate-promotion-pr.yml"}, "region": {"startLine": 662}}}]}, {"ruleId": "scanner-dad99732c09466c6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69e469aa92f0de71", "scanner": "scanner-primary", "fingerprint": "dad99732c09466c6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/candidate-promotion-pr.yml"}, "region": {"startLine": 838}}}]}, {"ruleId": "scanner-dad99732c09466c6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69e469aa92f0de71", "scanner": "scanner-primary", "fingerprint": "dad99732c09466c6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/candidate-promotion-pr.yml"}, "region": {"startLine": 995}}}]}, {"ruleId": "scanner-dad99732c09466c6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69e469aa92f0de71", "scanner": "scanner-primary", "fingerprint": "dad99732c09466c6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/candidate-promotion-pr.yml"}, "region": {"startLine": 1140}}}]}, {"ruleId": "scanner-aaee0b260683b8f2", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "2419ad3d7b6bc92a", "scanner": "scanner-primary", "fingerprint": "aaee0b260683b8f2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/candidate-promotion-pr.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f3725a8fcf08d0c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "462d5e851494407e", "scanner": "scanner-primary", "fingerprint": "4f3725a8fcf08d0c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/catalog-agent-pr.yml"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-0777e28e09b3aca8", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "5c97e30f13e09371", "scanner": "scanner-primary", "fingerprint": "0777e28e09b3aca8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/catalog-agent-pr.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-668f583fccc3eb6b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dd79ac2558384edb", "scanner": "scanner-primary", "fingerprint": "668f583fccc3eb6b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-weighted-review.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-668f583fccc3eb6b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dd79ac2558384edb", "scanner": "scanner-primary", "fingerprint": "668f583fccc3eb6b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-weighted-review.yml"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-668f583fccc3eb6b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dd79ac2558384edb", "scanner": "scanner-primary", "fingerprint": "668f583fccc3eb6b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-weighted-review.yml"}, "region": {"startLine": 150}}}]}, {"ruleId": "scanner-668f583fccc3eb6b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dd79ac2558384edb", "scanner": "scanner-primary", "fingerprint": "668f583fccc3eb6b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-weighted-review.yml"}, "region": {"startLine": 201}}}]}, {"ruleId": "scanner-668f583fccc3eb6b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dd79ac2558384edb", "scanner": "scanner-primary", "fingerprint": "668f583fccc3eb6b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-weighted-review.yml"}, "region": {"startLine": 258}}}]}, {"ruleId": "scanner-cab1916e86d792d1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "680ec326e8fcc7b3", "scanner": "scanner-primary", "fingerprint": "cab1916e86d792d1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/source-repair-pr.yml"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-cab1916e86d792d1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "680ec326e8fcc7b3", "scanner": "scanner-primary", "fingerprint": "cab1916e86d792d1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/source-repair-pr.yml"}, "region": {"startLine": 280}}}]}, {"ruleId": "scanner-cab1916e86d792d1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "680ec326e8fcc7b3", "scanner": "scanner-primary", "fingerprint": "cab1916e86d792d1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/source-repair-pr.yml"}, "region": {"startLine": 360}}}]}, {"ruleId": "scanner-cab1916e86d792d1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "680ec326e8fcc7b3", "scanner": "scanner-primary", "fingerprint": "cab1916e86d792d1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/source-repair-pr.yml"}, "region": {"startLine": 388}}}]}, {"ruleId": "scanner-5733fba2de072f36", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a0dda67790e16943", "scanner": "scanner-primary", "fingerprint": "5733fba2de072f36", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/source-repair-pr.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0f7c609cdffdc10f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "85ed51e3a3910f86", "scanner": "scanner-primary", "fingerprint": "0f7c609cdffdc10f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bot-chatops.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-fde138724462cc3b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6d6dfc2c70b1702", "scanner": "scanner-primary", "fingerprint": "fde138724462cc3b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-automerge.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-fde138724462cc3b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6d6dfc2c70b1702", "scanner": "scanner-primary", "fingerprint": "fde138724462cc3b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-automerge.yml"}, "region": {"startLine": 137}}}]}, {"ruleId": "scanner-fde138724462cc3b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6d6dfc2c70b1702", "scanner": "scanner-primary", "fingerprint": "fde138724462cc3b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-automerge.yml"}, "region": {"startLine": 202}}}]}, {"ruleId": "scanner-fde138724462cc3b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6d6dfc2c70b1702", "scanner": "scanner-primary", "fingerprint": "fde138724462cc3b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-automerge.yml"}, "region": {"startLine": 