{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-c478831e212b89ad", "name": "Possibly dead Python function: invoke_claude_for_doc", "shortDescription": {"text": "Possibly dead Python function: invoke_claude_for_doc"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9920b644882a4946", "name": "Possibly dead Python function: dry_run_invoker", "shortDescription": {"text": "Possibly dead Python function: dry_run_invoker"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-461117daa0c50fa3", "name": "Possibly dead Python function: sort_key", "shortDescription": {"text": "Possibly dead Python function: sort_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5dd3c0da140ee85f", "name": "Possibly dead Python function: issue_body_has_required_sections", "shortDescription": {"text": "Possibly dead Python function: issue_body_has_required_sections"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09e4c1f56695ed06", "name": "Possibly dead Python function: sort_key", "shortDescription": {"text": "Possibly dead Python function: sort_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cde30880be75e30b", "name": "Possibly dead Python function: replacer", "shortDescription": {"text": "Possibly dead Python function: replacer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0b4f2372fd0436e", "name": "Possibly dead Python function: invoke_round1_agent", "shortDescription": {"text": "Possibly dead Python function: invoke_round1_agent"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2cccf4c3dd79fcae", "name": "Possibly dead Python function: sort_key", "shortDescription": {"text": "Possibly dead Python function: sort_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2204b3341fb0c84d", "name": "Possibly dead Python function: replacer", "shortDescription": {"text": "Possibly dead Python function: replacer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-800c5284954a2371", "name": "Possibly dead Python function: to_markdown", "shortDescription": {"text": "Possibly dead Python function: to_markdown"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3567db1405b6569", "name": "Possibly dead Python function: analyze_from_files", "shortDescription": {"text": "Possibly dead Python function: analyze_from_files"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-567834f7dd3582cf", "name": "Possibly dead Python function: parse_codex_jsonl_file", "shortDescription": {"text": "Possibly dead Python function: parse_codex_jsonl_file"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b17cd8b09dee47a2", "name": "Possibly dead Python function: analyze_codex_log", "shortDescription": {"text": "Possibly dead Python function: analyze_codex_log"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0644bf77f90ab1a7", "name": "Possibly dead Python function: badly_formatted_function", "shortDescription": {"text": "Possibly dead Python function: badly_formatted_function"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9dff38748004cb5f", "name": "Possibly dead Python function: another_func", "shortDescription": {"text": "Possibly dead Python function: another_func"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02c67185b43b6383", "name": "Possibly dead Python function: long_line", "shortDescription": {"text": "Possibly dead Python function: long_line"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0fa57ecbf42efd1", "name": "Possibly dead Python function: compute_sum", "shortDescription": {"text": "Possibly dead Python function: compute_sum"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f25543727bf57c9", "name": "Possibly dead Python function: list_builder", "shortDescription": {"text": "Possibly dead Python function: list_builder"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-256347a02be09468", "name": "Possibly dead Python function: ambiguous_types", "shortDescription": {"text": "Possibly dead Python function: ambiguous_types"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4c9fc2a4ce38a063", "name": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/keepalive_loop.js:4280", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/keepalive_loop.js:4280"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1db143be8aa8ce83", "name": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/conflict_detector.js:149", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/conflict_detector.js:149"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1225ebad93ed43fd", "name": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/prompt_integrity_guard.js:190", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/prompt_integrity_guard.js:190"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54969e85058ec02c", "name": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/github-api-with-retry.js:431", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/github-api-with-retry.js:431"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-343ccd559cd626ac", "name": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/error_classifier.js:253", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/error_classifier.js:253"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-291a80f4780c8634", "name": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/github-api-cache-client.js:44", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/github-api-cache-client.js:44"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8262255a53e18120", "name": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/coverage-normalize.js:428", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/coverage-normalize.js:428"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-583e986a69745f9e", "name": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/comment-dedupe.js:92", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/comment-dedupe.js:92"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35ae73f82a1a30e5", "name": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/actions/artifact-cache/artifact_cache.js:296", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/actions/artifact-cache/artifact_cache.js:296"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea19cc9a80625160", "name": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/actions/agent-event-eligibility/eligibility.js:358", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/actions/agent-event-eligibility/eligibility.js:358"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7073af729f12d48d", "name": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/actions/path-classifier/classify.js:297", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/actions/path-classifier/classify.js:297"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05f278b9345474cf", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/sync_dependency_campaign.js:1442", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/sync_dependency_campaign.js:1442"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf39f55d11c19c7d", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/keepalive_loop.js:4280", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/keepalive_loop.js:4280"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c45c61a6e7f57590", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/conflict_detector.js:149", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/conflict_detector.js:149"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c21251287b434283", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/prompt_integrity_guard.js:190", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/prompt_integrity_guard.js:190"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81615a0be81907a1", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/github-api-with-retry.js:431", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/github-api-with-retry.js:431"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0de79be68d0821c", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/error_classifier.js:253", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/error_classifier.js:253"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d72c4b414c0e9f3", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/pr_source_context_report.js:270", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/pr_source_context_report.js:270"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9623a36b29e8a5c7", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/github-api-cache-client.js:44", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/github-api-cache-client.js:44"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05c9dcdefb694ae0", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/coverage-normalize.js:428", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/coverage-normalize.js:428"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d478dee28511216", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/comment-dedupe.js:92", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/comment-dedupe.js:92"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1ecfd2dbd1ab81f", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/__checks__/api-call-guard.js:152", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/__checks__/api-call-guard.js:152"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0eefcd801d48a68", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/rate_limits.js:76", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/rate_limits.js:76"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6788278564568071", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/detect_thresholds.js:140", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/detect_thresholds.js:140"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-59d841b308ce1b2b", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/accumulate_history.js:47", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/accumulate_history.js:47"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-62694b5c315524d5", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/access_checks.js:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/access_checks.js:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8929439b80f114f2", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/issue_alerts.js:57", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/issue_alerts.js:57"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f71c99dd0950bb7d", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/history.js:72", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/history.js:72"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2ed373f777b06fa", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/consumer_activity.js:77", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/consumer_activity.js:77"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53dd2452ee606088", "name": "Stray `console.log` in TS/JS \u2014 .github/actions/artifact-cache/artifact_cache.js:296", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/actions/artifact-cache/artifact_cache.js:296"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de42b0e1470131ea", "name": "Stray `console.log` in TS/JS \u2014 .github/actions/agent-event-eligibility/eligibility.js:358", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/actions/agent-event-eligibility/eligibility.js:358"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef615e44046e6060", "name": "Stray `console.log` in TS/JS \u2014 .github/actions/path-classifier/classify.js:297", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/actions/path-classifier/classify.js:297"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-590442ac542e51e7", "name": "Insecure pattern 'node_child_process' in .github/scripts/agents_pr_meta_update_body.js:16", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/scripts/agents_pr_meta_update_body.js:16"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-108d5fd8895ac400", "name": "Insecure pattern 'node_child_process' in .github/scripts/issue_context_utils.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/scripts/issue_context_utils.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0cfe1c77b2da5c10", "name": "Insecure pattern 'node_child_process' in .github/scripts/agents_verifier_context.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/scripts/agents_verifier_context.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c4ab24cbb825fe3c", "name": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/path-classifier-replay.test.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/path-classifier-replay.test.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-595e529d225ed022", "name": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/token-load-balancer-resolution.test.js:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/token-load-balancer-resolution.test.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d184972156f04f13", "name": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/agents-pr-meta-update-body.test.js:35", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/agents-pr-meta-update-body.test.js:35"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-76c52d47000c3231", "name": "Insecure pattern 'eval_used' in .github/scripts/__tests__/prompt-injection-guard.test.js:243", "shortDescription": {"text": "Insecure pattern 'eval_used' in .github/scripts/__tests__/prompt-injection-guard.test.js:243"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bb377e8d2b4ca8a5", "name": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/coverage-monitor-summary.test.js:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/coverage-monitor-summary.test.js:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d6a7fe37bee5cbe4", "name": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/bot-comment-auth-coverage.test.js:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/bot-comment-auth-coverage.test.js:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bdc32b8fd306167d", "name": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/issue_context_utils.test.js:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/issue_context_utils.test.js:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f8f465062b1332d", "name": "Insecure pattern 'node_child_process' in .github/actions/path-classifier/classify.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/actions/path-classifier/classify.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42d68bbfd52e3938", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42b0d409e0241e48", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64c246f82a844d06", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "stranske/Workflows/.github/workflows/reusable-agents-pr-health.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7a1d5c391e8607c7", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a280f17c1191aa4f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88ff2766284af411", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "stranske/Workflows/.github/workflows/reusable-agents-issue-bridge.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-117e631b90ab0516", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c2b4f71171f8dfdc", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dfe4081d114045c1", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "stranske/Workflows/.github/workflows/reusable-pr-context.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-42bf562ccef7971e", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-669701daa4d755e9", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ee2cc6a66ce6c14", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c936e7f1d0f218e", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "stranske/Workflows/.github/workflows/reusable-10-ci-python.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4cbccb39e412fc5a", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "stranske/Workflows/.github/workflows/reusable-13-cross-repo-smoke.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f59d9fcb9799bd69", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "stranske/Workflows/.github/workflows/reusable-18-autofix.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7a2f39ae62b395ab", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f0f92a53bbc8bf8", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "stranske/Workflows/.github/workflows/reusable-codex-run.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0e959f15762500b2", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-04ca18cf5ba2bc89", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "stranske/Workflows/.github/workflows/reusable-10-ci-python.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-165399fc1686fe82", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5225421691dca000", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "stranske/Workflows/.github/workflows/reusable-agents-verifier.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e17780d0bc04c07c", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "stranske/Workflows/.github/workflows/reusable-backplane-conformance.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-74ab9b9f2b241b59", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0deec05c319fd44d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f69f1662949983fd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v9 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7bf4949c147b59a9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-972990fda70d0070", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a109380104c4ad6", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86b06d9a2372998f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e60ebdc12a137bfa", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fdaea450dabf022b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be759656ba1df888", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77d323761a11324c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4b2c283cedd63b1", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c4de2abca0c8b6d1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f71b264d2e822989", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e345456e5f3416be", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v9 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3677815fe1b4b050", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a7be3f043eba99b", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d6d248183a86cfb", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-399efae9049064e9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-309528b19955634b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-250937ea2782df50", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c59de2a04db9442e", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64d9be72d8da869e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44fa40b88bbf216d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e16d9d729ef4992", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0531ca6bf1ee3ab7", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9edf90b203ed6e49", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v9 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47466df40129a4c7", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89edd483bc7f49e6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2c633470fcf470e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28330c57550d0d67", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-48fda8a5aded5ab5", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2a867920709ce60", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8bd07d5711d230ac", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "stranske/Workflows/.github/workflows/reusable-codex-run.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7fe4de9c8a34f3ee", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb0aa26a6e890141", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-488846bceaadaa63", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ec2ba082359a71d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1145d2ad2a317f49", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da7d1b26a9cd7aa8", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cafcb04846fb4407", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1de7e863bad78667", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-196be7dfe65aff36", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-39056eaec4265331", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0164a9e6e0e931a2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b95a2a2e3703744d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-82d6901a63cdda33", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3bd93fcf00832db8", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f65df2c53b39220", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v9 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d54cb754ef6d9f50", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e1e19521aecb210", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6569e514dcd771b4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "dorny/paths-filter@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16e43188220c7e1c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c2074ff5fe0f0d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f16226d3af981e89", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b54c7677ab4b1e81", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ccf0e0eb91804eba", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25f986f263a8c57e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6830dc26c77e586", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91d94208d87f7bef", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5331fbf89a0d4391", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ce7e19d9d3fee8b", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-281cd0efc87a62e4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-164aa4bc88af43bc", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e13989259df1c42", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06e3b669dc85017d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d7e446ec8add3c9", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-999dc72ee41c9494", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3890bd5f1ad7cadf", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e472defd5f97e5da", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f421a139d33520e4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea1eb18d667464c5", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "stranske/Workflows/.github/workflows/reusable-bot-comment-handler.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3f4dbf7ba1d6c5bf", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c28672665e10bf0", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8c6aa7b65e2f7725", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a5ca7883e68f20a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-886d432c59a5491a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af968c5a70c7c9c6", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d2576a1904c1f54", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c086272fb4b2cfbb", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-292b8ee25edd1fd8", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc615eda9be6dcbe", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87becfdb342697b9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d2ea04f86416f64", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd96eda8e3b45f52", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-435a922e728c5903", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d6742d25469f543", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6baaadb8b0adb7ca", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09f3fbb9186322aa", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-294ffbcb0bcb342e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-397e02fd22b8024e", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c64566b751ca53fd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ca0e5d37f242546", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0d3a1eeab63b5baf", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/cache@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f769970d3aacba64", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f2687b9534e1495", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-619564775eec11a8", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-342554808b8dfaa9", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd737d26a6e058ab", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c1ed6f5278280d1", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "stranske/Workflows/.github/workflows/reusable-codex-run.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c019f742a4c67519", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e34f02c0293ae9af", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef49726f212fe4f9", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70bbed004e003fcc", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0516483a58633b4e", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4a0ee43140771f7", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6f983092923ba09", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1901fb2334c9c26f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3503edcd538de637", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2891f6854de213e2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v9 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ccc35aa1e5d9b6e1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-169237898088c581", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38b4ff3a8ac14dfe", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e8143367195f578", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1ba976565c9998e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7be7a9332ef00822", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba7af494fe062325", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v9 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1159a8948cf39aee", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-91f86ae39f7cf7e5", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-26859f0c2ccb741d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2ae21c54484acbb", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a34c3f23e6197fa", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f79f3a182caec32", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4392c737c0a1d1ad", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7fe55fb2b21190e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a6f5a75097443d6", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aeff909953c2fea4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c30cf2026c66d577", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afb5c2a03d37d270", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8647f814bf6ae491", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "stranske/Workflows/.github/workflows/reusable-agents-verifier.