250}}}]}, {"ruleId": "scanner-fde138724462cc3b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6d6dfc2c70b1702", "scanner": "scanner-primary", "fingerprint": "fde138724462cc3b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-automerge.yml"}, "region": {"startLine": 375}}}]}, {"ruleId": "scanner-fde138724462cc3b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6d6dfc2c70b1702", "scanner": "scanner-primary", "fingerprint": "fde138724462cc3b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-automerge.yml"}, "region": {"startLine": 455}}}]}, {"ruleId": "scanner-fde138724462cc3b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6d6dfc2c70b1702", "scanner": "scanner-primary", "fingerprint": "fde138724462cc3b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-automerge.yml"}, "region": {"startLine": 534}}}]}, {"ruleId": "scanner-fde138724462cc3b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6d6dfc2c70b1702", "scanner": "scanner-primary", "fingerprint": "fde138724462cc3b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-automerge.yml"}, "region": {"startLine": 622}}}]}, {"ruleId": "scanner-fde138724462cc3b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6d6dfc2c70b1702", "scanner": "scanner-primary", "fingerprint": "fde138724462cc3b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-automerge.yml"}, "region": {"startLine": 710}}}]}, {"ruleId": "scanner-fde138724462cc3b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6d6dfc2c70b1702", "scanner": "scanner-primary", "fingerprint": "fde138724462cc3b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-automerge.yml"}, "region": {"startLine": 798}}}]}, {"ruleId": "scanner-5d2c537f0534a8ba", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "d240c933a14cc8ae", "scanner": "scanner-primary", "fingerprint": "5d2c537f0534a8ba", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-automerge.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ee81bea9071ccee6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "44cf6fb1ff086a6d", "scanner": "scanner-primary", "fingerprint": "ee81bea9071ccee6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-candidate.yml"}, "region": {"startLine": 150}}}]}, {"ruleId": "scanner-3362ba15bc9515c2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6139ba629cc07655", "scanner": "scanner-primary", "fingerprint": "3362ba15bc9515c2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/site-live-feed.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-350ff91b510309d2", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a6d5a732c2df2476", "scanner": "scanner-primary", "fingerprint": "350ff91b510309d2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/discovery-ledger-append-pr.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-37c887c7838799a8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9aaa3874a435c860", "scanner": "scanner-primary", "fingerprint": "37c887c7838799a8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/submitted-source-verification.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-37c887c7838799a8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1dfef9d4f3407cf7", "scanner": "scanner-primary", "fingerprint": "37c887c7838799a8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/submitted-source-verification.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-aa6f0614ef34bd66", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8e664250a8808c0d", "scanner": "scanner-primary", "fingerprint": "aa6f0614ef34bd66", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/coverage-audit.yml"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-fd588fb621543c45", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "22a99cea3f77dca1", "scanner": "scanner-primary", "fingerprint": "fd588fb621543c45", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/observation-ledger-append-pr.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6b47f6b3cb9437be", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "50490bde30b3e962", "scanner": "scanner-primary", "fingerprint": "6b47f6b3cb9437be", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/autonomous-catalog-growth.yml"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-63f45dada6045236", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "df16bf542792dd2a", "scanner": "scanner-primary", "fingerprint": "63f45dada6045236", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/source-repair-pr-cleanup.yml"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-1b3165b5e9cb776b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "545fd2a40ec729b0", "scanner": "scanner-primary", "fingerprint": "1b3165b5e9cb776b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/site-pages.yml"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-1b3165b5e9cb776b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "816a9ae08d7fc0f1", "scanner": "scanner-primary", "fingerprint": "1b3165b5e9cb776b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/site-pages.yml"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-1b3165b5e9cb776b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7246e9b66a4fefcb", "scanner": "scanner-primary", "fingerprint": "1b3165b5e9cb776b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/site-pages.yml"}, "region": {"startLine": 129}}}]}, {"ruleId": "scanner-d77a985b0965c5d2", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "6df657b9c80dec12", "scanner": "scanner-primary", "fingerprint": "d77a985b0965c5d2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/site-pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "07c6dae13896f63f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "d07fbd2a37075b78", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "c8b3196a72a32076", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-227cb20b1b659621", "level": "note", "message": {"text": "Legacy-named symbol `test_pyproject_pins_mcp_below_v2` in tests/test_openva_mcp_metadata.py:63"}, "properties": {"repobilityId": "d816a526aa4e8a1e", "scanner": "scanner-primary", "fingerprint": "227cb20b1b659621", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-45e7462c29a06cab", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 site/src/app.js:121"}, "properties": {"repobilityId": "dd3524a72d83ca68", "scanner": "scanner-primary", "fingerprint": "45e7462c29a06cab", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-50c59c2958fc12b8", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/release_smoke.py:143"}, "properties": {"repobilityId": "00a23fe53a3b1e6f", "scanner": "scanner-primary", "fingerprint": "50c59c2958fc12b8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-02c507eb061c6923", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/observation_automerge.py:58"}, "properties": {"repobilityId": "acfb5657d0534790", "scanner": "scanner-primary", "fingerprint": "02c507eb061c6923", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-35c527f0b2e7a73c", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/machine_provisional_automerge.py:63"}, "properties": {"repobilityId": "c75346a6bcf60506", "scanner": "scanner-primary", "fingerprint": "35c527f0b2e7a73c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7587ad1d3a5f178c", "level": "none", "message": {"text": "Commented-code block (5 lines) in tools/openva/submission_verify.py:60"}, "properties": {"repobilityId": "cff30a6567945159", "scanner": "scanner-primary", "fingerprint": "7587ad1d3a5f178c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-80c3a9326fab1b7d", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/quorum_promotion_automerge.py:59"}, "properties": {"repobilityId": "3c8e98bc906652f2", "scanner": "scanner-primary", "fingerprint": "80c3a9326fab1b7d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-59a5c21c6c106319", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/rollback_automerge.py:54"}, "properties": {"repobilityId": "db47b644ad0da55f", "scanner": "scanner-primary", "fingerprint": "59a5c21c6c106319", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2dde18de8374b724", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/source_repair_automerge.py:59"}, "properties": {"repobilityId": "eafba0a0c8be9462", "scanner": "scanner-primary", "fingerprint": "2dde18de8374b724", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9171fb7eb0aa6d83", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/quarantine_automerge.py:57"}, "properties": {"repobilityId": "6d730eb5cd82e2ab", "scanner": "scanner-primary", "fingerprint": "9171fb7eb0aa6d83", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0bb0de752bf3b8bc", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/openva/machine_provisional_controller.py:28"}, "properties": {"repobilityId": "f92269491ba371ee", "scanner": "scanner-primary", "fingerprint": "0bb0de752bf3b8bc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ad1f2c0971b89ce0", "level": "note", "message": {"text": "10 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "3bfdc60c61f1870e", "scanner": "scanner-primary", "fingerprint": "ad1f2c0971b89ce0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "26064a2de7868267", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "40d89b5a7e70a100", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f097a6b5b939640f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "76963c46c39a775b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "2194262a060a0158", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "69fb7938cc219975", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "650bb9f0697ae5c8", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-33a6b62e30ce7ab4", "level": "note", "message": {"text": "Near-duplicate function bodies in 6 places"}, "properties": {"repobilityId": "b351585b0110aa27", "scanner": "scanner-primary", "fingerprint": "33a6b62e30ce7ab4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "45d1bfbadb662d96", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "29709a06daa5c9d9", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bfdb0ee3644843f4", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-122053f21232d80c", "level": "note", "message": {"text": "Near-duplicate function bodies in 14 places"}, "properties": {"repobilityId": "ff8c2094d3f4eeb1", "scanner": "scanner-primary", "fingerprint": "122053f21232d80c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "a482934cca8b7ab2", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-0027e313ade46c8f", "level": "note", "message": {"text": "Near-duplicate function bodies in 7 places"}, "properties": {"repobilityId": "f1e3d2d1a1a06d27", "scanner": "scanner-primary", "fingerprint": "0027e313ade46c8f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "699c27ef5753b5ff", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-33a6b62e30ce7ab4", "level": "note", "message": {"text": "Near-duplicate function bodies in 6 places"}, "properties": {"repobilityId": "772b7dc50b19009b", "scanner": "scanner-primary", "fingerprint": "33a6b62e30ce7ab4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1d9c7904da596d59", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-380b7cb95b387b9c", "level": "note", "message": {"text": "Near-duplicate function bodies in 11 places"}, "properties": {"repobilityId": "efcd7a0018e2b238", "scanner": "scanner-primary", "fingerprint": "380b7cb95b387b9c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "61802a2fc2f9a939", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c4473cc06d2e5a0a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-aed41d6d66696588", "level": "note", "message": {"text": "Unused endpoint: GET /pack/meta"}, "properties": {"repobilityId": "e3c75af1303125a4", "scanner": "scanner-primary", "fingerprint": "aed41d6d66696588", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8c436869d081bf12", "level": "note", "message": {"text": "Unused endpoint: POST /match"}, "properties": {"repobilityId": "c0cd3d170045cb94", "scanner": "scanner-primary", "fingerprint": "8c436869d081bf12", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}