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dec741eef9f8c727", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bdf9e76bc7bace3", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f518497fb2835e5", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0bfb6c9810ce4cee", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d3be75a7dfb90a6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b15246c59b4d6d0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ad0b4dd3d80be5c", "name": "Very large file: tests/test_followup_issue_generator.py (1677 lines)", "shortDescription": {"text": "Very large file: tests/test_followup_issue_generator.py (1677 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a85c4077671f3e21", "name": "Very large file: tests/scripts/test_aggregate_agent_metrics.py (1775 lines)", "shortDescription": {"text": "Very large file: tests/scripts/test_aggregate_agent_metrics.py (1775 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb84b51313f707ec", "name": "Very large file: tests/workflows/test_workflow_agents_consolidation.py (1137 lines)", "shortDescription": {"text": "Very large file: tests/workflows/test_workflow_agents_consolidation.py (1137 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a64afa0894a50294", "name": "Very large file: tests/tools/test_llm_provider.py (1879 lines)", "shortDescription": {"text": "Very large file: tests/tools/test_llm_provider.py (1879 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-921ebcd00777b6c0", "name": "Very large file: scripts/repo_review_evaluator.py (3942 lines)", "shortDescription": {"text": "Very large file: scripts/repo_review_evaluator.py (3942 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8bfc8c7d0ff75db", "name": "Very large file: scripts/repo_review_round2_runner.py (1377 lines)", "shortDescription": {"text": "Very large file: scripts/repo_review_round2_runner.py (1377 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-116c06647a9fb579", "name": "Very large file: scripts/aggregate_agent_metrics.py (1582 lines)", "shortDescription": {"text": "Very large file: scripts/aggregate_agent_metrics.py (1582 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc8a15075c18fb92", "name": "Very large file: scripts/langchain/issue_optimizer.py (1538 lines)", "shortDescription": {"text": "Very large file: scripts/langchain/issue_optimizer.py (1538 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24bc0dc84a14cf54", "name": "Very large file: scripts/langchain/followup_issue_generator.py (2172 lines)", "shortDescription": {"text": "Very large file: scripts/langchain/followup_issue_generator.py (2172 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a36cbbb8275e52f7", "name": "Very large file: templates/consumer-repo/scripts/aggregate_agent_metrics.py (1582 lines)", "shortDescription": {"text": "Very large file: templates/consumer-repo/scripts/aggregate_agent_metrics.py (1582 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-565199fef3af87dc", "name": "Very large file: templates/consumer-repo/.github/scripts/keepalive_post_work.js (1674 lines)", "shortDescription": {"text": "Very large file: templates/consumer-repo/.github/scripts/keepalive_post_work.js (1674 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-178d3912a820dd0d", "name": "Very large file: templates/consumer-repo/.github/scripts/agents_pr_meta_update_body.js (1717 lines)", "shortDescription": {"text": "Very large file: templates/consumer-repo/.github/scripts/agents_pr_meta_update_body.js (1717 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f9e3344487c663d", "name": "Very large file: templates/consumer-repo/.github/scripts/keepalive_loop.js (4776 lines)", "shortDescription": {"text": "Very large file: templates/consumer-repo/.github/scripts/keepalive_loop.js (4776 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c000b8e8cb80ebb7", "name": "Very large file: .github/scripts/keepalive_post_work.js (1674 lines)", "shortDescription": {"text": "Very large file: .github/scripts/keepalive_post_work.js (1674 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c72dfc0670bb6e3", "name": "Very large file: .github/scripts/sync_dependency_campaign.js (1669 lines)", "shortDescription": {"text": "Very large file: .github/scripts/sync_dependency_campaign.js (1669 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7da7f528f0feb72", "name": "Very large file: .github/scripts/agents_pr_meta_update_body.js (1717 lines)", "shortDescription": {"text": "Very large file: .github/scripts/agents_pr_meta_update_body.js (1717 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b1f720ab9852d94", "name": "Very large file: .github/scripts/keepalive_loop.js (4776 lines)", "shortDescription": {"text": "Very large file: .github/scripts/keepalive_loop.js (4776 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5021e974d565d0d5", "name": "Very large file: .github/scripts/__tests__/keepalive-loop.test.js (3769 lines)", "shortDescription": {"text": "Very large file: .github/scripts/__tests__/keepalive-loop.test.js (3769 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b69c8d7b15a6838a", "name": "Node manifest has dependencies but no lockfile: templates/consumer-repo/.github/scripts/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: templates/consumer-repo/.github/scripts/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 986 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 61 placeholder/mock markers across 26 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d23ca58cb4b55f95", "name": "Agent authority lacks a verifier contract: templates/consumer-repo/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: templates/consumer-repo/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f03804f5a1366df", "name": "Agent authority lacks a verifier contract: templates/consumer-repo/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: templates/consumer-repo/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-31c07ba3677ea394", "name": "Agent instruction/config may expose a secret: .claude/skills/langsmith-integration/skill.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/langsmith-integration/skill.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aef9872ebbd2b160", "name": "Agent authority lacks a verifier contract: .github/copilot-instructions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .github/copilot-instructions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36d7c522d179c65e", "name": "Legacy-named symbol `tooOld` in tests/bot-comment-dismiss.test.js:47", "shortDescription": {"text": "Legacy-named symbol `tooOld` in tests/bot-comment-dismiss.test.js:47"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-315cc0d9c73581e7", "name": "Legacy-named symbol `test_detect_multiple_deprecated` in tests/test_workflow_validator.py:74", "shortDescription": {"text": "Legacy-named symbol `test_detect_multiple_deprecated` in tests/test_workflow_validator.py:74"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8a0b398f54e1886", "name": "Commented-code block (5 lines) in tests/scripts/test_repo_review_heartbeat.py:137", "shortDescription": {"text": "Commented-code block (5 lines) in tests/scripts/test_repo_review_heartbeat.py:137"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c66dfaca3c205ed1", "name": "Legacy-named symbol `nOld` in tests/scripts/test_sync_label_docs.py:39", "shortDescription": {"text": "Legacy-named symbol `nOld` in tests/scripts/test_sync_label_docs.py:39"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b602ed9986e3e26", "name": "Legacy-named symbol `test_resolve_default_branch_action_contract_and_template_copy` in tests/workflows/test_resolve_defa", "shortDescription": {"text": "Legacy-named symbol `test_resolve_default_branch_action_contract_and_template_copy` in tests/workflows/test_resolve_default_branch.py:17"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-19108a1f74effbba", "name": "Legacy-named symbol `use_legacy` in tests/workflows/test_bot_comment_handler.py:113", "shortDescription": {"text": "Legacy-named symbol `use_legacy` in tests/workflows/test_bot_comment_handler.py:113"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b894bb252fbc784", "name": "Commented-code block (5 lines) in tests/workflows/test_issue_bridge_triggers.py:155", "shortDescription": {"text": "Commented-code block (5 lines) in tests/workflows/test_issue_bridge_triggers.py:155"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3bf46bfc3c319587", "name": "Legacy-named symbol `fake_copy` in tests/workflows/github_scripts/test_restore_branch_snapshots.py:238", "shortDescription": {"text": "Legacy-named symbol `fake_copy` in tests/workflows/github_scripts/test_restore_branch_snapshots.py:238"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d8e94f8a1fe85bd", "name": "Commented-code block (5 lines) in tests/contracts/test_validate_run_contract.py:178", "shortDescription": {"text": "Commented-code block (5 lines) in tests/contracts/test_validate_run_contract.py:178"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-980af0e8881a1c2f", "name": "Commented-code block (11 lines) in scripts/repo_review_coordinator.py:472", "shortDescription": {"text": "Commented-code block (11 lines) in scripts/repo_review_coordinator.py:472"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ac9a692825c917ab", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/upload_repo_review_issues.py:122", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/upload_repo_review_issues.py:122"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c2002f0fc2829ea", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/check_gate_diff_quality.py:33", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/check_gate_diff_quality.py:33"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74a005333c06c0c6", "name": "Commented-code block (9 lines) in scripts/repo_review_body_writer.py:76", "shortDescription": {"text": "Commented-code block (9 lines) in scripts/repo_review_body_writer.py:76"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e55890101d301b0b", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/run_consumer_repo_tests.py:44", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/run_consumer_repo_tests.py:44"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-07c51de4f6da3382", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/ci_cosmetic_repair.py:89", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/ci_cosmetic_repair.py:89"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-21738f5098ab9d4e", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/workflow_startup_failure_diagnostic.py:21", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/workflow_startup_failure_diagnostic.py:21"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-583060ab8a72fa98", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/check_api_wrapper_guard.py:64", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/check_api_wrapper_guard.py:64"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-921d6058d45d5c9e", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/prune_agent_stubs.py:47", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/prune_agent_stubs.py:47"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c0d53b7a4d28dce3", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/sync_label_docs.py:67", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/sync_label_docs.py:67"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9276b6da07818ada", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/check_issue_consistency.py:182", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/check_issue_consistency.py:182"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b71d2590793c245e", "name": "Commented-code block (6 lines) in scripts/repo_review_evaluator.py:2036", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/repo_review_evaluator.py:2036"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c8fe825703814d06", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/update_langchain_versions.py:12", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/update_langchain_versions.py:12"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb0017308728cf6b", "name": "Commented-code block (5 lines) in scripts/repo_review_round2_runner.py:317", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/repo_review_round2_runner.py:317"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cfad3a5b47260e7c", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/create_verifier_labels.py:223", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/create_verifier_labels.py:223"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ad4da6f4e273df5", "name": "Commented-code block (5 lines) in scripts/check_consumer_sync_drift.py:817", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/check_consumer_sync_drift.py:817"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c52405c46310fbac", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/sync_status_file_ignores.py:375", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/sync_status_file_ignores.py:375"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b556d066ed6b584f", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/ledger_validate.py:369", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/ledger_validate.py:369"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c0dfcc0cbf13b139", "name": "Commented-code block (6 lines) in scripts/workflow_validator.py:184", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/workflow_validator.py:184"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9f28e713d00ca864", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/bootstrap_consumer_settings.py:259", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/bootstrap_consumer_settings.py:259"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b34ca2266da0d5e3", "name": "Commented-code block (6 lines) in scripts/langchain/task_decomposer.py:89", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/langchain/task_decomposer.py:89"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dab633400506a4ad", "name": "Commented-code block (5 lines) in scripts/langchain/issue_optimizer.py:180", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/langchain/issue_optimizer.py:180"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-14fa150fb195dacb", "name": "Commented-code block (7 lines) in scripts/langchain/issue_formatter.py:451", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/langchain/issue_formatter.py:451"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-23241d4397c04a4a", "name": "Commented-code block (7 lines) in templates/consumer-repo/.github/scripts/issue_scope_parser.js:587", "shortDescription": {"text": "Commented-code block (7 lines) in templates/consumer-repo/.github/scripts/issue_scope_parser.js:587"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-728f44055d37efb7", "name": "Commented-code block (6 lines) in templates/consumer-repo/.github/scripts/agents-guard.js:50", "shortDescription": {"text": "Commented-code block (6 lines) in templates/consumer-repo/.github/scripts/agents-guard.js:50"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2e6bf1880963f623", "name": "Commented-code block (5 lines) in templates/consumer-repo/.github/scripts/parse_chatgpt_topics.py:16", "shortDescription": {"text": "Commented-code block (5 lines) in templates/consumer-repo/.github/scripts/parse_chatgpt_topics.py:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-868e2d37ca6b8fd4", "name": "Commented-code block (8 lines) in templates/consumer-repo/.github/scripts/agent_delegation_policy.js:227", "shortDescription": {"text": "Commented-code block (8 lines) in templates/consumer-repo/.github/scripts/agent_delegation_policy.js:227"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cb73e61c3e7bf03d", "name": "Commented-code block (6 lines) in templates/consumer-repo/.github/scripts/keepalive_loop.js:1726", "shortDescription": {"text": "Commented-code block (6 lines) in templates/consumer-repo/.github/scripts/keepalive_loop.js:1726"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e7c53c1d72dd71e5", "name": "Commented-code block (7 lines) in templates/consumer-repo/.github/scripts/agents_pr_meta_keepalive.js:446", "shortDescription": {"text": "Commented-code block (7 lines) in templates/consumer-repo/.github/scripts/agents_pr_meta_keepalive.js:446"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a8bbcff51ff0a7c1", "name": "Commented-code block (5 lines) in templates/consumer-repo/.github/scripts/github-api-with-retry.js:148", "shortDescription": {"text": "Commented-code block (5 lines) in templates/consumer-repo/.github/scripts/github-api-with-retry.js:148"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ce06652298571657", "name": "Commented-code block (6 lines) in templates/consumer-repo/.github/scripts/agent_registry.js:74", "shortDescription": {"text": "Commented-code block (6 lines) in templates/consumer-repo/.github/scripts/agent_registry.js:74"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-557196a152190d64", "name": "Legacy-named symbol `isLegacy` in templates/consumer-repo/.github/scripts/comment-dedupe.js:65", "shortDescription": {"text": "Legacy-named symbol `isLegacy` in templates/consumer-repo/.github/scripts/comment-dedupe.js:65"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9341b125e484b66b", "name": "Network/subprocess call without timeout or try/except \u2014 tools/coverage_guard.py:387", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/coverage_guard.py:387"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd525cb775d390e3", "name": "Commented-code block (7 lines) in .github/scripts/issue_scope_parser.js:587", "shortDescription": {"text": "Commented-code block (7 lines) in .github/scripts/issue_scope_parser.js:587"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f667c363f40efacd", "name": "Commented-code block (6 lines) in .github/scripts/agents-guard.js:50", "shortDescription": {"text": "Commented-code block (6 lines) in .github/scripts/agents-guard.js:50"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-83792da8f370e5a1", "name": "Commented-code block (5 lines) in .github/scripts/parse_chatgpt_topics.py:16", "shortDescription": {"text": "Commented-code block (5 lines) in .github/scripts/parse_chatgpt_topics.py:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-75c7358b7a61fe7f", "name": "Commented-code block (8 lines) in .github/scripts/agent_delegation_policy.js:227", "shortDescription": {"text": "Commented-code block (8 lines) in .github/scripts/agent_delegation_policy.js:227"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-59c107355a35943b", "name": "Commented-code block (6 lines) in .github/scripts/keepalive_loop.js:1726", "shortDescription": {"text": "Commented-code block (6 lines) in .github/scripts/keepalive_loop.js:1726"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d799b8d5aa7d1db6", "name": "Commented-code block (7 lines) in .github/scripts/agents_pr_meta_keepalive.js:446", "shortDescription": {"text": "Commented-code block (7 lines) in .github/scripts/agents_pr_meta_keepalive.js:446"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b3e2958eeae9bd0", "name": "Commented-code block (5 lines) in .github/scripts/github-api-with-retry.js:148", "shortDescription": {"text": "Commented-code block (5 lines) in .github/scripts/github-api-with-retry.js:148"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e6e9ae8cb1796b39", "name": "Commented-code block (6 lines) in .github/scripts/agent_registry.js:74", "shortDescription": {"text": "Commented-code block (6 lines) in .github/scripts/agent_registry.js:74"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-adabb75f2201ed96", "name": "Legacy-named symbol `isLegacy` in .github/scripts/comment-dedupe.js:65", "shortDescription": {"text": "Legacy-named symbol `isLegacy` in .github/scripts/comment-dedupe.js:65"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-abe8715d7576b84f", "name": "Legacy-named symbol `nOld` in .github/scripts/__tests__/agents-pr-meta-update-body.test.js:1507", "shortDescription": {"text": "Legacy-named symbol `nOld` in .github/scripts/__tests__/agents-pr-meta-update-body.test.js:1507"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fbee23caec6bfd9", "name": "Legacy-named symbol `nOld` in .github/scripts/__tests__/sync-tracker-state.test.js:480", "shortDescription": {"text": "Legacy-named symbol `nOld` in .github/scripts/__tests__/sync-tracker-state.test.js:480"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e6d1383f3ec0db0", "name": "Commented-code block (6 lines) in .github/scripts/__tests__/conflict-detector.test.js:69", "shortDescription": {"text": "Commented-code block (6 lines) in .github/scripts/__tests__/conflict-detector.test.js:69"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d728ada752befac4", "name": "Stub function `unused_func` (body is just `pass`/`return`) \u2014 src/trend_analysis/_autofix_violation_case2.py:20", "shortDescription": {"text": "Stub function `unused_func` (body is just `pass`/`return`) \u2014 src/trend_analysis/_autofix_violation_case2.py:20"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/duplicate_detection.py:check_issue_for_duplicate, scripts/duplicate_detection.py:check_issue_for_no_duplicate\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/repo_review_state.py:to_dict, scripts/repo_review_state.py:to_dict, scripts/repo_review_state.py:to_dict\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20395"}, "properties": {"repository": "stranske/Workflows", "repoUrl": "https://github.com/stranske/Workflows", "branch": "main"}, "results": [{"ruleId": "scanner-c478831e212b89ad", "level": "note", "message": {"text": "Possibly dead Python function: invoke_claude_for_doc"}, "properties": {"repobilityId": "0856ca227220f9f0", "scanner": "scanner-primary", "fingerprint": "c478831e212b89ad", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/repo_review_docs_drift_scan.py:365"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9920b644882a4946", "level": "note", "message": {"text": "Possibly dead Python function: dry_run_invoker"}, "properties": {"repobilityId": "2f2fe6cfa9eaeb03", "scanner": "scanner-primary", "fingerprint": "9920b644882a4946", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/repo_review_docs_drift_scan.py:491"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-461117daa0c50fa3", "level": "note", "message": {"text": "Possibly dead Python function: sort_key"}, "properties": {"repobilityId": "ac2a4181eae38738", "scanner": "scanner-primary", "fingerprint": "461117daa0c50fa3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/repo_review_evaluator.py:383"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5dd3c0da140ee85f", "level": "note", "message": {"text": "Possibly dead Python function: issue_body_has_required_sections"}, "properties": {"repobilityId": "97bb7ab1fb186183", "scanner": "scanner-primary", "fingerprint": "5dd3c0da140ee85f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/repo_review_evaluator.py:2523"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-09e4c1f56695ed06", "level": "note", "message": {"text": "Possibly dead Python function: sort_key"}, "properties": {"repobilityId": "ac2a4181eae38738", "scanner": "scanner-primary", "fingerprint": "09e4c1f56695ed06", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/coverage_history_append.py:61"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cde30880be75e30b", "level": "note", "message": {"text": "Possibly dead Python function: replacer"}, "properties": {"repobilityId": "4c6d041d83cc4187", "scanner": "scanner-primary", "fingerprint": "cde30880be75e30b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/sync_dev_dependencies.py:192"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e0b4f2372fd0436e", "level": "note", "message": {"text": "Possibly dead Python function: invoke_round1_agent"}, "properties": {"repobilityId": "84fd28a1881b4cc5", "scanner": "scanner-primary", "fingerprint": "e0b4f2372fd0436e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/repo_review_round1_runner.py:303"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2cccf4c3dd79fcae", "level": "note", "message": {"text": "Possibly dead Python function: sort_key"}, "properties": {"repobilityId": "ac2a4181eae38738", "scanner": "scanner-primary", "fingerprint": "2cccf4c3dd79fcae", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/langchain/label_matcher.py:476"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2204b3341fb0c84d", "level": "note", "message": {"text": "Possibly dead Python function: replacer"}, "properties": {"repobilityId": "4c6d041d83cc4187", "scanner": "scanner-primary", "fingerprint": "2204b3341fb0c84d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/scripts/sync_dev_dependencies.py:130"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-800c5284954a2371", "level": "note", "message": {"text": "Possibly dead Python function: to_markdown"}, "properties": {"repobilityId": "05d730416c465cfd", "scanner": "scanner-primary", "fingerprint": "800c5284954a2371", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/app-baseline-kit/baseline_kit/manifest.py:42"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d3567db1405b6569", "level": "note", "message": {"text": "Possibly dead Python function: analyze_from_files"}, "properties": {"repobilityId": "2f17608b035b2634", "scanner": "scanner-primary", "fingerprint": "d3567db1405b6569", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/codex_session_analyzer.py:295"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-567834f7dd3582cf", "level": "note", "message": {"text": "Possibly dead Python function: parse_codex_jsonl_file"}, "properties": {"repobilityId": "6cbd674eef03f01c", "scanner": "scanner-primary", "fingerprint": "567834f7dd3582cf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/codex_jsonl_parser.py:535"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b17cd8b09dee47a2", "level": "note", "message": {"text": "Possibly dead Python function: analyze_codex_log"}, "properties": {"repobilityId": "84600c6dccf28d76", "scanner": "scanner-primary", "fingerprint": "b17cd8b09dee47a2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/codex_log_analyzer.py:53"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0644bf77f90ab1a7", "level": "note", "message": {"text": "Possibly dead Python function: badly_formatted_function"}, "properties": {"repobilityId": "abc7d15a2058fa1b", "scanner": "scanner-primary", "fingerprint": "0644bf77f90ab1a7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/trend_analysis/_autofix_trigger_sample.py:6"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9dff38748004cb5f", "level": "note", "message": {"text": "Possibly dead Python function: another_func"}, "properties": {"repobilityId": "a0d00fa92ad0bc79", "scanner": "scanner-primary", "fingerprint": "9dff38748004cb5f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/trend_analysis/_autofix_trigger_sample.py:10"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-02c67185b43b6383", "level": "note", "message": {"text": "Possibly dead Python function: long_line"}, "properties": {"repobilityId": "32664853df83d285", "scanner": "scanner-primary", "fingerprint": "02c67185b43b6383", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/trend_analysis/_autofix_trigger_sample.py:14"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e0fa57ecbf42efd1", "level": "note", "message": {"text": "Possibly dead Python function: compute_sum"}, "properties": {"repobilityId": "60bca0cd032b74bb", "scanner": "scanner-primary", "fingerprint": "e0fa57ecbf42efd1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/trend_analysis/_autofix_violation_case3.py:8"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f25543727bf57c9", "level": "note", "message": {"text": "Possibly dead Python function: list_builder"}, "properties": {"repobilityId": "d5c94baa3cf6b089", "scanner": "scanner-primary", "fingerprint": "5f25543727bf57c9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/trend_analysis/_autofix_violation_case3.py:12"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-256347a02be09468", "level": "note", "message": {"text": "Possibly dead Python function: ambiguous_types"}, "properties": {"repobilityId": "b182fea75c3ce436", "scanner": "scanner-primary", "fingerprint": "256347a02be09468", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/trend_analysis/_autofix_violation_case3.py:16"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-4c9fc2a4ce38a063", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/keepalive_loop.js:4280"}, "properties": {"repobilityId": "b52dc478423b1216", "scanner": "scanner-primary", "fingerprint": "4c9fc2a4ce38a063", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1db143be8aa8ce83", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/conflict_detector.js:149"}, "properties": {"repobilityId": "253010e1bb0f2fc7", "scanner": "scanner-primary", "fingerprint": "1db143be8aa8ce83", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1225ebad93ed43fd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/prompt_integrity_guard.js:190"}, "properties": {"repobilityId": "f84848eab1cbdd7f", "scanner": "scanner-primary", "fingerprint": "1225ebad93ed43fd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-54969e85058ec02c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/github-api-with-retry.js:431"}, "properties": {"repobilityId": "adeef513ee13db09", "scanner": "scanner-primary", "fingerprint": "54969e85058ec02c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-343ccd559cd626ac", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/error_classifier.js:253"}, "properties": {"repobilityId": "e0cb3b1e00176b82", "scanner": "scanner-primary", "fingerprint": "343ccd559cd626ac", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-291a80f4780c8634", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/github-api-cache-client.js:44"}, "properties": {"repobilityId": "ed3f9d56fe188010", "scanner": "scanner-primary", "fingerprint": "291a80f4780c8634", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8262255a53e18120", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/coverage-normalize.js:428"}, "properties": {"repobilityId": "2f398dce957a05aa", "scanner": "scanner-primary", "fingerprint": "8262255a53e18120", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-583e986a69745f9e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/scripts/comment-dedupe.js:92"}, "properties": {"repobilityId": "55e167e8c406e9b8", "scanner": "scanner-primary", "fingerprint": "583e986a69745f9e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-35ae73f82a1a30e5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/actions/artifact-cache/artifact_cache.js:296"}, "properties": {"repobilityId": "a4cbcffb08321c08", "scanner": "scanner-primary", "fingerprint": "35ae73f82a1a30e5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ea19cc9a80625160", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/actions/agent-event-eligibility/eligibility.js:358"}, "properties": {"repobilityId": "4f66220d26e693f1", "scanner": "scanner-primary", "fingerprint": "ea19cc9a80625160", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7073af729f12d48d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 templates/consumer-repo/.github/actions/path-classifier/classify.js:297"}, "properties": {"repobilityId": "8a3bfa349a011ca0", "scanner": "scanner-primary", "fingerprint": "7073af729f12d48d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-05f278b9345474cf", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/sync_dependency_campaign.js:1442"}, "properties": {"repobilityId": "77194bd16b9599ed", "scanner": "scanner-primary", "fingerprint": "05f278b9345474cf", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bf39f55d11c19c7d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/keepalive_loop.js:4280"}, "properties": {"repobilityId": "856ed96943b8f0ae", "scanner": "scanner-primary", "fingerprint": "bf39f55d11c19c7d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c45c61a6e7f57590", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/conflict_detector.js:149"}, "properties": {"repobilityId": "8e2a230dad283d8d", "scanner": "scanner-primary", "fingerprint": "c45c61a6e7f57590", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c21251287b434283", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/prompt_integrity_guard.js:190"}, "properties": {"repobilityId": "66a9424020a6c9e9", "scanner": "scanner-primary", "fingerprint": "c21251287b434283", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-81615a0be81907a1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/github-api-with-retry.js:431"}, "properties": {"repobilityId": "a2f675033bf5b1a5", "scanner": "scanner-primary", "fingerprint": "81615a0be81907a1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b0de79be68d0821c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/error_classifier.js:253"}, "properties": {"repobilityId": "14a195b0465e685a", "scanner": "scanner-primary", "fingerprint": "b0de79be68d0821c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6d72c4b414c0e9f3", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/pr_source_context_report.js:270"}, "properties": {"repobilityId": "c5c0a1ee318cad5e", "scanner": "scanner-primary", "fingerprint": "6d72c4b414c0e9f3", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9623a36b29e8a5c7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/github-api-cache-client.js:44"}, "properties": {"repobilityId": "cd428c19b2ba1ebd", "scanner": "scanner-primary", "fingerprint": "9623a36b29e8a5c7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-05c9dcdefb694ae0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/coverage-normalize.js:428"}, "properties": {"repobilityId": "41918851a8483a27", "scanner": "scanner-primary", "fingerprint": "05c9dcdefb694ae0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3d478dee28511216", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/comment-dedupe.js:92"}, "properties": {"repobilityId": "fb7fb2e6ade6fc1d", "scanner": "scanner-primary", "fingerprint": "3d478dee28511216", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b1ecfd2dbd1ab81f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/__checks__/api-call-guard.js:152"}, "properties": {"repobilityId": "efaf2f257770ff44", "scanner": "scanner-primary", "fingerprint": "b1ecfd2dbd1ab81f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e0eefcd801d48a68", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/rate_limits.js:76"}, "properties": {"repobilityId": "745c63d9dd8b83df", "scanner": "scanner-primary", "fingerprint": "e0eefcd801d48a68", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6788278564568071", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/detect_thresholds.js:140"}, "properties": {"repobilityId": "0ace9093e0c38444", "scanner": "scanner-primary", "fingerprint": "6788278564568071", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-59d841b308ce1b2b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/accumulate_history.js:47"}, "properties": {"repobilityId": "2c6aa82bc4eb5957", "scanner": "scanner-primary", "fingerprint": "59d841b308ce1b2b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-62694b5c315524d5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/access_checks.js:32"}, "properties": {"repobilityId": "3a4a44d422264bcc", "scanner": "scanner-primary", "fingerprint": "62694b5c315524d5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8929439b80f114f2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/issue_alerts.js:57"}, "properties": {"repobilityId": "9efd25df2cdd3cd9", "scanner": "scanner-primary", "fingerprint": "8929439b80f114f2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f71c99dd0950bb7d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/history.js:72"}, "properties": {"repobilityId": "4c65f407e957f22c", "scanner": "scanner-primary", "fingerprint": "f71c99dd0950bb7d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e2ed373f777b06fa", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/api_rate_diagnostic/consumer_activity.js:77"}, "properties": {"repobilityId": "83954db6a436c810", "scanner": "scanner-primary", "fingerprint": "e2ed373f777b06fa", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-53dd2452ee606088", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/actions/artifact-cache/artifact_cache.js:296"}, "properties": {"repobilityId": "a96784fb4ede48fa", "scanner": "scanner-primary", "fingerprint": "53dd2452ee606088", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-de42b0e1470131ea", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/actions/agent-event-eligibility/eligibility.js:358"}, "properties": {"repobilityId": "32fd75c1d0ac6697", "scanner": "scanner-primary", "fingerprint": "de42b0e1470131ea", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ef615e44046e6060", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/actions/path-classifier/classify.js:297"}, "properties": {"repobilityId": "93fa0f10fc777116", "scanner": "scanner-primary", "fingerprint": "ef615e44046e6060", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-590442ac542e51e7", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/scripts/agents_pr_meta_update_body.js:16"}, "properties": {"repobilityId": "bd4fbec4ceb7b683", "scanner": "scanner-primary", "fingerprint": "590442ac542e51e7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/agents_pr_meta_update_body.js"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-108d5fd8895ac400", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/scripts/issue_context_utils.js:5"}, "properties": {"repobilityId": "d27d3996f86ea0cd", "scanner": "scanner-primary", "fingerprint": "108d5fd8895ac400", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/issue_context_utils.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-0cfe1c77b2da5c10", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/scripts/agents_verifier_context.js:5"}, "properties": {"repobilityId": "7c54a9b48b41f6d9", "scanner": "scanner-primary", "fingerprint": "0cfe1c77b2da5c10", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/agents_verifier_context.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-c4ab24cbb825fe3c", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/path-classifier-replay.test.js:5"}, "properties": {"repobilityId": "9270d6feecfbd7a6", "scanner": "scanner-primary", "fingerprint": "c4ab24cbb825fe3c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/__tests__/path-classifier-replay.test.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-595e529d225ed022", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/token-load-balancer-resolution.test.js:6"}, "properties": {"repobilityId": "f427786d5a364d61", "scanner": "scanner-primary", "fingerprint": "595e529d225ed022", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/__tests__/token-load-balancer-resolution.test.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-d184972156f04f13", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/agents-pr-meta-update-body.test.js:35"}, "properties": {"repobilityId": "eaaa9ca7f8a0ada2", "scanner": "scanner-primary", "fingerprint": "d184972156f04f13", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/__tests__/agents-pr-meta-update-body.test.js"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-76c52d47000c3231", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in .github/scripts/__tests__/prompt-injection-guard.test.js:243"}, "properties": {"repobilityId": "fc0500dd80a6cab4", "scanner": "scanner-primary", "fingerprint": "76c52d47000c3231", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/__tests__/prompt-injection-guard.test.js"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-bb377e8d2b4ca8a5", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/coverage-monitor-summary.test.js:3"}, "properties": {"repobilityId": "492bc3eb9a7094da", "scanner": "scanner-primary", "fingerprint": "bb377e8d2b4ca8a5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/__tests__/coverage-monitor-summary.test.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-d6a7fe37bee5cbe4", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/bot-comment-auth-coverage.test.js:3"}, "properties": {"repobilityId": "fc06664e95d9fa2c", "scanner": "scanner-primary", "fingerprint": "d6a7fe37bee5cbe4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/__tests__/bot-comment-auth-coverage.test.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-bdc32b8fd306167d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/scripts/__tests__/issue_context_utils.test.js:3"}, "properties": {"repobilityId": "b7894cd6992aa1df", "scanner": "scanner-primary", "fingerprint": "bdc32b8fd306167d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/__tests__/issue_context_utils.test.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-7f8f465062b1332d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/actions/path-classifier/classify.js:5"}, "properties": {"repobilityId": "97701a1774c394df", "scanner": "scanner-primary", "fingerprint": "7f8f465062b1332d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/actions/path-classifier/classify.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-42d68bbfd52e3938", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fe671ce0a4808ff5", "scanner": "scanner-primary", "fingerprint": "42d68bbfd52e3938", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/integration-repo/.github/workflows/ci.yml"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-42d68bbfd52e3938", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5e5965e0846becc6", "scanner": "scanner-primary", "fingerprint": "42d68bbfd52e3938", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/integration-repo/.github/workflows/ci.yml"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-42b0d409e0241e48", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "389e739fce0665bd", "scanner": "scanner-primary", "fingerprint": "42b0d409e0241e48", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/integration-repo/.github/workflows/notify-workflows.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-42b0d409e0241e48", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e254669725d36c64", "scanner": "scanner-primary", "fingerprint": "42b0d409e0241e48", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/integration-repo/.github/workflows/notify-workflows.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-42b0d409e0241e48", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "389e739fce0665bd", "scanner": "scanner-primary", "fingerprint": "42b0d409e0241e48", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/integration-repo/.github/workflows/notify-workflows.yml"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-42b0d409e0241e48", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "389e739fce0665bd", "scanner": "scanner-primary", "fingerprint": "42b0d409e0241e48", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/integration-repo/.github/workflows/notify-workflows.yml"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-64c246f82a844d06", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "3e73d5cb730007a1", "scanner": "scanner-primary", "fingerprint": "64c246f82a844d06", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-pr-health.yml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-7a1d5c391e8607c7", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "bb45eb90c9f2b417", "scanner": "scanner-primary", "fingerprint": "7a1d5c391e8607c7", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-pr-health.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a280f17c1191aa4f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "8eb9835519e06637", "scanner": "scanner-primary", "fingerprint": "a280f17c1191aa4f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-88ff2766284af411", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "e5ed17a994cf6aba", "scanner": "scanner-primary", "fingerprint": "88ff2766284af411", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-issue-intake.yml"}, "region": {"startLine": 182}}}]}, {"ruleId": "scanner-88ff2766284af411", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "fff5487686bc045f", "scanner": "scanner-primary", "fingerprint": "88ff2766284af411", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-issue-intake.yml"}, "region": {"startLine": 211}}}]}, {"ruleId": "scanner-117e631b90ab0516", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ec8145d337303041", "scanner": "scanner-primary", "fingerprint": "117e631b90ab0516", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-issue-intake.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c2b4f71171f8dfdc", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "873dde3844c5da3d", "scanner": "scanner-primary", "fingerprint": "c2b4f71171f8dfdc", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-71-codex-belt-dispatcher.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dfe4081d114045c1", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "d4b5a614a82713c4", "scanner": "scanner-primary", "fingerprint": "dfe4081d114045c1", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-80-pr-event-hub.yml"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-dfe4081d114045c1", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "c7f5ef52193c206e", "scanner": "scanner-primary", "fingerprint": "dfe4081d114045c1", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-80-pr-event-hub.yml"}, "region": {"startLine": 209}}}]}, {"ruleId": "scanner-dfe4081d114045c1", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "9cd7760efd8ef85c", "scanner": "scanner-primary", "fingerprint": "dfe4081d114045c1", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-80-pr-event-hub.yml"}, "region": {"startLine": 233}}}]}, {"ruleId": "scanner-42bf562ccef7971e", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "8d17f31ed0d4a532", "scanner": "scanner-primary", "fingerprint": "42bf562ccef7971e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-73-codex-belt-conveyor.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-669701daa4d755e9", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "fb24363727a405b8", "scanner": "scanner-primary", "fingerprint": "669701daa4d755e9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/maint-76-claude-code-review.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7ee2cc6a66ce6c14", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "3f02d1ed1983b799", "scanner": "scanner-primary", "fingerprint": "7ee2cc6a66ce6c14", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-72-codex-belt-worker-dispatch.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0c936e7f1d0f218e", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "19a1f166f655223c", "scanner": "scanner-primary", "fingerprint": "0c936e7f1d0f218e", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/ci.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-4cbccb39e412fc5a", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "60a004565a4addb9", "scanner": "scanner-primary", "fingerprint": "4cbccb39e412fc5a", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/cross-repo-smoke.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-f59d9fcb9799bd69", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "b53b6e6aca066cf3", "scanner": "scanner-primary", "fingerprint": "f59d9fcb9799bd69", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/autofix.yml"}, "region": {"startLine": 495}}}]}, {"ruleId": "scanner-7a2f39ae62b395ab", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "23d27cd97c73c252", "scanner": "scanner-primary", "fingerprint": "7a2f39ae62b395ab", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/autofix.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0f0f92a53bbc8bf8", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "e89b650415e136bb", "scanner": "scanner-primary", "fingerprint": "0f0f92a53bbc8bf8", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-81-gate-followups.yml"}, "region": {"startLine": 425}}}]}, {"ruleId": "scanner-0f0f92a53bbc8bf8", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "b12999170ada6387", "scanner": "scanner-primary", "fingerprint": "0f0f92a53bbc8bf8", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-81-gate-followups.yml"}, "region": {"startLine": 459}}}]}, {"ruleId": "scanner-0f0f92a53bbc8bf8", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "e89b650415e136bb", "scanner": "scanner-primary", "fingerprint": "0f0f92a53bbc8bf8", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-81-gate-followups.yml"}, "region": {"startLine": 1243}}}]}, {"ruleId": "scanner-0f0f92a53bbc8bf8", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "b12999170ada6387", "scanner": "scanner-primary", "fingerprint": "0f0f92a53bbc8bf8", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-81-gate-followups.yml"}, "region": {"startLine": 1262}}}]}, {"ruleId": "scanner-0e959f15762500b2", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "9e74286987fda10c", "scanner": "scanner-primary", "fingerprint": "0e959f15762500b2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-81-gate-followups.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-04ca18cf5ba2bc89", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "713b66a7ac1ace9a", "scanner": "scanner-primary", "fingerprint": "04ca18cf5ba2bc89", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/pr-00-gate.yml"}, "region": {"startLine": 177}}}]}, {"ruleId": "scanner-04ca18cf5ba2bc89", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "8ff8d73142bc0fc0", "scanner": "scanner-primary", "fingerprint": "04ca18cf5ba2bc89", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/pr-00-gate.yml"}, "region": {"startLine": 323}}}]}, {"ruleId": "scanner-165399fc1686fe82", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "18ecd07d8762f64a", "scanner": "scanner-primary", "fingerprint": "165399fc1686fe82", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/pr-00-gate.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5225421691dca000", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "19199baa6992ca7f", "scanner": "scanner-primary", "fingerprint": "5225421691dca000", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/agents-verifier.yml"}, "region": {"startLine": 303}}}]}, {"ruleId": "scanner-e17780d0bc04c07c", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "368aa472a1f33203", "scanner": "scanner-primary", "fingerprint": "e17780d0bc04c07c", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/workflows/backplane-conformance.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-74ab9b9f2b241b59", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f731557e97c342c7", "scanner": "scanner-primary", "fingerprint": "74ab9b9f2b241b59", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-66-monthly-audit.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-0deec05c319fd44d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3770dcaab90eecbd", "scanner": "scanner-primary", "fingerprint": "0deec05c319fd44d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-70-fix-integration-formatting.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-0deec05c319fd44d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b31f982ac8ed2431", "scanner": "scanner-primary", "fingerprint": "0deec05c319fd44d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-70-fix-integration-formatting.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-0deec05c319fd44d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3770dcaab90eecbd", "scanner": "scanner-primary", "fingerprint": "0deec05c319fd44d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-70-fix-integration-formatting.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-0deec05c319fd44d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "efa934e9d5b64ef9", "scanner": "scanner-primary", "fingerprint": "0deec05c319fd44d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-70-fix-integration-formatting.yml"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-f69f1662949983fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4015ac45cadab17e", "scanner": "scanner-primary", "fingerprint": "f69f1662949983fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-69-sync-labels.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-f69f1662949983fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4015ac45cadab17e", "scanner": "scanner-primary", "fingerprint": "f69f1662949983fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-69-sync-labels.yml"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eb33b8ad0150dd57", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 403}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eb33b8ad0150dd57", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 426}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eb33b8ad0150dd57", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 433}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "329961deabb89c77", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 448}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "09d357c9c65a9484", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 458}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1bebd875f9f348f5", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 470}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eb33b8ad0150dd57", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 722}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eb33b8ad0150dd57", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 830}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eb33b8ad0150dd57", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 836}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "329961deabb89c77", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 850}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "09d357c9c65a9484", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 860}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1bebd875f9f348f5", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 872}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eb33b8ad0150dd57", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 1137}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eb33b8ad0150dd57", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 1143}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "329961deabb89c77", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 1170}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "09d357c9c65a9484", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 1181}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1bebd875f9f348f5", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 1193}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1bebd875f9f348f5", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 1406}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "95f26bac49836ba9", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 1483}}}]}, {"ruleId": "scanner-7bf4949c147b59a9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eb33b8ad0150dd57", "scanner": "scanner-primary", "fingerprint": "7bf4949c147b59a9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-10-ci-python.yml"}, "region": {"startLine": 1492}}}]}, {"ruleId": "scanner-972990fda70d0070", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a409c9802e3b479", "scanner": "scanner-primary", "fingerprint": "972990fda70d0070", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-auto-lock-deps.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-3a109380104c4ad6", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "aa1193f0b6529885", "scanner": "scanner-primary", "fingerprint": "3a109380104c4ad6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-auto-lock-deps.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86b06d9a2372998f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5490b1155c41cea5", "scanner": "scanner-primary", "fingerprint": "86b06d9a2372998f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-73-template-completeness.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-86b06d9a2372998f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ce8b0ee95b10a139", "scanner": "scanner-primary", "fingerprint": "86b06d9a2372998f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-73-template-completeness.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-e60ebdc12a137bfa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "11df045873cda682", "scanner": "scanner-primary", "fingerprint": "e60ebdc12a137bfa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-74-template-drift.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-fdaea450dabf022b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "460326c32ecab146", "scanner": "scanner-primary", "fingerprint": "fdaea450dabf022b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-capability-check.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-fdaea450dabf022b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dc294ed8b67fdc16", "scanner": "scanner-primary", "fingerprint": "fdaea450dabf022b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-capability-check.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-fdaea450dabf022b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b6184e5ce8ef1b94", "scanner": "scanner-primary", "fingerprint": "fdaea450dabf022b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-capability-check.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-fdaea450dabf022b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b6184e5ce8ef1b94", "scanner": "scanner-primary", "fingerprint": "fdaea450dabf022b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-capability-check.yml"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-fdaea450dabf022b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b6184e5ce8ef1b94", "scanner": "scanner-primary", "fingerprint": "fdaea450dabf022b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-capability-check.yml"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-be759656ba1df888", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e39e42b990d6d332", "scanner": "scanner-primary", "fingerprint": "be759656ba1df888", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-67-integration-sync-check.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-be759656ba1df888", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a992d23bb680dd1a", "scanner": "scanner-primary", "fingerprint": "be759656ba1df888", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-67-integration-sync-check.yml"}, "region": {"startLine": 231}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "31e367dcbe87031f", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 195}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 228}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "99edfd949065d361", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 293}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "99edfd949065d361", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 309}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 329}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 354}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 397}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 454}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 539}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "99edfd949065d361", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 572}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "99edfd949065d361", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 580}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 590}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 762}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 1011}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 1033}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 1058}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 1140}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 1164}}}]}, {"ruleId": "scanner-77d323761a11324c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9d5e0f83d69ce3e3", "scanner": "scanner-primary", "fingerprint": "77d323761a11324c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 1203}}}]}, {"ruleId": "scanner-f4b2c283cedd63b1", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "23073f5700cd09b1", "scanner": "scanner-primary", "fingerprint": "f4b2c283cedd63b1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c4de2abca0c8b6d1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "44bfb9102fae49f5", "scanner": "scanner-primary", "fingerprint": "c4de2abca0c8b6d1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-39-test-llm-providers.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-c4de2abca0c8b6d1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "29306261aa9269f2", "scanner": "scanner-primary", "fingerprint": "c4de2abca0c8b6d1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-39-test-llm-providers.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-f71b264d2e822989", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "27068f6abee7161d", "scanner": "scanner-primary", "fingerprint": "f71b264d2e822989", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-auto-label.yml"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-f71b264d2e822989", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "78c381d401c48670", "scanner": "scanner-primary", "fingerprint": "f71b264d2e822989", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-auto-label.yml"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-f71b264d2e822989", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7503a0892fda92a1", "scanner": "scanner-primary", "fingerprint": "f71b264d2e822989", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-auto-label.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-f71b264d2e822989", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "676f91994de312ab", "scanner": "scanner-primary", "fingerprint": "f71b264d2e822989", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-auto-label.yml"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-f71b264d2e822989", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "676f91994de312ab", "scanner": "scanner-primary", "fingerprint": "f71b264d2e822989", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-auto-label.yml"}, "region": {"startLine": 246}}}]}, {"ruleId": "scanner-f71b264d2e822989", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "676f91994de312ab", "scanner": "scanner-primary", "fingerprint": "f71b264d2e822989", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-auto-label.yml"}, "region": {"startLine": 298}}}]}, {"ruleId": "scanner-e345456e5f3416be", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "062050a471a80026", "scanner": "scanner-primary", "fingerprint": "e345456e5f3416be", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-40-repo-selfcheck.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-e345456e5f3416be", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "062050a471a80026", "scanner": "scanner-primary", "fingerprint": "e345456e5f3416be", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-40-repo-selfcheck.yml"}, "region": {"startLine": 143}}}]}, {"ruleId": "scanner-e345456e5f3416be", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "062050a471a80026", "scanner": "scanner-primary", "fingerprint": "e345456e5f3416be", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-40-repo-selfcheck.yml"}, "region": {"startLine": 869}}}]}, {"ruleId": "scanner-e345456e5f3416be", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "062050a471a80026", "scanner": "scanner-primary", "fingerprint": "e345456e5f3416be", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-40-repo-selfcheck.yml"}, "region": {"startLine": 979}}}]}, {"ruleId": "scanner-e345456e5f3416be", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "062050a471a80026", "scanner": "scanner-primary", "fingerprint": "e345456e5f3416be", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-40-repo-selfcheck.yml"}, "region": {"startLine": 1024}}}]}, {"ruleId": "scanner-e345456e5f3416be", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6c4eaa31632bab97", "scanner": "scanner-primary", "fingerprint": "e345456e5f3416be", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-40-repo-selfcheck.yml"}, "region": {"startLine": 1161}}}]}, {"ruleId": "scanner-e345456e5f3416be", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "062050a471a80026", "scanner": "scanner-primary", "fingerprint": "e345456e5f3416be", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-40-repo-selfcheck.yml"}, "region": {"startLine": 1174}}}]}, {"ruleId": "scanner-3677815fe1b4b050", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "beb6202b5a0b3359", "scanner": "scanner-primary", "fingerprint": "3677815fe1b4b050", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-71-codex-belt-dispatcher.yml"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-3677815fe1b4b050", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9483a6b00141e413", "scanner": "scanner-primary", "fingerprint": "3677815fe1b4b050", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-71-codex-belt-dispatcher.yml"}, "region": {"startLine": 170}}}]}, {"ruleId": "scanner-3677815fe1b4b050", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9483a6b00141e413", "scanner": "scanner-primary", "fingerprint": "3677815fe1b4b050", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-71-codex-belt-dispatcher.yml"}, "region": {"startLine": 186}}}]}, {"ruleId": "scanner-3677815fe1b4b050", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0979455905cf55d9", "scanner": "scanner-primary", "fingerprint": "3677815fe1b4b050", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-71-codex-belt-dispatcher.yml"}, "region": {"startLine": 201}}}]}, {"ruleId": "scanner-3677815fe1b4b050", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9483a6b00141e413", "scanner": "scanner-primary", "fingerprint": "3677815fe1b4b050", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-71-codex-belt-dispatcher.yml"}, "region": {"startLine": 296}}}]}, {"ruleId": "scanner-3677815fe1b4b050", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0979455905cf55d9", "scanner": "scanner-primary", "fingerprint": "3677815fe1b4b050", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-71-codex-belt-dispatcher.yml"}, "region": {"startLine": 323}}}]}, {"ruleId": "scanner-4a7be3f043eba99b", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "6906cb4bbaf39e26", "scanner": "scanner-primary", "fingerprint": "4a7be3f043eba99b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-71-codex-belt-dispatcher.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9d6d248183a86cfb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2981a492366ba1d4", "scanner": "scanner-primary", "fingerprint": "9d6d248183a86cfb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-69-sync-integration-repo.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-9d6d248183a86cfb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7cf2963b376abdce", "scanner": "scanner-primary", "fingerprint": "9d6d248183a86cfb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-69-sync-integration-repo.yml"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-9d6d248183a86cfb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a376f67ec2b77cec", "scanner": "scanner-primary", "fingerprint": "9d6d248183a86cfb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-69-sync-integration-repo.yml"}, "region": {"startLine": 238}}}]}, {"ruleId": "scanner-9d6d248183a86cfb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2981a492366ba1d4", "scanner": "scanner-primary", "fingerprint": "9d6d248183a86cfb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-69-sync-integration-repo.yml"}, "region": {"startLine": 297}}}]}, {"ruleId": "scanner-9d6d248183a86cfb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a376f67ec2b77cec", "scanner": "scanner-primary", "fingerprint": "9d6d248183a86cfb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-69-sync-integration-repo.yml"}, "region": {"startLine": 304}}}]}, {"ruleId": "scanner-399efae9049064e9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b4dfd0d021279975", "scanner": "scanner-primary", "fingerprint": "399efae9049064e9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-72-fix-pr-body-conflicts.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-399efae9049064e9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c6e5660b47018c17", "scanner": "scanner-primary", "fingerprint": "399efae9049064e9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-72-fix-pr-body-conflicts.yml"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-399efae9049064e9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b4dfd0d021279975", "scanner": "scanner-primary", "fingerprint": "399efae9049064e9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-72-fix-pr-body-conflicts.yml"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-399efae9049064e9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "23eed237cd9a840c", "scanner": "scanner-primary", "fingerprint": "399efae9049064e9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-72-fix-pr-body-conflicts.yml"}, "region": {"startLine": 154}}}]}, {"ruleId": "scanner-309528b19955634b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4bf52b9dae71b547", "scanner": "scanner-primary", "fingerprint": "309528b19955634b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-75-api-rate-diagnostic.yml"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-309528b19955634b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "318ac7409aa95d14", "scanner": "scanner-primary", "fingerprint": "309528b19955634b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-75-api-rate-diagnostic.yml"}, "region": {"startLine": 122}}}]}, {"ruleId": "scanner-309528b19955634b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "318ac7409aa95d14", "scanner": "scanner-primary", "fingerprint": "309528b19955634b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-75-api-rate-diagnostic.yml"}, "region": {"startLine": 140}}}]}, {"ruleId": "scanner-309528b19955634b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "318ac7409aa95d14", "scanner": "scanner-primary", "fingerprint": "309528b19955634b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-75-api-rate-diagnostic.yml"}, "region": {"startLine": 159}}}]}, {"ruleId": "scanner-309528b19955634b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4bf52b9dae71b547", "scanner": "scanner-primary", "fingerprint": "309528b19955634b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-75-api-rate-diagnostic.yml"}, "region": {"startLine": 226}}}]}, {"ruleId": "scanner-309528b19955634b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6905b14dc8b7a576", "scanner": "scanner-primary", "fingerprint": "309528b19955634b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-75-api-rate-diagnostic.yml"}, "region": {"startLine": 229}}}]}, {"ruleId": "scanner-309528b19955634b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4bf52b9dae71b547", "scanner": "scanner-primary", "fingerprint": "309528b19955634b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-75-api-rate-diagnostic.yml"}, "region": {"startLine": 266}}}]}, {"ruleId": "scanner-309528b19955634b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4bf52b9dae71b547", "scanner": "scanner-primary", "fingerprint": "309528b19955634b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-75-api-rate-diagnostic.yml"}, "region": {"startLine": 319}}}]}, {"ruleId": "scanner-309528b19955634b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4bf52b9dae71b547", "scanner": "scanner-primary", "fingerprint": "309528b19955634b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-75-api-rate-diagnostic.yml"}, "region": {"startLine": 345}}}]}, {"ruleId": "scanner-309528b19955634b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4bf52b9dae71b547", "scanner": "scanner-primary", "fingerprint": "309528b19955634b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-75-api-rate-diagnostic.yml"}, "region": {"startLine": 375}}}]}, {"ruleId": "scanner-309528b19955634b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4bf52b9dae71b547", "scanner": "scanner-primary", "fingerprint": "309528b19955634b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-75-api-rate-diagnostic.yml"}, "region": {"startLine": 395}}}]}, {"ruleId": "scanner-309528b19955634b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "318ac7409aa95d14", "scanner": "scanner-primary", "fingerprint": "309528b19955634b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-75-api-rate-diagnostic.yml"}, "region": {"startLine": 413}}}]}, {"ruleId": "scanner-250937ea2782df50", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9f6d9a19b797aea2", "scanner": "scanner-primary", "fingerprint": "250937ea2782df50", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-sync-action-versions.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-250937ea2782df50", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "85b2d3443af8f66d", "scanner": "scanner-primary", "fingerprint": "250937ea2782df50", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-sync-action-versions.yml"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-c59de2a04db9442e", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "dfec0c3727541511", "scanner": "scanner-primary", "fingerprint": "c59de2a04db9442e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-sync-action-versions.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64d9be72d8da869e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "810cb0c4b2675fc9", "scanner": "scanner-primary", "fingerprint": "64d9be72d8da869e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-65-sync-label-docs.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-44fa40b88bbf216d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "10e5c9905cfaa5a8", "scanner": "scanner-primary", "fingerprint": "44fa40b88bbf216d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-81-langsmith-fleet-conformance.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-44fa40b88bbf216d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0023d0a0ae466a30", "scanner": "scanner-primary", "fingerprint": "44fa40b88bbf216d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-81-langsmith-fleet-conformance.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-44fa40b88bbf216d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cb495da17ed20ac4", "scanner": "scanner-primary", "fingerprint": "44fa40b88bbf216d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-81-langsmith-fleet-conformance.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-44fa40b88bbf216d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7e27da3dc3a43e0b", "scanner": "scanner-primary", "fingerprint": "44fa40b88bbf216d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-81-langsmith-fleet-conformance.yml"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d0b24191312e2752", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8728024932a15811", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6213310e2703776", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 178}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d0b24191312e2752", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 193}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8728024932a15811", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 196}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "966fb82f3a47ee6a", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 204}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d0b24191312e2752", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 287}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "966fb82f3a47ee6a", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 298}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8728024932a15811", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 303}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f9e51b58ca69a311", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 758}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6213310e2703776", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 1030}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d0b24191312e2752", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 1048}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "966fb82f3a47ee6a", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 1055}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6213310e2703776", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 1145}}}]}, {"ruleId": "scanner-3e16d9d729ef4992", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d0b24191312e2752", "scanner": "scanner-primary", "fingerprint": "3e16d9d729ef4992", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-68-sync-consumer-repos.yml"}, "region": {"startLine": 1162}}}]}, {"ruleId": "scanner-0531ca6bf1ee3ab7", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13cbce66e4509b3a", "scanner": "scanner-primary", "fingerprint": "0531ca6bf1ee3ab7", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-sync-env-from-pyproject.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9edf90b203ed6e49", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "14c0b512e438af18", "scanner": "scanner-primary", "fingerprint": "9edf90b203ed6e49", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-46-post-ci.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-9edf90b203ed6e49", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "615098d112199014", "scanner": "scanner-primary", "fingerprint": "9edf90b203ed6e49", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-46-post-ci.yml"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-9edf90b203ed6e49", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "14c0b512e438af18", "scanner": "scanner-primary", "fingerprint": "9edf90b203ed6e49", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-46-post-ci.yml"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-9edf90b203ed6e49", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e831570be951e46f", "scanner": "scanner-primary", "fingerprint": "9edf90b203ed6e49", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-46-post-ci.yml"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-9edf90b203ed6e49", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3a26d2622c3ed04f", "scanner": "scanner-primary", "fingerprint": "9edf90b203ed6e49", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-46-post-ci.yml"}, "region": {"startLine": 270}}}]}, {"ruleId": "scanner-9edf90b203ed6e49", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "14c0b512e438af18", "scanner": "scanner-primary", "fingerprint": "9edf90b203ed6e49", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-46-post-ci.yml"}, "region": {"startLine": 284}}}]}, {"ruleId": "scanner-47466df40129a4c7", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d709ac5b3423accc", "scanner": "scanner-primary", "fingerprint": "47466df40129a4c7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-backplane-conformance.yml"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-47466df40129a4c7", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d709ac5b3423accc", "scanner": "scanner-primary", "fingerprint": "47466df40129a4c7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-backplane-conformance.yml"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-47466df40129a4c7", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f70c2b134f204241", "scanner": "scanner-primary", "fingerprint": "47466df40129a4c7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-backplane-conformance.yml"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-47466df40129a4c7", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "afbd3a47b7b25cdf", "scanner": "scanner-primary", "fingerprint": "47466df40129a4c7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-backplane-conformance.yml"}, "region": {"startLine": 122}}}]}, {"ruleId": "scanner-89edd483bc7f49e6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a74316142793b8f4", "scanner": "scanner-primary", "fingerprint": "89edd483bc7f49e6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-dedup.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-89edd483bc7f49e6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "96a736428c12ef14", "scanner": "scanner-primary", "fingerprint": "89edd483bc7f49e6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-dedup.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-89edd483bc7f49e6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "02df23630079d288", "scanner": "scanner-primary", "fingerprint": "89edd483bc7f49e6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-dedup.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-89edd483bc7f49e6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "02df23630079d288", "scanner": "scanner-primary", "fingerprint": "89edd483bc7f49e6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-dedup.yml"}, "region": {"startLine": 221}}}]}, {"ruleId": "scanner-f2c633470fcf470e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8394e62820a2cb8a", "scanner": "scanner-primary", "fingerprint": "f2c633470fcf470e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-73-codex-belt-conveyor.yml"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-f2c633470fcf470e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e86c9c4950fc085a", "scanner": "scanner-primary", "fingerprint": "f2c633470fcf470e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-73-codex-belt-conveyor.yml"}, "region": {"startLine": 186}}}]}, {"ruleId": "scanner-f2c633470fcf470e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cd473d461f3e530f", "scanner": "scanner-primary", "fingerprint": "f2c633470fcf470e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-73-codex-belt-conveyor.yml"}, "region": {"startLine": 207}}}]}, {"ruleId": "scanner-f2c633470fcf470e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cd473d461f3e530f", "scanner": "scanner-primary", "fingerprint": "f2c633470fcf470e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-73-codex-belt-conveyor.yml"}, "region": {"startLine": 271}}}]}, {"ruleId": "scanner-f2c633470fcf470e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cd473d461f3e530f", "scanner": "scanner-primary", "fingerprint": "f2c633470fcf470e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-73-codex-belt-conveyor.yml"}, "region": {"startLine": 332}}}]}, {"ruleId": "scanner-f2c633470fcf470e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cd473d461f3e530f", "scanner": "scanner-primary", "fingerprint": "f2c633470fcf470e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-73-codex-belt-conveyor.yml"}, "region": {"startLine": 361}}}]}, {"ruleId": "scanner-f2c633470fcf470e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cd473d461f3e530f", "scanner": "scanner-primary", "fingerprint": "f2c633470fcf470e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-73-codex-belt-conveyor.yml"}, "region": {"startLine": 436}}}]}, {"ruleId": "scanner-f2c633470fcf470e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cd473d461f3e530f", "scanner": "scanner-primary", "fingerprint": "f2c633470fcf470e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-73-codex-belt-conveyor.yml"}, "region": {"startLine": 461}}}]}, {"ruleId": "scanner-f2c633470fcf470e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cd473d461f3e530f", "scanner": "scanner-primary", "fingerprint": "f2c633470fcf470e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-73-codex-belt-conveyor.yml"}, "region": {"startLine": 485}}}]}, {"ruleId": "scanner-f2c633470fcf470e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cd473d461f3e530f", "scanner": "scanner-primary", "fingerprint": "f2c633470fcf470e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-73-codex-belt-conveyor.yml"}, "region": {"startLine": 531}}}]}, {"ruleId": "scanner-f2c633470fcf470e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cd473d461f3e530f", "scanner": "scanner-primary", "fingerprint": "f2c633470fcf470e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-73-codex-belt-conveyor.yml"}, "region": {"startLine": 563}}}]}, {"ruleId": "scanner-28330c57550d0d67", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "366e55a5ff303340", "scanner": "scanner-primary", "fingerprint": "28330c57550d0d67", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-73-codex-belt-conveyor.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-48fda8a5aded5ab5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ead17ff5be16b3a", "scanner": "scanner-primary", "fingerprint": "48fda8a5aded5ab5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-guard.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-48fda8a5aded5ab5", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f342ad7945b902d8", "scanner": "scanner-primary", "fingerprint": "48fda8a5aded5ab5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-guard.yml"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-48fda8a5aded5ab5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5a70c6f5e3cd6634", "scanner": "scanner-primary", "fingerprint": "48fda8a5aded5ab5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-guard.yml"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-48fda8a5aded5ab5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ead17ff5be16b3a", "scanner": "scanner-primary", "fingerprint": "48fda8a5aded5ab5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-guard.yml"}, "region": {"startLine": 130}}}]}, {"ruleId": "scanner-48fda8a5aded5ab5", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f342ad7945b902d8", "scanner": "scanner-primary", "fingerprint": "48fda8a5aded5ab5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-guard.yml"}, "region": {"startLine": 173}}}]}, {"ruleId": "scanner-48fda8a5aded5ab5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5a70c6f5e3cd6634", "scanner": "scanner-primary", "fingerprint": "48fda8a5aded5ab5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-guard.yml"}, "region": {"startLine": 182}}}]}, {"ruleId": "scanner-48fda8a5aded5ab5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5a70c6f5e3cd6634", "scanner": "scanner-primary", "fingerprint": "48fda8a5aded5ab5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-guard.yml"}, "region": {"startLine": 445}}}]}, {"ruleId": "scanner-48fda8a5aded5ab5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5a70c6f5e3cd6634", "scanner": "scanner-primary", "fingerprint": "48fda8a5aded5ab5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-guard.yml"}, "region": {"startLine": 593}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2197fd2ae5c922b9", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "62cd8d986363e41a", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "58f4a0d059c0964e", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "58f4a0d059c0964e", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 267}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "58f4a0d059c0964e", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 331}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2305ff0bcce949d6", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 520}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2197fd2ae5c922b9", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 635}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "62cd8d986363e41a", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 638}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "58f4a0d059c0964e", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 651}}}]}, {"ruleId": "scanner-8bd07d5711d230ac", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "5ed97d146f9911bd", "scanner": "scanner-primary", "fingerprint": "8bd07d5711d230ac", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 686}}}]}, {"ruleId": "scanner-8bd07d5711d230ac", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "b18ff5253e9b3f13", "scanner": "scanner-primary", "fingerprint": "8bd07d5711d230ac", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 719}}}]}, {"ruleId": "scanner-8bd07d5711d230ac", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "60de811e3120caaf", "scanner": "scanner-primary", "fingerprint": "8bd07d5711d230ac", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 751}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2197fd2ae5c922b9", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 789}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2197fd2ae5c922b9", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 855}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "62cd8d986363e41a", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 858}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2ec09fed0e6eb342", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 871}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "58f4a0d059c0964e", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 880}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "58f4a0d059c0964e", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 923}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "58f4a0d059c0964e", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 1023}}}]}, {"ruleId": "scanner-e2a867920709ce60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2197fd2ae5c922b9", "scanner": "scanner-primary", "fingerprint": "e2a867920709ce60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 1119}}}]}, {"ruleId": "scanner-7fe4de9c8a34f3ee", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "3060ace51435dcc9", "scanner": "scanner-primary", "fingerprint": "7fe4de9c8a34f3ee", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eb0aa26a6e890141", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69e2b79d0018f3b1", "scanner": "scanner-primary", "fingerprint": "eb0aa26a6e890141", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-coverage-guard.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-eb0aa26a6e890141", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "29fe57cd875f18cc", "scanner": "scanner-primary", "fingerprint": "eb0aa26a6e890141", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-coverage-guard.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-eb0aa26a6e890141", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69e2b79d0018f3b1", "scanner": "scanner-primary", "fingerprint": "eb0aa26a6e890141", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-coverage-guard.yml"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-eb0aa26a6e890141", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69e2b79d0018f3b1", "scanner": "scanner-primary", "fingerprint": "eb0aa26a6e890141", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-coverage-guard.yml"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-eb0aa26a6e890141", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "29fe57cd875f18cc", "scanner": "scanner-primary", "fingerprint": "eb0aa26a6e890141", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-coverage-guard.yml"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-488846bceaadaa63", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "d2e45a9c2a5e8354", "scanner": "scanner-primary", "fingerprint": "488846bceaadaa63", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-72-codex-belt-worker-dispatch.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ec2ba082359a71d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d8bf712c380cbc80", "scanner": "scanner-primary", "fingerprint": "3ec2ba082359a71d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-83-bootstrap-consumer.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-3ec2ba082359a71d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ffcbb84ecd94674", "scanner": "scanner-primary", "fingerprint": "3ec2ba082359a71d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-83-bootstrap-consumer.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-1145d2ad2a317f49", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5c3f0436bb3d5971", "scanner": "scanner-primary", "fingerprint": "1145d2ad2a317f49", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-51-zizmor.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-1145d2ad2a317f49", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c3f443fca3ba5cd3", "scanner": "scanner-primary", "fingerprint": "1145d2ad2a317f49", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-51-zizmor.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-da7d1b26a9cd7aa8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0f083690ec7758b1", "scanner": "scanner-primary", "fingerprint": "da7d1b26a9cd7aa8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-verifier.yml"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-da7d1b26a9cd7aa8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "24079c3a55b42c32", "scanner": "scanner-primary", "fingerprint": "da7d1b26a9cd7aa8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-verifier.yml"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-da7d1b26a9cd7aa8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "24079c3a55b42c32", "scanner": "scanner-primary", "fingerprint": "da7d1b26a9cd7aa8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-verifier.yml"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-da7d1b26a9cd7aa8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "92e5291b6005818a", "scanner": "scanner-primary", "fingerprint": "da7d1b26a9cd7aa8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-verifier.yml"}, "region": {"startLine": 149}}}]}, {"ruleId": "scanner-da7d1b26a9cd7aa8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "92e5291b6005818a", "scanner": "scanner-primary", "fingerprint": "da7d1b26a9cd7aa8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-verifier.yml"}, "region": {"startLine": 336}}}]}, {"ruleId": "scanner-da7d1b26a9cd7aa8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "92e5291b6005818a", "scanner": "scanner-primary", "fingerprint": "da7d1b26a9cd7aa8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-verifier.yml"}, "region": {"startLine": 362}}}]}, {"ruleId": "scanner-da7d1b26a9cd7aa8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "53eeee6f8ec1ed43", "scanner": "scanner-primary", "fingerprint": "da7d1b26a9cd7aa8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-verifier.yml"}, "region": {"startLine": 645}}}]}, {"ruleId": "scanner-da7d1b26a9cd7aa8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2ceb0df7c018422d", "scanner": "scanner-primary", "fingerprint": "da7d1b26a9cd7aa8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-verifier.yml"}, "region": {"startLine": 655}}}]}, {"ruleId": "scanner-da7d1b26a9cd7aa8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "53eeee6f8ec1ed43", "scanner": "scanner-primary", "fingerprint": "da7d1b26a9cd7aa8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-verifier.yml"}, "region": {"startLine": 954}}}]}, {"ruleId": "scanner-da7d1b26a9cd7aa8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2ceb0df7c018422d", "scanner": "scanner-primary", "fingerprint": "da7d1b26a9cd7aa8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-verifier.yml"}, "region": {"startLine": 964}}}]}, {"ruleId": "scanner-da7d1b26a9cd7aa8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "923b94c124566dfd", "scanner": "scanner-primary", "fingerprint": "da7d1b26a9cd7aa8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-verifier.yml"}, "region": {"startLine": 1183}}}]}, {"ruleId": "scanner-da7d1b26a9cd7aa8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "92e5291b6005818a", "scanner": "scanner-primary", "fingerprint": "da7d1b26a9cd7aa8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-verifier.yml"}, "region": {"startLine": 1230}}}]}, {"ruleId": "scanner-da7d1b26a9cd7aa8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "923b94c124566dfd", "scanner": "scanner-primary", "fingerprint": "da7d1b26a9cd7aa8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-verifier.yml"}, "region": {"startLine": 1703}}}]}, {"ruleId": "scanner-da7d1b26a9cd7aa8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "923b94c124566dfd", "scanner": "scanner-primary", "fingerprint": "da7d1b26a9cd7aa8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-verifier.yml"}, "region": {"startLine": 1753}}}]}, {"ruleId": "scanner-cafcb04846fb4407", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d63f1dc33a2e0b85", "scanner": "scanner-primary", "fingerprint": "cafcb04846fb4407", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-52-sync-dev-versions.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-cafcb04846fb4407", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "23e41894f39a63ae", "scanner": "scanner-primary", "fingerprint": "cafcb04846fb4407", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-52-sync-dev-versions.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-cafcb04846fb4407", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d63f1dc33a2e0b85", "scanner": "scanner-primary", "fingerprint": "cafcb04846fb4407", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-52-sync-dev-versions.yml"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-cafcb04846fb4407", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4265ba1d7275b4f2", "scanner": "scanner-primary", "fingerprint": "cafcb04846fb4407", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-52-sync-dev-versions.yml"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-cafcb04846fb4407", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "87d0540bed802819", "scanner": "scanner-primary", "fingerprint": "cafcb04846fb4407", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-52-sync-dev-versions.yml"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-cafcb04846fb4407", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "23e41894f39a63ae", "scanner": "scanner-primary", "fingerprint": "cafcb04846fb4407", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-52-sync-dev-versions.yml"}, "region": {"startLine": 149}}}]}, {"ruleId": "scanner-1de7e863bad78667", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9c829dd2a79b8cac", "scanner": "scanner-primary", "fingerprint": "1de7e863bad78667", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-pr-context.yml"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-1de7e863bad78667", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b1492e74da173184", "scanner": "scanner-primary", "fingerprint": "1de7e863bad78667", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-pr-context.yml"}, "region": {"startLine": 162}}}]}, {"ruleId": "scanner-1de7e863bad78667", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5de16a6f58348a1b", "scanner": "scanner-primary", "fingerprint": "1de7e863bad78667", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-pr-context.yml"}, "region": {"startLine": 187}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d2843024947a37d6", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 188}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "45568027422f5dc4", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 217}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "706e442aaf75049c", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 235}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0a66af5c0372d21e", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 538}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d2843024947a37d6", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 562}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1a31a89ce3402abf", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 587}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "45568027422f5dc4", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 593}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "706e442aaf75049c", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 603}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d2843024947a37d6", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 687}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1a31a89ce3402abf", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 712}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "706e442aaf75049c", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 718}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d2843024947a37d6", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 774}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1a31a89ce3402abf", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 799}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "45568027422f5dc4", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 805}}}]}, {"ruleId": "scanner-196be7dfe65aff36", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "706e442aaf75049c", "scanner": "scanner-primary", "fingerprint": "196be7dfe65aff36", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 815}}}]}, {"ruleId": "scanner-39056eaec4265331", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "49959955f639c85f", "scanner": "scanner-primary", "fingerprint": "39056eaec4265331", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-pr-health.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a7480ad332bdf2ca", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "af4b0977549e0bbe", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 253}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "af4b0977549e0bbe", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 273}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "af4b0977549e0bbe", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 296}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2a6cd3004c258a9", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 352}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2a6cd3004c258a9", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 401}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c4163784027dc4e3", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 949}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2a6cd3004c258a9", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 961}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2a6cd3004c258a9", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 1081}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c4163784027dc4e3", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 1388}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "af4b0977549e0bbe", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 1448}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2a6cd3004c258a9", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 1477}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2a6cd3004c258a9", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 1552}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2a6cd3004c258a9", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 1638}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2a6cd3004c258a9", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 1719}}}]}, {"ruleId": "scanner-0164a9e6e0e931a2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c4163784027dc4e3", "scanner": "scanner-primary", "fingerprint": "0164a9e6e0e931a2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 1821}}}]}, {"ruleId": "scanner-b95a2a2e3703744d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "cdafd4adc51e9b77", "scanner": "scanner-primary", "fingerprint": "b95a2a2e3703744d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-18-autofix.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-82d6901a63cdda33", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3280a324fb24c8ff", "scanner": "scanner-primary", "fingerprint": "82d6901a63cdda33", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-auto-update-pypi-versions.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-82d6901a63cdda33", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f7f01642ba68fed3", "scanner": "scanner-primary", "fingerprint": "82d6901a63cdda33", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-auto-update-pypi-versions.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-3bd93fcf00832db8", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "47fe49c82b879318", "scanner": "scanner-primary", "fingerprint": "3bd93fcf00832db8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-auto-update-pypi-versions.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f65df2c53b39220", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c1898aaff646ec4e", "scanner": "scanner-primary", "fingerprint": "3f65df2c53b39220", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-pr-meta-v4.yml"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-3f65df2c53b39220", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c1898aaff646ec4e", "scanner": "scanner-primary", "fingerprint": "3f65df2c53b39220", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-pr-meta-v4.yml"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-3f65df2c53b39220", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "491cff721434739a", "scanner": "scanner-primary", "fingerprint": "3f65df2c53b39220", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-pr-meta-v4.yml"}, "region": {"startLine": 170}}}]}, {"ruleId": "scanner-3f65df2c53b39220", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c1898aaff646ec4e", "scanner": "scanner-primary", "fingerprint": "3f65df2c53b39220", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-pr-meta-v4.yml"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-3f65df2c53b39220", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c1898aaff646ec4e", "scanner": "scanner-primary", "fingerprint": "3f65df2c53b39220", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-pr-meta-v4.yml"}, "region": {"startLine": 234}}}]}, {"ruleId": "scanner-3f65df2c53b39220", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c1898aaff646ec4e", "scanner": "scanner-primary", "fingerprint": "3f65df2c53b39220", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-pr-meta-v4.yml"}, "region": {"startLine": 264}}}]}, {"ruleId": "scanner-3f65df2c53b39220", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c1898aaff646ec4e", "scanner": "scanner-primary", "fingerprint": "3f65df2c53b39220", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-pr-meta-v4.yml"}, "region": {"startLine": 307}}}]}, {"ruleId": "scanner-3f65df2c53b39220", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "491cff721434739a", "scanner": "scanner-primary", "fingerprint": "3f65df2c53b39220", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-pr-meta-v4.yml"}, "region": {"startLine": 328}}}]}, {"ruleId": "scanner-3f65df2c53b39220", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c1898aaff646ec4e", "scanner": "scanner-primary", "fingerprint": "3f65df2c53b39220", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-pr-meta-v4.yml"}, "region": {"startLine": 335}}}]}, {"ruleId": "scanner-3f65df2c53b39220", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "491cff721434739a", "scanner": "scanner-primary", "fingerprint": "3f65df2c53b39220", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-pr-meta-v4.yml"}, "region": {"startLine": 534}}}]}, {"ruleId": "scanner-3f65df2c53b39220", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c1898aaff646ec4e", "scanner": "scanner-primary", "fingerprint": "3f65df2c53b39220", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-pr-meta-v4.yml"}, "region": {"startLine": 541}}}]}, {"ruleId": "scanner-d54cb754ef6d9f50", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7b44da82fe41cb9e", "scanner": "scanner-primary", "fingerprint": "d54cb754ef6d9f50", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-issue-optimizer.yml"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-d54cb754ef6d9f50", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "29bf10ffd30b0522", "scanner": "scanner-primary", "fingerprint": "d54cb754ef6d9f50", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-issue-optimizer.yml"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-d54cb754ef6d9f50", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7165e0454ea00572", "scanner": "scanner-primary", "fingerprint": "d54cb754ef6d9f50", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-issue-optimizer.yml"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-0e1e19521aecb210", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8964ffcbbcdd2515", "scanner": "scanner-primary", "fingerprint": "0e1e19521aecb210", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/selftest-ci.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-0e1e19521aecb210", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0797916497597f20", "scanner": "scanner-primary", "fingerprint": "0e1e19521aecb210", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/selftest-ci.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-0e1e19521aecb210", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0797916497597f20", "scanner": "scanner-primary", "fingerprint": "0e1e19521aecb210", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/selftest-ci.yml"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-6569e514dcd771b4", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "22ed75abf8ba6010", "scanner": "scanner-primary", "fingerprint": "6569e514dcd771b4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-40-sweep.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-16e43188220c7e1c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5471da842e35d952", "scanner": "scanner-primary", "fingerprint": "16e43188220c7e1c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-init.yml"}, "region": {"startLine": 121}}}]}, {"ruleId": "scanner-16e43188220c7e1c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e5cc4ca1610d8623", "scanner": "scanner-primary", "fingerprint": "16e43188220c7e1c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-init.yml"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-16e43188220c7e1c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5471da842e35d952", "scanner": "scanner-primary", "fingerprint": "16e43188220c7e1c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-init.yml"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-16e43188220c7e1c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e5cc4ca1610d8623", "scanner": "scanner-primary", "fingerprint": "16e43188220c7e1c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-init.yml"}, "region": {"startLine": 217}}}]}, {"ruleId": "scanner-16e43188220c7e1c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c2bd2f995757ba26", "scanner": "scanner-primary", "fingerprint": "16e43188220c7e1c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-init.yml"}, "region": {"startLine": 394}}}]}, {"ruleId": "scanner-16e43188220c7e1c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e5cc4ca1610d8623", "scanner": "scanner-primary", "fingerprint": "16e43188220c7e1c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-init.yml"}, "region": {"startLine": 426}}}]}, {"ruleId": "scanner-16e43188220c7e1c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e5cc4ca1610d8623", "scanner": "scanner-primary", "fingerprint": "16e43188220c7e1c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-init.yml"}, "region": {"startLine": 528}}}]}, {"ruleId": "scanner-16e43188220c7e1c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5471da842e35d952", "scanner": "scanner-primary", "fingerprint": "16e43188220c7e1c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-init.yml"}, "region": {"startLine": 549}}}]}, {"ruleId": "scanner-16e43188220c7e1c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e5cc4ca1610d8623", "scanner": "scanner-primary", "fingerprint": "16e43188220c7e1c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-init.yml"}, "region": {"startLine": 560}}}]}, {"ruleId": "scanner-16e43188220c7e1c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5471da842e35d952", "scanner": "scanner-primary", "fingerprint": "16e43188220c7e1c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-init.yml"}, "region": {"startLine": 575}}}]}, {"ruleId": "scanner-16e43188220c7e1c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e5cc4ca1610d8623", "scanner": "scanner-primary", "fingerprint": "16e43188220c7e1c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-init.yml"}, "region": {"startLine": 586}}}]}, {"ruleId": "scanner-49c2074ff5fe0f0d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2c5280f8508c443b", "scanner": "scanner-primary", "fingerprint": "49c2074ff5fe0f0d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-71-sync-health-check.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-f16226d3af981e89", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7f39c0c4ffdf4f8c", "scanner": "scanner-primary", "fingerprint": "f16226d3af981e89", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-decompose.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-f16226d3af981e89", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5403a9a85f1c7494", "scanner": "scanner-primary", "fingerprint": "f16226d3af981e89", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-decompose.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-f16226d3af981e89", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bdcf7948189bbe23", "scanner": "scanner-primary", "fingerprint": "f16226d3af981e89", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-decompose.yml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-f16226d3af981e89", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bdcf7948189bbe23", "scanner": "scanner-primary", "fingerprint": "f16226d3af981e89", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-decompose.yml"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-f16226d3af981e89", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bdcf7948189bbe23", "scanner": "scanner-primary", "fingerprint": "f16226d3af981e89", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-decompose.yml"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-b54c7677ab4b1e81", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "abfaf3a7b32a6d43", "scanner": "scanner-primary", "fingerprint": "b54c7677ab4b1e81", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-71-auto-fix-integration.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-b54c7677ab4b1e81", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a9594517ada14fdd", "scanner": "scanner-primary", "fingerprint": "b54c7677ab4b1e81", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-71-auto-fix-integration.yml"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-b54c7677ab4b1e81", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "abfaf3a7b32a6d43", "scanner": "scanner-primary", "fingerprint": "b54c7677ab4b1e81", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-71-auto-fix-integration.yml"}, "region": {"startLine": 164}}}]}, {"ruleId": "scanner-b54c7677ab4b1e81", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8e3af0e6b730b155", "scanner": "scanner-primary", "fingerprint": "b54c7677ab4b1e81", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-71-auto-fix-integration.yml"}, "region": {"startLine": 173}}}]}, {"ruleId": "scanner-ccf0e0eb91804eba", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "09a0f1aaa9ce58be", "scanner": "scanner-primary", "fingerprint": "ccf0e0eb91804eba", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-50-tool-version-check.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-ccf0e0eb91804eba", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5f659d4f31436639", "scanner": "scanner-primary", "fingerprint": "ccf0e0eb91804eba", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-50-tool-version-check.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-ccf0e0eb91804eba", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f3a27cacd6903b7d", "scanner": "scanner-primary", "fingerprint": "ccf0e0eb91804eba", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-50-tool-version-check.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae63087609140602", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 132}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "48f67980667e10a1", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e68f7cbf8374cdda", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 155}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "48f67980667e10a1", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 260}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e68f7cbf8374cdda", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 270}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "48f67980667e10a1", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 362}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e68f7cbf8374cdda", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 373}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "48f67980667e10a1", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 564}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae63087609140602", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 575}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e68f7cbf8374cdda", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 582}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e68f7cbf8374cdda", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 1023}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e68f7cbf8374cdda", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 1082}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e68f7cbf8374cdda", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 1131}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e68f7cbf8374cdda", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 1241}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e68f7cbf8374cdda", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 1383}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae63087609140602", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 1502}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e68f7cbf8374cdda", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 1523}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e68f7cbf8374cdda", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 1618}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e68f7cbf8374cdda", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 1750}}}]}, {"ruleId": "scanner-25f986f263a8c57e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae63087609140602", "scanner": "scanner-primary", "fingerprint": "25f986f263a8c57e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 1876}}}]}, {"ruleId": "scanner-c6830dc26c77e586", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "1cc9c0bc701ee9db", "scanner": "scanner-primary", "fingerprint": "c6830dc26c77e586", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-70-orchestrator-main.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-91d94208d87f7bef", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "724d530095ad12b8", "scanner": "scanner-primary", "fingerprint": "91d94208d87f7bef", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-82-sync-dependency-campaign.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-91d94208d87f7bef", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b398afd84feae20e", "scanner": "scanner-primary", "fingerprint": "91d94208d87f7bef", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-82-sync-dependency-campaign.yml"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-91d94208d87f7bef", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8bb198a5646577ca", "scanner": "scanner-primary", "fingerprint": "91d94208d87f7bef", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-82-sync-dependency-campaign.yml"}, "region": {"startLine": 163}}}]}, {"ruleId": "scanner-5331fbf89a0d4391", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6affafe1d289913a", "scanner": "scanner-primary", "fingerprint": "5331fbf89a0d4391", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-63-issue-intake.yml"}, "region": {"startLine": 273}}}]}, {"ruleId": "scanner-5331fbf89a0d4391", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3da5a43b2c5ccbd8", "scanner": "scanner-primary", "fingerprint": "5331fbf89a0d4391", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-63-issue-intake.yml"}, "region": {"startLine": 276}}}]}, {"ruleId": "scanner-5331fbf89a0d4391", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2e8c79dc491829b", "scanner": "scanner-primary", "fingerprint": "5331fbf89a0d4391", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-63-issue-intake.yml"}, "region": {"startLine": 376}}}]}, {"ruleId": "scanner-5331fbf89a0d4391", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6affafe1d289913a", "scanner": "scanner-primary", "fingerprint": "5331fbf89a0d4391", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-63-issue-intake.yml"}, "region": {"startLine": 399}}}]}, {"ruleId": "scanner-5331fbf89a0d4391", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c5edfd30b47861e8", "scanner": "scanner-primary", "fingerprint": "5331fbf89a0d4391", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-63-issue-intake.yml"}, "region": {"startLine": 495}}}]}, {"ruleId": "scanner-5331fbf89a0d4391", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6affafe1d289913a", "scanner": "scanner-primary", "fingerprint": "5331fbf89a0d4391", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-63-issue-intake.yml"}, "region": {"startLine": 1337}}}]}, {"ruleId": "scanner-5331fbf89a0d4391", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c5edfd30b47861e8", "scanner": "scanner-primary", "fingerprint": "5331fbf89a0d4391", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-63-issue-intake.yml"}, "region": {"startLine": 1350}}}]}, {"ruleId": "scanner-5331fbf89a0d4391", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6affafe1d289913a", "scanner": "scanner-primary", "fingerprint": "5331fbf89a0d4391", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-63-issue-intake.yml"}, "region": {"startLine": 1477}}}]}, {"ruleId": "scanner-5331fbf89a0d4391", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "497fb4161b5cb40f", "scanner": "scanner-primary", "fingerprint": "5331fbf89a0d4391", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-63-issue-intake.yml"}, "region": {"startLine": 1480}}}]}, {"ruleId": "scanner-5331fbf89a0d4391", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3da5a43b2c5ccbd8", "scanner": "scanner-primary", "fingerprint": "5331fbf89a0d4391", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-63-issue-intake.yml"}, "region": {"startLine": 1491}}}]}, {"ruleId": "scanner-7ce7e19d9d3fee8b", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "fde11db4c894cf91", "scanner": "scanner-primary", "fingerprint": "7ce7e19d9d3fee8b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-63-issue-intake.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-281cd0efc87a62e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6b91a09265442421", "scanner": "scanner-primary", "fingerprint": "281cd0efc87a62e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-20-pr-meta.yml"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-281cd0efc87a62e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "51258d73544b5645", "scanner": "scanner-primary", "fingerprint": "281cd0efc87a62e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-20-pr-meta.yml"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-281cd0efc87a62e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6b91a09265442421", "scanner": "scanner-primary", "fingerprint": "281cd0efc87a62e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-20-pr-meta.yml"}, "region": {"startLine": 150}}}]}, {"ruleId": "scanner-281cd0efc87a62e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6b91a09265442421", "scanner": "scanner-primary", "fingerprint": "281cd0efc87a62e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-20-pr-meta.yml"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-281cd0efc87a62e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3bbc8cc00bba799b", "scanner": "scanner-primary", "fingerprint": "281cd0efc87a62e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-20-pr-meta.yml"}, "region": {"startLine": 215}}}]}, {"ruleId": "scanner-281cd0efc87a62e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3bbc8cc00bba799b", "scanner": "scanner-primary", "fingerprint": "281cd0efc87a62e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-20-pr-meta.yml"}, "region": {"startLine": 247}}}]}, {"ruleId": "scanner-281cd0efc87a62e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6b91a09265442421", "scanner": "scanner-primary", "fingerprint": "281cd0efc87a62e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-20-pr-meta.yml"}, "region": {"startLine": 292}}}]}, {"ruleId": "scanner-281cd0efc87a62e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3bbc8cc00bba799b", "scanner": "scanner-primary", "fingerprint": "281cd0efc87a62e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-20-pr-meta.yml"}, "region": {"startLine": 321}}}]}, {"ruleId": "scanner-281cd0efc87a62e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6b91a09265442421", "scanner": "scanner-primary", "fingerprint": "281cd0efc87a62e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-20-pr-meta.yml"}, "region": {"startLine": 369}}}]}, {"ruleId": "scanner-281cd0efc87a62e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3bbc8cc00bba799b", "scanner": "scanner-primary", "fingerprint": "281cd0efc87a62e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-20-pr-meta.yml"}, "region": {"startLine": 399}}}]}, {"ruleId": "scanner-281cd0efc87a62e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3bbc8cc00bba799b", "scanner": "scanner-primary", "fingerprint": "281cd0efc87a62e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-20-pr-meta.yml"}, "region": {"startLine": 435}}}]}, {"ruleId": "scanner-281cd0efc87a62e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3bbc8cc00bba799b", "scanner": "scanner-primary", "fingerprint": "281cd0efc87a62e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-20-pr-meta.yml"}, "region": {"startLine": 458}}}]}, {"ruleId": "scanner-281cd0efc87a62e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6b91a09265442421", "scanner": "scanner-primary", "fingerprint": "281cd0efc87a62e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-20-pr-meta.yml"}, "region": {"startLine": 526}}}]}, {"ruleId": "scanner-281cd0efc87a62e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3bbc8cc00bba799b", "scanner": "scanner-primary", "fingerprint": "281cd0efc87a62e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-20-pr-meta.yml"}, "region": {"startLine": 555}}}]}, {"ruleId": "scanner-164aa4bc88af43bc", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4b95c04d7028b109", "scanner": "scanner-primary", "fingerprint": "164aa4bc88af43bc", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-45-cosmetic-repair.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-164aa4bc88af43bc", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dcfcd7cddd620474", "scanner": "scanner-primary", "fingerprint": "164aa4bc88af43bc", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-45-cosmetic-repair.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-164aa4bc88af43bc", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4d8454fe3497f0b4", "scanner": "scanner-primary", "fingerprint": "164aa4bc88af43bc", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-45-cosmetic-repair.yml"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-164aa4bc88af43bc", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "55f3311aae167561", "scanner": "scanner-primary", "fingerprint": "164aa4bc88af43bc", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-45-cosmetic-repair.yml"}, "region": {"startLine": 154}}}]}, {"ruleId": "scanner-6e13989259df1c42", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "420003a60395ce4e", "scanner": "scanner-primary", "fingerprint": "6e13989259df1c42", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-45-cosmetic-repair.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-06e3b669dc85017d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "61519bf350e0c0df", "scanner": "scanner-primary", "fingerprint": "06e3b669dc85017d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-80-langsmith-metrics-dashboard.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-06e3b669dc85017d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ab7f8b58948b5254", "scanner": "scanner-primary", "fingerprint": "06e3b669dc85017d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-80-langsmith-metrics-dashboard.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-06e3b669dc85017d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c5334b9efd577ffe", "scanner": "scanner-primary", "fingerprint": "06e3b669dc85017d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-80-langsmith-metrics-dashboard.yml"}, "region": {"startLine": 296}}}]}, {"ruleId": "scanner-06e3b669dc85017d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c5334b9efd577ffe", "scanner": "scanner-primary", "fingerprint": "06e3b669dc85017d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-80-langsmith-metrics-dashboard.yml"}, "region": {"startLine": 312}}}]}, {"ruleId": "scanner-4d7e446ec8add3c9", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "e8ac3b3939b28654", "scanner": "scanner-primary", "fingerprint": "4d7e446ec8add3c9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-80-langsmith-metrics-dashboard.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-999dc72ee41c9494", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "890e9f6b41fdd331", "scanner": "scanner-primary", "fingerprint": "999dc72ee41c9494", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-11-ci-node.yml"}, "region": {"startLine": 217}}}]}, {"ruleId": "scanner-999dc72ee41c9494", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "880c196e34516165", "scanner": "scanner-primary", "fingerprint": "999dc72ee41c9494", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-11-ci-node.yml"}, "region": {"startLine": 222}}}]}, {"ruleId": "scanner-999dc72ee41c9494", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4b2116b675da84b3", "scanner": "scanner-primary", "fingerprint": "999dc72ee41c9494", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-11-ci-node.yml"}, "region": {"startLine": 448}}}]}, {"ruleId": "scanner-3890bd5f1ad7cadf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "576cf5250a4daa29", "scanner": "scanner-primary", "fingerprint": "3890bd5f1ad7cadf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-dispatcher.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-3890bd5f1ad7cadf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3266c4796aa88238", "scanner": "scanner-primary", "fingerprint": "3890bd5f1ad7cadf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-dispatcher.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-3890bd5f1ad7cadf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "adbdfd51a0f9d620", "scanner": "scanner-primary", "fingerprint": "3890bd5f1ad7cadf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-dispatcher.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-e472defd5f97e5da", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f10bb11789510644", "scanner": "scanner-primary", "fingerprint": "e472defd5f97e5da", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-64-verify-agent-assignment.yml"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-e472defd5f97e5da", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0bd75f8edc333d52", "scanner": "scanner-primary", "fingerprint": "e472defd5f97e5da", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-64-verify-agent-assignment.yml"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-f421a139d33520e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b346359a865eda3a", "scanner": "scanner-primary", "fingerprint": "f421a139d33520e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-bot-comment-handler.yml"}, "region": {"startLine": 132}}}]}, {"ruleId": "scanner-f421a139d33520e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b346359a865eda3a", "scanner": "scanner-primary", "fingerprint": "f421a139d33520e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-bot-comment-handler.yml"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-f421a139d33520e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1b53465c721c45e0", "scanner": "scanner-primary", "fingerprint": "f421a139d33520e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-bot-comment-handler.yml"}, "region": {"startLine": 151}}}]}, {"ruleId": "scanner-f421a139d33520e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8566f52af5875c90", "scanner": "scanner-primary", "fingerprint": "f421a139d33520e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-bot-comment-handler.yml"}, "region": {"startLine": 187}}}]}, {"ruleId": "scanner-f421a139d33520e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6dd0a599a7125e4e", "scanner": "scanner-primary", "fingerprint": "f421a139d33520e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-bot-comment-handler.yml"}, "region": {"startLine": 196}}}]}, {"ruleId": "scanner-f421a139d33520e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f27756cd595ec423", "scanner": "scanner-primary", "fingerprint": "f421a139d33520e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-bot-comment-handler.yml"}, "region": {"startLine": 453}}}]}, {"ruleId": "scanner-ea1eb18d667464c5", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "d8568d4e1b43f6fc", "scanner": "scanner-primary", "fingerprint": "ea1eb18d667464c5", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-bot-comment-handler.yml"}, "region": {"startLine": 465}}}]}, {"ruleId": "scanner-f421a139d33520e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b346359a865eda3a", "scanner": "scanner-primary", "fingerprint": "f421a139d33520e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-bot-comment-handler.yml"}, "region": {"startLine": 528}}}]}, {"ruleId": "scanner-f421a139d33520e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b346359a865eda3a", "scanner": "scanner-primary", "fingerprint": "f421a139d33520e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-bot-comment-handler.yml"}, "region": {"startLine": 538}}}]}, {"ruleId": "scanner-f421a139d33520e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1b53465c721c45e0", "scanner": "scanner-primary", "fingerprint": "f421a139d33520e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-bot-comment-handler.yml"}, "region": {"startLine": 548}}}]}, {"ruleId": "scanner-f421a139d33520e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6dd0a599a7125e4e", "scanner": "scanner-primary", "fingerprint": "f421a139d33520e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-bot-comment-handler.yml"}, "region": {"startLine": 580}}}]}, {"ruleId": "scanner-3f4dbf7ba1d6c5bf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b04766c46ebcb18c", "scanner": "scanner-primary", "fingerprint": "3f4dbf7ba1d6c5bf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-cursor-run.yml"}, "region": {"startLine": 190}}}]}, {"ruleId": "scanner-3f4dbf7ba1d6c5bf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8b802561567cf320", "scanner": "scanner-primary", "fingerprint": "3f4dbf7ba1d6c5bf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-cursor-run.yml"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-3f4dbf7ba1d6c5bf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5e53ffa15a5cdab3", "scanner": "scanner-primary", "fingerprint": "3f4dbf7ba1d6c5bf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-cursor-run.yml"}, "region": {"startLine": 234}}}]}, {"ruleId": "scanner-3f4dbf7ba1d6c5bf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8b802561567cf320", "scanner": "scanner-primary", "fingerprint": "3f4dbf7ba1d6c5bf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-cursor-run.yml"}, "region": {"startLine": 247}}}]}, {"ruleId": "scanner-3f4dbf7ba1d6c5bf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3b3df2bb98091d4e", "scanner": "scanner-primary", "fingerprint": "3f4dbf7ba1d6c5bf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-cursor-run.yml"}, "region": {"startLine": 358}}}]}, {"ruleId": "scanner-3f4dbf7ba1d6c5bf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5b17e6e003568212", "scanner": "scanner-primary", "fingerprint": "3f4dbf7ba1d6c5bf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-cursor-run.yml"}, "region": {"startLine": 434}}}]}, {"ruleId": "scanner-3f4dbf7ba1d6c5bf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0dbb8b309cb260d5", "scanner": "scanner-primary", "fingerprint": "3f4dbf7ba1d6c5bf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-cursor-run.yml"}, "region": {"startLine": 1149}}}]}, {"ruleId": "scanner-3f4dbf7ba1d6c5bf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "651630ba1b3b8042", "scanner": "scanner-primary", "fingerprint": "3f4dbf7ba1d6c5bf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-cursor-run.yml"}, "region": {"startLine": 1317}}}]}, {"ruleId": "scanner-3f4dbf7ba1d6c5bf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "651630ba1b3b8042", "scanner": "scanner-primary", "fingerprint": "3f4dbf7ba1d6c5bf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-cursor-run.yml"}, "region": {"startLine": 1374}}}]}, {"ruleId": "scanner-3f4dbf7ba1d6c5bf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0dbb8b309cb260d5", "scanner": "scanner-primary", "fingerprint": "3f4dbf7ba1d6c5bf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-cursor-run.yml"}, "region": {"startLine": 1514}}}]}, {"ruleId": "scanner-3f4dbf7ba1d6c5bf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "651630ba1b3b8042", "scanner": "scanner-primary", "fingerprint": "3f4dbf7ba1d6c5bf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-cursor-run.yml"}, "region": {"startLine": 1524}}}]}, {"ruleId": "scanner-7c28672665e10bf0", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "e862fc9ff102eb4e", "scanner": "scanner-primary", "fingerprint": "7c28672665e10bf0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-cursor-run.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c6aa7b65e2f7725", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "03dcaffef026d078", "scanner": "scanner-primary", "fingerprint": "8c6aa7b65e2f7725", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-12-ci-docker.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-8c6aa7b65e2f7725", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "659c048e9b7611b1", "scanner": "scanner-primary", "fingerprint": "8c6aa7b65e2f7725", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-12-ci-docker.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-0a5ca7883e68f20a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "923303fc6dcb2386", "scanner": "scanner-primary", "fingerprint": "0a5ca7883e68f20a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-52-semgrep.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-0a5ca7883e68f20a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d53a74ea99dbb211", "scanner": "scanner-primary", "fingerprint": "0a5ca7883e68f20a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-52-semgrep.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-0a5ca7883e68f20a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c2b4a045bf2fe424", "scanner": "scanner-primary", "fingerprint": "0a5ca7883e68f20a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-52-semgrep.yml"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-886d432c59a5491a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dd4649c0ad5f3720", "scanner": "scanner-primary", "fingerprint": "886d432c59a5491a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-60-release.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-886d432c59a5491a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "72bc13c6d493d1b9", "scanner": "scanner-primary", "fingerprint": "886d432c59a5491a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-60-release.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-af968c5a70c7c9c6", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "149491ef1df95500", "scanner": "scanner-primary", "fingerprint": "af968c5a70c7c9c6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-60-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d2576a1904c1f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "256c2fbd412d2fd8", "scanner": "scanner-primary", "fingerprint": "7d2576a1904c1f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-claude-run.yml"}, "region": {"startLine": 208}}}]}, {"ruleId": "scanner-7d2576a1904c1f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7f6a6872e3ee1ad5", "scanner": "scanner-primary", "fingerprint": "7d2576a1904c1f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-claude-run.yml"}, "region": {"startLine": 214}}}]}, {"ruleId": "scanner-7d2576a1904c1f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2d0f9e3fd6ea4cd7", "scanner": "scanner-primary", "fingerprint": "7d2576a1904c1f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-claude-run.yml"}, "region": {"startLine": 338}}}]}, {"ruleId": "scanner-7d2576a1904c1f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cdbb04f34c43a957", "scanner": "scanner-primary", "fingerprint": "7d2576a1904c1f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-claude-run.yml"}, "region": {"startLine": 414}}}]}, {"ruleId": "scanner-7d2576a1904c1f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f00984736261a059", "scanner": "scanner-primary", "fingerprint": "7d2576a1904c1f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-claude-run.yml"}, "region": {"startLine": 1040}}}]}, {"ruleId": "scanner-7d2576a1904c1f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "61507d20c0ed9feb", "scanner": "scanner-primary", "fingerprint": "7d2576a1904c1f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-claude-run.yml"}, "region": {"startLine": 1208}}}]}, {"ruleId": "scanner-7d2576a1904c1f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "61507d20c0ed9feb", "scanner": "scanner-primary", "fingerprint": "7d2576a1904c1f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-claude-run.yml"}, "region": {"startLine": 1265}}}]}, {"ruleId": "scanner-7d2576a1904c1f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f00984736261a059", "scanner": "scanner-primary", "fingerprint": "7d2576a1904c1f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-claude-run.yml"}, "region": {"startLine": 1405}}}]}, {"ruleId": "scanner-7d2576a1904c1f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "61507d20c0ed9feb", "scanner": "scanner-primary", "fingerprint": "7d2576a1904c1f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-claude-run.yml"}, "region": {"startLine": 1415}}}]}, {"ruleId": "scanner-c086272fb4b2cfbb", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "54aeb5cc4299277f", "scanner": "scanner-primary", "fingerprint": "c086272fb4b2cfbb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-claude-run.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-292b8ee25edd1fd8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b02a9e98dcb537ce", "scanner": "scanner-primary", "fingerprint": "292b8ee25edd1fd8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-72-template-sync.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-292b8ee25edd1fd8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "30052b41212618bf", "scanner": "scanner-primary", "fingerprint": "292b8ee25edd1fd8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-72-template-sync.yml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-fc615eda9be6dcbe", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "8596edd89ae12643", "scanner": "scanner-primary", "fingerprint": "fc615eda9be6dcbe", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-72-template-sync.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e175ad617cffd7b2", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 153}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e8f7657c95e5a7f", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e8f7657c95e5a7f", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 204}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e8f7657c95e5a7f", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 233}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e8f7657c95e5a7f", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 321}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e175ad617cffd7b2", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 370}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e8f7657c95e5a7f", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 390}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e8f7657c95e5a7f", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 608}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e8f7657c95e5a7f", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 652}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e8f7657c95e5a7f", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 742}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e175ad617cffd7b2", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 1000}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e175ad617cffd7b2", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 1019}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e175ad617cffd7b2", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 1044}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "556b119316ae7f29", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 1069}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e8f7657c95e5a7f", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 1086}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e8f7657c95e5a7f", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 1134}}}]}, {"ruleId": "scanner-87becfdb342697b9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e8f7657c95e5a7f", "scanner": "scanner-primary", "fingerprint": "87becfdb342697b9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 1163}}}]}, {"ruleId": "scanner-4d2ea04f86416f64", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "20e6ebf22c241055", "scanner": "scanner-primary", "fingerprint": "4d2ea04f86416f64", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-16-agents.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cd96eda8e3b45f52", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "21a3e49c1b29d1d5", "scanner": "scanner-primary", "fingerprint": "cd96eda8e3b45f52", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-61-release-please.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-cd96eda8e3b45f52", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5e78143e54736e4f", "scanner": "scanner-primary", "fingerprint": "cd96eda8e3b45f52", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-61-release-please.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-435a922e728c5903", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "f042b5d2d99ccd25", "scanner": "scanner-primary", "fingerprint": "435a922e728c5903", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-61-release-please.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2d6742d25469f543", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d52234421dcf9c42", "scanner": "scanner-primary", "fingerprint": "2d6742d25469f543", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-62-integration-consumer.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-2d6742d25469f543", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d52234421dcf9c42", "scanner": "scanner-primary", "fingerprint": "2d6742d25469f543", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-62-integration-consumer.yml"}, "region": {"startLine": 199}}}]}, {"ruleId": "scanner-2d6742d25469f543", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6967c6cf65be3e27", "scanner": "scanner-primary", "fingerprint": "2d6742d25469f543", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-62-integration-consumer.yml"}, "region": {"startLine": 218}}}]}, {"ruleId": "scanner-2d6742d25469f543", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6967c6cf65be3e27", "scanner": "scanner-primary", "fingerprint": "2d6742d25469f543", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-62-integration-consumer.yml"}, "region": {"startLine": 302}}}]}, {"ruleId": "scanner-6baaadb8b0adb7ca", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ca13878e917f645e", "scanner": "scanner-primary", "fingerprint": "6baaadb8b0adb7ca", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-dispatch-handler.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-6baaadb8b0adb7ca", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9ed5973c886a8dac", "scanner": "scanner-primary", "fingerprint": "6baaadb8b0adb7ca", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-dispatch-handler.yml"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-6baaadb8b0adb7ca", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f3abc9613fb5cd5a", "scanner": "scanner-primary", "fingerprint": "6baaadb8b0adb7ca", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-dispatch-handler.yml"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-6baaadb8b0adb7ca", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ff9237bfc20cdef", "scanner": "scanner-primary", "fingerprint": "6baaadb8b0adb7ca", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-dispatch-handler.yml"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-09f3fbb9186322aa", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0715aafb66c2ae4d", "scanner": "scanner-primary", "fingerprint": "09f3fbb9186322aa", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-dispatch-handler.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-294ffbcb0bcb342e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "098cf55d57197e05", "scanner": "scanner-primary", "fingerprint": "294ffbcb0bcb342e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-71-merge-sync-prs.yml"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-294ffbcb0bcb342e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "094cd1eef3ab596e", "scanner": "scanner-primary", "fingerprint": "294ffbcb0bcb342e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-71-merge-sync-prs.yml"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-294ffbcb0bcb342e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c88e05def6d16754", "scanner": "scanner-primary", "fingerprint": "294ffbcb0bcb342e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-71-merge-sync-prs.yml"}, "region": {"startLine": 647}}}]}, {"ruleId": "scanner-397e02fd22b8024e", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "6d7f984c93bd7483", "scanner": "scanner-primary", "fingerprint": "397e02fd22b8024e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-71-merge-sync-prs.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "518806c755ec7d29", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 282}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 357}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 408}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 416}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 425}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 595}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 695}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 963}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 1204}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 1244}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 1274}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 1503}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 1554}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 1604}}}]}, {"ruleId": "scanner-c64566b751ca53fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3987c655f6e9c191", "scanner": "scanner-primary", "fingerprint": "c64566b751ca53fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 1663}}}]}, {"ruleId": "scanner-3ca0e5d37f242546", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "dc9c79dad9d4d406", "scanner": "scanner-primary", "fingerprint": "3ca0e5d37f242546", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-agents-issue-bridge.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d3a1eeab63b5baf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c934542eceae32b4", "scanner": "scanner-primary", "fingerprint": "0d3a1eeab63b5baf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-42-actionlint.yml"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-0d3a1eeab63b5baf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c934542eceae32b4", "scanner": "scanner-primary", "fingerprint": "0d3a1eeab63b5baf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-42-actionlint.yml"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-f769970d3aacba64", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "426c8efb16ec1f73", "scanner": "scanner-primary", "fingerprint": "f769970d3aacba64", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-74-ledger-base-sync.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-f769970d3aacba64", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "81aa87dee2504afb", "scanner": "scanner-primary", "fingerprint": "f769970d3aacba64", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-74-ledger-base-sync.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-f769970d3aacba64", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "70799f8a7ad91627", "scanner": "scanner-primary", "fingerprint": "f769970d3aacba64", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-74-ledger-base-sync.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-f769970d3aacba64", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "30fe18a9079a8b8f", "scanner": "scanner-primary", "fingerprint": "f769970d3aacba64", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-74-ledger-base-sync.yml"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-6f2687b9534e1495", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "1e0a8b4b3f1b6dfb", "scanner": "scanner-primary", "fingerprint": "6f2687b9534e1495", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-74-ledger-base-sync.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-619564775eec11a8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a970fceb032ff72f", "scanner": "scanner-primary", "fingerprint": "619564775eec11a8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/autofix.yml"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-619564775eec11a8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8831e1f45e7fb72c", "scanner": "scanner-primary", "fingerprint": "619564775eec11a8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/autofix.yml"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-619564775eec11a8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a970fceb032ff72f", "scanner": "scanner-primary", "fingerprint": "619564775eec11a8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/autofix.yml"}, "region": {"startLine": 449}}}]}, {"ruleId": "scanner-342554808b8dfaa9", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "7cf90d6aa796cf21", "scanner": "scanner-primary", "fingerprint": "342554808b8dfaa9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/autofix.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd737d26a6e058ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a25ccb2fd0bcf886", "scanner": "scanner-primary", "fingerprint": "bd737d26a6e058ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-bd737d26a6e058ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f82958269f7ac52e", "scanner": "scanner-primary", "fingerprint": "bd737d26a6e058ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-bd737d26a6e058ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "475c2e6b4a96c2f2", "scanner": "scanner-primary", "fingerprint": "bd737d26a6e058ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 129}}}]}, {"ruleId": "scanner-bd737d26a6e058ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "475c2e6b4a96c2f2", "scanner": "scanner-primary", "fingerprint": "bd737d26a6e058ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 253}}}]}, {"ruleId": "scanner-3c1ed6f5278280d1", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "eac484a56abbb125", "scanner": "scanner-primary", "fingerprint": "3c1ed6f5278280d1", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 682}}}]}, {"ruleId": "scanner-3c1ed6f5278280d1", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "fe8c19bd53303ba8", "scanner": "scanner-primary", "fingerprint": "3c1ed6f5278280d1", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 707}}}]}, {"ruleId": "scanner-3c1ed6f5278280d1", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "cfa31390744a62b2", "scanner": "scanner-primary", "fingerprint": "3c1ed6f5278280d1", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 733}}}]}, {"ruleId": "scanner-bd737d26a6e058ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f82958269f7ac52e", "scanner": "scanner-primary", "fingerprint": "bd737d26a6e058ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 766}}}]}, {"ruleId": "scanner-bd737d26a6e058ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a25ccb2fd0bcf886", "scanner": "scanner-primary", "fingerprint": "bd737d26a6e058ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 830}}}]}, {"ruleId": "scanner-bd737d26a6e058ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f82958269f7ac52e", "scanner": "scanner-primary", "fingerprint": "bd737d26a6e058ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 838}}}]}, {"ruleId": "scanner-bd737d26a6e058ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "475c2e6b4a96c2f2", "scanner": "scanner-primary", "fingerprint": "bd737d26a6e058ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 848}}}]}, {"ruleId": "scanner-bd737d26a6e058ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a25ccb2fd0bcf886", "scanner": "scanner-primary", "fingerprint": "bd737d26a6e058ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 925}}}]}, {"ruleId": "scanner-bd737d26a6e058ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f82958269f7ac52e", "scanner": "scanner-primary", "fingerprint": "bd737d26a6e058ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 933}}}]}, {"ruleId": "scanner-bd737d26a6e058ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "475c2e6b4a96c2f2", "scanner": "scanner-primary", "fingerprint": "bd737d26a6e058ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 953}}}]}, {"ruleId": "scanner-bd737d26a6e058ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "05f037a1392a2660", "scanner": "scanner-primary", "fingerprint": "bd737d26a6e058ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 1126}}}]}, {"ruleId": "scanner-c019f742a4c67519", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "687daa0b0d1eac6b", "scanner": "scanner-primary", "fingerprint": "c019f742a4c67519", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-autofix-loop.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e34f02c0293ae9af", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9cef12eab39f106c", "scanner": "scanner-primary", "fingerprint": "e34f02c0293ae9af", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-branch-sync.yml"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-e34f02c0293ae9af", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "87b8a8103d4483e1", "scanner": "scanner-primary", "fingerprint": "e34f02c0293ae9af", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-branch-sync.yml"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-ef49726f212fe4f9", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "19a6e0be95141b33", "scanner": "scanner-primary", "fingerprint": "ef49726f212fe4f9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-branch-sync.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-70bbed004e003fcc", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a1bc7b06256e4c50", "scanner": "scanner-primary", "fingerprint": "70bbed004e003fcc", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-84-prune-agent-stubs.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-70bbed004e003fcc", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cbae8990feee1b19", "scanner": "scanner-primary", "fingerprint": "70bbed004e003fcc", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-84-prune-agent-stubs.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-0516483a58633b4e", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a9dd8b2ab9407ab0", "scanner": "scanner-primary", "fingerprint": "0516483a58633b4e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-84-prune-agent-stubs.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4a0ee43140771f7", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "32b7076630d742ac", "scanner": "scanner-primary", "fingerprint": "e4a0ee43140771f7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-moderate-connector.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-e4a0ee43140771f7", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dd0df8cb6132cfa0", "scanner": "scanner-primary", "fingerprint": "e4a0ee43140771f7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-moderate-connector.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-e4a0ee43140771f7", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae750c6d9bfdd648", "scanner": "scanner-primary", "fingerprint": "e4a0ee43140771f7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-moderate-connector.yml"}, "region": {"startLine": 233}}}]}, {"ruleId": "scanner-e4a0ee43140771f7", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dd0df8cb6132cfa0", "scanner": "scanner-primary", "fingerprint": "e4a0ee43140771f7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-moderate-connector.yml"}, "region": {"startLine": 264}}}]}, {"ruleId": "scanner-a6f983092923ba09", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8352d03c83abe43a", "scanner": "scanner-primary", "fingerprint": "a6f983092923ba09", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-47-disable-legacy-workflows.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-a6f983092923ba09", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "307e6a45f024687f", "scanner": "scanner-primary", "fingerprint": "a6f983092923ba09", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-47-disable-legacy-workflows.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-1901fb2334c9c26f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "63505811b71e5cca", "scanner": "scanner-primary", "fingerprint": "1901fb2334c9c26f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-78-backplane-contract.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-1901fb2334c9c26f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8d801d298275bdf4", "scanner": "scanner-primary", "fingerprint": "1901fb2334c9c26f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-78-backplane-contract.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-1901fb2334c9c26f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "261521331087f52b", "scanner": "scanner-primary", "fingerprint": "1901fb2334c9c26f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-78-backplane-contract.yml"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-3503edcd538de637", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b139d0b42f5a6d38", "scanner": "scanner-primary", "fingerprint": "3503edcd538de637", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-11-ci-smoke.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-3503edcd538de637", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dfec740a975041c4", "scanner": "scanner-primary", "fingerprint": "3503edcd538de637", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-11-ci-smoke.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-3503edcd538de637", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dedeba9339462b20", "scanner": "scanner-primary", "fingerprint": "3503edcd538de637", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-11-ci-smoke.yml"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-2891f6854de213e2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "63d328cdc66cbea5", "scanner": "scanner-primary", "fingerprint": "2891f6854de213e2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-44-gate-branch-protection.yml"}, "region": {"startLine": 121}}}]}, {"ruleId": "scanner-2891f6854de213e2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ffbbba8ca6a5ea75", "scanner": "scanner-primary", "fingerprint": "2891f6854de213e2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-44-gate-branch-protection.yml"}, "region": {"startLine": 293}}}]}, {"ruleId": "scanner-ccc35aa1e5d9b6e1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dff2c41650193e62", "scanner": "scanner-primary", "fingerprint": "ccc35aa1e5d9b6e1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-weekly-metrics.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-ccc35aa1e5d9b6e1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3ae1899638478193", "scanner": "scanner-primary", "fingerprint": "ccc35aa1e5d9b6e1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-weekly-metrics.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-ccc35aa1e5d9b6e1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1ea89f46af824e6e", "scanner": "scanner-primary", "fingerprint": "ccc35aa1e5d9b6e1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-weekly-metrics.yml"}, "region": {"startLine": 350}}}]}, {"ruleId": "scanner-ccc35aa1e5d9b6e1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b4f9733dd7717700", "scanner": "scanner-primary", "fingerprint": "ccc35aa1e5d9b6e1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-weekly-metrics.yml"}, "region": {"startLine": 372}}}]}, {"ruleId": "scanner-169237898088c581", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "94724180eb52e51b", "scanner": "scanner-primary", "fingerprint": "169237898088c581", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop-reporter.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-169237898088c581", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b5533fbb10b10fa8", "scanner": "scanner-primary", "fingerprint": "169237898088c581", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop-reporter.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-169237898088c581", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "648a7c985080ba37", "scanner": "scanner-primary", "fingerprint": "169237898088c581", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-keepalive-loop-reporter.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-38b4ff3a8ac14dfe", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "9c197282e719f379", "scanner": "scanner-primary", "fingerprint": "38b4ff3a8ac14dfe", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-53-scorecard.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3e23c2f0fd7452c6", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 175}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3e23c2f0fd7452c6", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 184}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "632bc297e5fbf802", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "117395e1e17b5d75", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 247}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5578538879323040", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 271}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5578538879323040", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 331}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5578538879323040", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 482}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5578538879323040", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 529}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "632bc297e5fbf802", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 574}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "117395e1e17b5d75", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 593}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "632bc297e5fbf802", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 666}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3e23c2f0fd7452c6", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 724}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3e23c2f0fd7452c6", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 733}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "117395e1e17b5d75", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 755}}}]}, {"ruleId": "scanner-6e8143367195f578", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5578538879323040", "scanner": "scanner-primary", "fingerprint": "6e8143367195f578", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-bot-comment-handler.yml"}, "region": {"startLine": 774}}}]}, {"ruleId": "scanner-f1ba976565c9998e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "59e3cf9206f2933d", "scanner": "scanner-primary", "fingerprint": "f1ba976565c9998e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-68-consumer-sync-drift.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-f1ba976565c9998e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "10598fd9263cf5ab", "scanner": "scanner-primary", "fingerprint": "f1ba976565c9998e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-68-consumer-sync-drift.yml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-f1ba976565c9998e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0e818c1b5fb80fc6", "scanner": "scanner-primary", "fingerprint": "f1ba976565c9998e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-68-consumer-sync-drift.yml"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-f1ba976565c9998e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c348bb827bc0623c", "scanner": "scanner-primary", "fingerprint": "f1ba976565c9998e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-68-consumer-sync-drift.yml"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-7be7a9332ef00822", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "763412e61a6112f3", "scanner": "scanner-primary", "fingerprint": "7be7a9332ef00822", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-codex-auth-check.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-7be7a9332ef00822", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4fb7c484f05342ae", "scanner": "scanner-primary", "fingerprint": "7be7a9332ef00822", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-codex-auth-check.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-7be7a9332ef00822", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4fb7c484f05342ae", "scanner": "scanner-primary", "fingerprint": "7be7a9332ef00822", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-codex-auth-check.yml"}, "region": {"startLine": 157}}}]}, {"ruleId": "scanner-ba7af494fe062325", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4ccb5fdcae17f9ea", "scanner": "scanner-primary", "fingerprint": "ba7af494fe062325", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-verify-to-issue-v2.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-ba7af494fe062325", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8bdbdfc5685400b4", "scanner": "scanner-primary", "fingerprint": "ba7af494fe062325", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-verify-to-issue-v2.yml"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-ba7af494fe062325", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e080d19bfdc7ff1", "scanner": "scanner-primary", "fingerprint": "ba7af494fe062325", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-verify-to-issue-v2.yml"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-ba7af494fe062325", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4ccb5fdcae17f9ea", "scanner": "scanner-primary", "fingerprint": "ba7af494fe062325", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-verify-to-issue-v2.yml"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-ba7af494fe062325", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4ccb5fdcae17f9ea", "scanner": "scanner-primary", "fingerprint": "ba7af494fe062325", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-verify-to-issue-v2.yml"}, "region": {"startLine": 283}}}]}, {"ruleId": "scanner-ba7af494fe062325", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4ccb5fdcae17f9ea", "scanner": "scanner-primary", "fingerprint": "ba7af494fe062325", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-verify-to-issue-v2.yml"}, "region": {"startLine": 368}}}]}, {"ruleId": "scanner-ba7af494fe062325", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4ccb5fdcae17f9ea", "scanner": "scanner-primary", "fingerprint": "ba7af494fe062325", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-verify-to-issue-v2.yml"}, "region": {"startLine": 440}}}]}, {"ruleId": "scanner-ba7af494fe062325", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4ccb5fdcae17f9ea", "scanner": "scanner-primary", "fingerprint": "ba7af494fe062325", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-verify-to-issue-v2.yml"}, "region": {"startLine": 488}}}]}, {"ruleId": "scanner-ba7af494fe062325", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97eb8255073aa314", "scanner": "scanner-primary", "fingerprint": "ba7af494fe062325", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-verify-to-issue-v2.yml"}, "region": {"startLine": 538}}}]}, {"ruleId": "scanner-ba7af494fe062325", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4ccb5fdcae17f9ea", "scanner": "scanner-primary", "fingerprint": "ba7af494fe062325", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-verify-to-issue-v2.yml"}, "region": {"startLine": 548}}}]}, {"ruleId": "scanner-1159a8948cf39aee", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cfa29b2f70010f5e", "scanner": "scanner-primary", "fingerprint": "1159a8948cf39aee", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-keepalive-e2e.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-1159a8948cf39aee", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4bd63f75760d9b0a", "scanner": "scanner-primary", "fingerprint": "1159a8948cf39aee", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-keepalive-e2e.yml"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-1159a8948cf39aee", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4bd63f75760d9b0a", "scanner": "scanner-primary", "fingerprint": "1159a8948cf39aee", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-keepalive-e2e.yml"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-1159a8948cf39aee", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4bd63f75760d9b0a", "scanner": "scanner-primary", "fingerprint": "1159a8948cf39aee", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-keepalive-e2e.yml"}, "region": {"startLine": 167}}}]}, {"ruleId": "scanner-91f86ae39f7cf7e5", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0bb4862a81b77e94", "scanner": "scanner-primary", "fingerprint": "91f86ae39f7cf7e5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-keepalive-e2e.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-26859f0c2ccb741d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7ed4cf66ad79dabe", "scanner": "scanner-primary", "fingerprint": "26859f0c2ccb741d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-70-validate-sync-manifest.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-26859f0c2ccb741d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4b700a63c4047517", "scanner": "scanner-primary", "fingerprint": "26859f0c2ccb741d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-70-validate-sync-manifest.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-26859f0c2ccb741d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0050666891ef4805", "scanner": "scanner-primary", "fingerprint": "26859f0c2ccb741d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-70-validate-sync-manifest.yml"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-a2ae21c54484acbb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cb2f46a60f0b3dd6", "scanner": "scanner-primary", "fingerprint": "a2ae21c54484acbb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-13-cross-repo-smoke.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-a2ae21c54484acbb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cb2f46a60f0b3dd6", "scanner": "scanner-primary", "fingerprint": "a2ae21c54484acbb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-13-cross-repo-smoke.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-a2ae21c54484acbb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f9f7c017b533a691", "scanner": "scanner-primary", "fingerprint": "a2ae21c54484acbb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-13-cross-repo-smoke.yml"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-3a34c3f23e6197fa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4fc6f1bb257850ad", "scanner": "scanner-primary", "fingerprint": "3a34c3f23e6197fa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-52-validate-workflows.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-3a34c3f23e6197fa", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2451b66768141742", "scanner": "scanner-primary", "fingerprint": "3a34c3f23e6197fa", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-52-validate-workflows.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4fef26f117ca194", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7a2b7cf0af4b9df7", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "21b0ec87e8e269a6", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4fef26f117ca194", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 357}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7a2b7cf0af4b9df7", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 365}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "79d72a8ea2366ddf", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 373}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4fef26f117ca194", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 422}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7a2b7cf0af4b9df7", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 430}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "698996863b4c703e", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 451}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "21b0ec87e8e269a6", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 459}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "21b0ec87e8e269a6", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 469}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "21b0ec87e8e269a6", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 489}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "21b0ec87e8e269a6", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 506}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1d7b73629c3ea321", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 515}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "21b0ec87e8e269a6", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 558}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "21b0ec87e8e269a6", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 618}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "21b0ec87e8e269a6", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 770}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b8b53366c589503b", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 900}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b8b53366c589503b", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 910}}}]}, {"ruleId": "scanner-0f79f3a182caec32", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b8b53366c589503b", "scanner": "scanner-primary", "fingerprint": "0f79f3a182caec32", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 920}}}]}, {"ruleId": "scanner-4392c737c0a1d1ad", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "6fcf6cd464d01263", "scanner": "scanner-primary", "fingerprint": "4392c737c0a1d1ad", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-00-gate.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e7fe55fb2b21190e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eaf84a89ba57780e", "scanner": "scanner-primary", "fingerprint": "e7fe55fb2b21190e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-41-repo-health.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-e7fe55fb2b21190e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "72eb26741625af37", "scanner": "scanner-primary", "fingerprint": "e7fe55fb2b21190e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-41-repo-health.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-e7fe55fb2b21190e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eaf84a89ba57780e", "scanner": "scanner-primary", "fingerprint": "e7fe55fb2b21190e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-41-repo-health.yml"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-e7fe55fb2b21190e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "72eb26741625af37", "scanner": "scanner-primary", "fingerprint": "e7fe55fb2b21190e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-41-repo-health.yml"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-e7fe55fb2b21190e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "72eb26741625af37", "scanner": "scanner-primary", "fingerprint": "e7fe55fb2b21190e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-41-repo-health.yml"}, "region": {"startLine": 383}}}]}, {"ruleId": "scanner-8a6f5a75097443d6", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a1d77ad2d0c2c6e1", "scanner": "scanner-primary", "fingerprint": "8a6f5a75097443d6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-70-orchestrator.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aeff909953c2fea4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0df2f2a30f76c3af", "scanner": "scanner-primary", "fingerprint": "aeff909953c2fea4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-codex-run.yml"}, "region": {"startLine": 224}}}]}, {"ruleId": "scanner-aeff909953c2fea4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8a1c89013de3270e", "scanner": "scanner-primary", "fingerprint": "aeff909953c2fea4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-codex-run.yml"}, "region": {"startLine": 230}}}]}, {"ruleId": "scanner-aeff909953c2fea4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9ed36d605b00d71a", "scanner": "scanner-primary", "fingerprint": "aeff909953c2fea4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-codex-run.yml"}, "region": {"startLine": 356}}}]}, {"ruleId": "scanner-aeff909953c2fea4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "907cfb429292f1fd", "scanner": "scanner-primary", "fingerprint": "aeff909953c2fea4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-codex-run.yml"}, "region": {"startLine": 433}}}]}, {"ruleId": "scanner-aeff909953c2fea4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b591f4824a1749d5", "scanner": "scanner-primary", "fingerprint": "aeff909953c2fea4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-codex-run.yml"}, "region": {"startLine": 1466}}}]}, {"ruleId": "scanner-aeff909953c2fea4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "34d9d2a65123ccd1", "scanner": "scanner-primary", "fingerprint": "aeff909953c2fea4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-codex-run.yml"}, "region": {"startLine": 1478}}}]}, {"ruleId": "scanner-aeff909953c2fea4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "34d9d2a65123ccd1", "scanner": "scanner-primary", "fingerprint": "aeff909953c2fea4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-codex-run.yml"}, "region": {"startLine": 1510}}}]}, {"ruleId": "scanner-aeff909953c2fea4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b591f4824a1749d5", "scanner": "scanner-primary", "fingerprint": "aeff909953c2fea4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-codex-run.yml"}, "region": {"startLine": 1669}}}]}, {"ruleId": "scanner-aeff909953c2fea4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "34d9d2a65123ccd1", "scanner": "scanner-primary", "fingerprint": "aeff909953c2fea4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-codex-run.yml"}, "region": {"startLine": 1679}}}]}, {"ruleId": "scanner-aeff909953c2fea4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "34d9d2a65123ccd1", "scanner": "scanner-primary", "fingerprint": "aeff909953c2fea4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-codex-run.yml"}, "region": {"startLine": 1781}}}]}, {"ruleId": "scanner-c30cf2026c66d577", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "efc48fbbfbbedf8f", "scanner": "scanner-primary", "fingerprint": "c30cf2026c66d577", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/reusable-codex-run.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-afb5c2a03d37d270", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ada65555347933a4", "scanner": "scanner-primary", "fingerprint": "afb5c2a03d37d270", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-verifier.yml"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-afb5c2a03d37d270", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fa507eaa87c275f7", "scanner": "scanner-primary", "fingerprint": "afb5c2a03d37d270", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-verifier.yml"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-8647f814bf6ae491", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "bd910ff211e90130", "scanner": "scanner-primary", "fingerprint": "8647f814bf6ae491", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agents-verifier.yml"}, "region": {"startLine": 213}}}]}, {"ruleId": "scanner-dec741eef9f8c727", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ac4af6e735b3b092", "scanner": "scanner-primary", "fingerprint": "dec741eef9f8c727", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-48-docs-drift-audit.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-2bdf9e76bc7bace3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fb8d45a402a5d53a", "scanner": "scanner-primary", "fingerprint": "2bdf9e76bc7bace3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/selftest-reusable-ci.yml"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-2bdf9e76bc7bace3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "acbfe2aa0b211edb", "scanner": "scanner-primary", "fingerprint": "2bdf9e76bc7bace3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/selftest-reusable-ci.yml"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-2bdf9e76bc7bace3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fb8d45a402a5d53a", "scanner": "scanner-primary", "fingerprint": "2bdf9e76bc7bace3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/selftest-reusable-ci.yml"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-2bdf9e76bc7bace3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "acbfe2aa0b211edb", "scanner": "scanner-primary", "fingerprint": "2bdf9e76bc7bace3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/selftest-reusable-ci.yml"}, "region": {"startLine": 418}}}]}, {"ruleId": "scanner-2bdf9e76bc7bace3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4b0c392bc14ce0bd", "scanner": "scanner-primary", "fingerprint": "2bdf9e76bc7bace3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/selftest-reusable-ci.yml"}, "region": {"startLine": 655}}}]}, {"ruleId": "scanner-2bdf9e76bc7bace3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ec6f3f33452fb54", "scanner": "scanner-primary", "fingerprint": "2bdf9e76bc7bace3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/selftest-reusable-ci.yml"}, "region": {"startLine": 724}}}]}, {"ruleId": "scanner-2bdf9e76bc7bace3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fb8d45a402a5d53a", "scanner": "scanner-primary", "fingerprint": "2bdf9e76bc7bace3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/selftest-reusable-ci.yml"}, "region": {"startLine": 747}}}]}, {"ruleId": "scanner-2bdf9e76bc7bace3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b105b73558331b5e", "scanner": "scanner-primary", "fingerprint": "2bdf9e76bc7bace3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/selftest-reusable-ci.yml"}, "region": {"startLine": 772}}}]}, {"ruleId": "scanner-2bdf9e76bc7bace3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "acbfe2aa0b211edb", "scanner": "scanner-primary", "fingerprint": "2bdf9e76bc7bace3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/selftest-reusable-ci.yml"}, "region": {"startLine": 846}}}]}, {"ruleId": "scanner-4f518497fb2835e5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f52696182aab242e", "scanner": "scanner-primary", "fingerprint": "4f518497fb2835e5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-50-security-scan.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-4f518497fb2835e5", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "16751629d2159b82", "scanner": "scanner-primary", "fingerprint": "4f518497fb2835e5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-50-security-scan.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-4f518497fb2835e5", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "18c769acbd4a6bbd", "scanner": "scanner-primary", "fingerprint": "4f518497fb2835e5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-50-security-scan.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-4f518497fb2835e5", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1275e154e5449395", "scanner": "scanner-primary", "fingerprint": "4f518497fb2835e5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-50-security-scan.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-0bfb6c9810ce4cee", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cda20096252ab541", "scanner": "scanner-primary", "fingerprint": "0bfb6c9810ce4cee", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-metrics-retention.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-0bfb6c9810ce4cee", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eddb5e07d82f7434", "scanner": "scanner-primary", "fingerprint": "0bfb6c9810ce4cee", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-metrics-retention.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-0bfb6c9810ce4cee", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f4b9bb63d8fc9767", "scanner": "scanner-primary", "fingerprint": "0bfb6c9810ce4cee", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/maint-metrics-retention.yml"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-2d3be75a7dfb90a6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4e83861f2fb9b464", "scanner": "scanner-primary", "fingerprint": "2d3be75a7dfb90a6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-76-codex-cli-freshness.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-2d3be75a7dfb90a6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b9218bcd11645b66", "scanner": "scanner-primary", "fingerprint": "2d3be75a7dfb90a6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-76-codex-cli-freshness.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-2d3be75a7dfb90a6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "89cde6a92b460916", "scanner": "scanner-primary", "fingerprint": "2d3be75a7dfb90a6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/health-76-codex-cli-freshness.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-4b15246c59b4d6d0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "598c5f5ced0e9b1f", "scanner": "scanner-primary", "fingerprint": "4b15246c59b4d6d0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/archived/maint-63-ensure-environments.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-4b15246c59b4d6d0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5175db4435083b66", "scanner": "scanner-primary", "fingerprint": "4b15246c59b4d6d0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/archived/maint-63-ensure-environments.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-4ad0b4dd3d80be5c", "level": "note", "message": {"text": "Very large file: tests/test_followup_issue_generator.py (1677 lines)"}, "properties": {"repobilityId": "4a0197446af8a3d6", "scanner": "scanner-primary", "fingerprint": "4ad0b4dd3d80be5c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a85c4077671f3e21", "level": "note", "message": {"text": "Very large file: tests/scripts/test_aggregate_agent_metrics.py (1775 lines)"}, "properties": {"repobilityId": "85b8443d2c580a5c", "scanner": "scanner-primary", "fingerprint": "a85c4077671f3e21", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-eb84b51313f707ec", "level": "note", "message": {"text": "Very large file: tests/workflows/test_workflow_agents_consolidation.py (1137 lines)"}, "properties": {"repobilityId": "55f009cf4ef2a529", "scanner": "scanner-primary", "fingerprint": "eb84b51313f707ec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a64afa0894a50294", "level": "note", "message": {"text": "Very large file: tests/tools/test_llm_provider.py (1879 lines)"}, "properties": {"repobilityId": "f640c2c3ea016987", "scanner": "scanner-primary", "fingerprint": "a64afa0894a50294", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-921ebcd00777b6c0", "level": "note", "message": {"text": "Very large file: scripts/repo_review_evaluator.py (3942 lines)"}, "properties": {"repobilityId": "f1e44b4439aa5f42", "scanner": "scanner-primary", "fingerprint": "921ebcd00777b6c0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b8bfc8c7d0ff75db", "level": "note", "message": {"text": "Very large file: scripts/repo_review_round2_runner.py (1377 lines)"}, "properties": {"repobilityId": "798deec8eceba725", "scanner": "scanner-primary", "fingerprint": "b8bfc8c7d0ff75db", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-116c06647a9fb579", "level": "note", "message": {"text": "Very large file: scripts/aggregate_agent_metrics.py (1582 lines)"}, "properties": {"repobilityId": "e92d2dec6aa92441", "scanner": "scanner-primary", "fingerprint": "116c06647a9fb579", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dc8a15075c18fb92", "level": "note", "message": {"text": "Very large file: scripts/langchain/issue_optimizer.py (1538 lines)"}, "properties": {"repobilityId": "2803483c7b8ebdc3", "scanner": "scanner-primary", "fingerprint": "dc8a15075c18fb92", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-24bc0dc84a14cf54", "level": "note", "message": {"text": "Very large file: scripts/langchain/followup_issue_generator.py (2172 lines)"}, "properties": {"repobilityId": "a947da8ca3a8eac6", "scanner": "scanner-primary", "fingerprint": "24bc0dc84a14cf54", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a36cbbb8275e52f7", "level": "note", "message": {"text": "Very large file: templates/consumer-repo/scripts/aggregate_agent_metrics.py (1582 lines)"}, "properties": {"repobilityId": "337e417dac895767", "scanner": "scanner-primary", "fingerprint": "a36cbbb8275e52f7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-565199fef3af87dc", "level": "note", "message": {"text": "Very large file: templates/consumer-repo/.github/scripts/keepalive_post_work.js (1674 lines)"}, "properties": {"repobilityId": "b3a36f41f8592058", "scanner": "scanner-primary", "fingerprint": "565199fef3af87dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-178d3912a820dd0d", "level": "note", "message": {"text": "Very large file: templates/consumer-repo/.github/scripts/agents_pr_meta_update_body.js (1717 lines)"}, "properties": {"repobilityId": "434108ddbaafb12f", "scanner": "scanner-primary", "fingerprint": "178d3912a820dd0d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5f9e3344487c663d", "level": "note", "message": {"text": "Very large file: templates/consumer-repo/.github/scripts/keepalive_loop.js (4776 lines)"}, "properties": {"repobilityId": "b122c0d503ab23f5", "scanner": "scanner-primary", "fingerprint": "5f9e3344487c663d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c000b8e8cb80ebb7", "level": "note", "message": {"text": "Very large file: .github/scripts/keepalive_post_work.js (1674 lines)"}, "properties": {"repobilityId": "c444ec36e3ee85d1", "scanner": "scanner-primary", "fingerprint": "c000b8e8cb80ebb7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1c72dfc0670bb6e3", "level": "note", "message": {"text": "Very large file: .github/scripts/sync_dependency_campaign.js (1669 lines)"}, "properties": {"repobilityId": "cf2825d42109c41a", "scanner": "scanner-primary", "fingerprint": "1c72dfc0670bb6e3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a7da7f528f0feb72", "level": "note", "message": {"text": "Very large file: .github/scripts/agents_pr_meta_update_body.js (1717 lines)"}, "properties": {"repobilityId": "4971d474b3e2239b", "scanner": "scanner-primary", "fingerprint": "a7da7f528f0feb72", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2b1f720ab9852d94", "level": "note", "message": {"text": "Very large file: .github/scripts/keepalive_loop.js (4776 lines)"}, "properties": {"repobilityId": "a541e40ec7e9a9ae", "scanner": "scanner-primary", "fingerprint": "2b1f720ab9852d94", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5021e974d565d0d5", "level": "note", "message": {"text": "Very large file: .github/scripts/__tests__/keepalive-loop.test.js (3769 lines)"}, "properties": {"repobilityId": "a5d403ee48fd3dca", "scanner": "scanner-primary", "fingerprint": "5021e974d565d0d5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b69c8d7b15a6838a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: templates/consumer-repo/.github/scripts/package.json"}, "properties": {"repobilityId": "96d302f615d7287b", "scanner": "scanner-primary", "fingerprint": "b69c8d7b15a6838a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/.github/scripts/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c1a56fc9dee01097", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "691fbf5dd50f8101", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "959cf6a829b00a1b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "31ae7aa60ba8f510", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "a05cba8a670f1465", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "f98862f2c82b61b3", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-d23ca58cb4b55f95", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: templates/consumer-repo/CLAUDE.md"}, "properties": {"repobilityId": "8e013c3c3b1ace0d", "scanner": "scanner-primary", "fingerprint": "d23ca58cb4b55f95", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f03804f5a1366df", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: templates/consumer-repo/AGENTS.md"}, "properties": {"repobilityId": "4f28d0da266cd027", "scanner": "scanner-primary", "fingerprint": "5f03804f5a1366df", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/consumer-repo/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-31c07ba3677ea394", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/langsmith-integration/skill.md"}, "properties": {"repobilityId": "90ce59e1c5009772", "scanner": "scanner-primary", "fingerprint": "31c07ba3677ea394", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/langsmith-integration/skill.md"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-aef9872ebbd2b160", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .github/copilot-instructions.md"}, "properties": {"repobilityId": "0f079956bea4eb94", "scanner": "scanner-primary", "fingerprint": "aef9872ebbd2b160", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agent_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/copilot-instructions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-36d7c522d179c65e", "level": "note", "message": {"text": "Legacy-named symbol `tooOld` in tests/bot-comment-dismiss.test.js:47"}, "properties": {"repobilityId": "c792bcfd77ac852a", "scanner": "scanner-primary", "fingerprint": "36d7c522d179c65e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-315cc0d9c73581e7", "level": "note", "message": {"text": "Legacy-named symbol `test_detect_multiple_deprecated` in tests/test_workflow_validator.py:74"}, "properties": {"repobilityId": "20c4dcea9c0612ce", "scanner": "scanner-primary", "fingerprint": "315cc0d9c73581e7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b8a0b398f54e1886", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/scripts/test_repo_review_heartbeat.py:137"}, "properties": {"repobilityId": "c82dbe0df56dfc68", "scanner": "scanner-primary", "fingerprint": "b8a0b398f54e1886", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c66dfaca3c205ed1", "level": "note", "message": {"text": "Legacy-named symbol `nOld` in tests/scripts/test_sync_label_docs.py:39"}, "properties": {"repobilityId": "828e29f1fe6ac2e4", "scanner": "scanner-primary", "fingerprint": "c66dfaca3c205ed1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6b602ed9986e3e26", "level": "note", "message": {"text": "Legacy-named symbol `test_resolve_default_branch_action_contract_and_template_copy` in tests/workflows/test_resolve_default_branch.py:17"}, "properties": {"repobilityId": "b6abbc6306163dc2", "scanner": "scanner-primary", "fingerprint": "6b602ed9986e3e26", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-19108a1f74effbba", "level": "note", "message": {"text": "Legacy-named symbol `use_legacy` in tests/workflows/test_bot_comment_handler.py:113"}, "properties": {"repobilityId": "b1ae201bc5831fdc", "scanner": "scanner-primary", "fingerprint": "19108a1f74effbba", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9b894bb252fbc784", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/workflows/test_issue_bridge_triggers.py:155"}, "properties": {"repobilityId": "6119322067657683", "scanner": "scanner-primary", "fingerprint": "9b894bb252fbc784", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3bf46bfc3c319587", "level": "note", "message": {"text": "Legacy-named symbol `fake_copy` in tests/workflows/github_scripts/test_restore_branch_snapshots.py:238"}, "properties": {"repobilityId": "bb499e7bee6519c0", "scanner": "scanner-primary", "fingerprint": "3bf46bfc3c319587", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7d8e94f8a1fe85bd", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/contracts/test_validate_run_contract.py:178"}, "properties": {"repobilityId": "3d44e58ace6d9868", "scanner": "scanner-primary", "fingerprint": "7d8e94f8a1fe85bd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-980af0e8881a1c2f", "level": "none", "message": {"text": "Commented-code block (11 lines) in scripts/repo_review_coordinator.py:472"}, "properties": {"repobilityId": "7a0b78783ac474ff", "scanner": "scanner-primary", "fingerprint": "980af0e8881a1c2f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ac9a692825c917ab", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/upload_repo_review_issues.py:122"}, "properties": {"repobilityId": "755a7508ab7d1aec", "scanner": "scanner-primary", "fingerprint": "ac9a692825c917ab", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1c2002f0fc2829ea", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/check_gate_diff_quality.py:33"}, "properties": {"repobilityId": "6a8f2e2032b38be6", "scanner": "scanner-primary", "fingerprint": "1c2002f0fc2829ea", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-74a005333c06c0c6", "level": "none", "message": {"text": "Commented-code block (9 lines) in scripts/repo_review_body_writer.py:76"}, "properties": {"repobilityId": "31ae1db09f20d97f", "scanner": "scanner-primary", "fingerprint": "74a005333c06c0c6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e55890101d301b0b", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/run_consumer_repo_tests.py:44"}, "properties": {"repobilityId": "9c1effd3e2b9659a", "scanner": "scanner-primary", "fingerprint": "e55890101d301b0b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-07c51de4f6da3382", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/ci_cosmetic_repair.py:89"}, "properties": {"repobilityId": "619d73ff0951ec01", "scanner": "scanner-primary", "fingerprint": "07c51de4f6da3382", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-21738f5098ab9d4e", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/workflow_startup_failure_diagnostic.py:21"}, "properties": {"repobilityId": "335508eb9cb59fe8", "scanner": "scanner-primary", "fingerprint": "21738f5098ab9d4e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-583060ab8a72fa98", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/check_api_wrapper_guard.py:64"}, "properties": {"repobilityId": "fa2f69055d451b01", "scanner": "scanner-primary", "fingerprint": "583060ab8a72fa98", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-921d6058d45d5c9e", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/prune_agent_stubs.py:47"}, "properties": {"repobilityId": "dba58aac0635bcf5", "scanner": "scanner-primary", "fingerprint": "921d6058d45d5c9e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c0d53b7a4d28dce3", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/sync_label_docs.py:67"}, "properties": {"repobilityId": "b60cb86cbf76daba", "scanner": "scanner-primary", "fingerprint": "c0d53b7a4d28dce3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9276b6da07818ada", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/check_issue_consistency.py:182"}, "properties": {"repobilityId": "51a9d965c92f10a8", "scanner": "scanner-primary", "fingerprint": "9276b6da07818ada", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b71d2590793c245e", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/repo_review_evaluator.py:2036"}, "properties": {"repobilityId": "4c19bb175a71e26d", "scanner": "scanner-primary", "fingerprint": "b71d2590793c245e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c8fe825703814d06", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/update_langchain_versions.py:12"}, "properties": {"repobilityId": "a4bd82f6a6e0d93d", "scanner": "scanner-primary", "fingerprint": "c8fe825703814d06", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fb0017308728cf6b", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/repo_review_round2_runner.py:317"}, "properties": {"repobilityId": "df7083e3cb0c07c6", "scanner": "scanner-primary", "fingerprint": "fb0017308728cf6b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cfad3a5b47260e7c", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/create_verifier_labels.py:223"}, "properties": {"repobilityId": "b0500f0558377051", "scanner": "scanner-primary", "fingerprint": "cfad3a5b47260e7c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2ad4da6f4e273df5", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/check_consumer_sync_drift.py:817"}, "properties": {"repobilityId": "bb94d9533a4ce24b", "scanner": "scanner-primary", "fingerprint": "2ad4da6f4e273df5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c52405c46310fbac", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/sync_status_file_ignores.py:375"}, "properties": {"repobilityId": "3a5878ee62784207", "scanner": "scanner-primary", "fingerprint": "c52405c46310fbac", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b556d066ed6b584f", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/ledger_validate.py:369"}, "properties": {"repobilityId": "cb49472fdf0aaf86", "scanner": "scanner-primary", "fingerprint": "b556d066ed6b584f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c0dfcc0cbf13b139", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/workflow_validator.py:184"}, "properties": {"repobilityId": "c5b0f24496af0ff0", "scanner": "scanner-primary", "fingerprint": "c0dfcc0cbf13b139", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9f28e713d00ca864", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/bootstrap_consumer_settings.py:259"}, "properties": {"repobilityId": "af5906e2efca241b", "scanner": "scanner-primary", "fingerprint": "9f28e713d00ca864", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b34ca2266da0d5e3", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/langchain/task_decomposer.py:89"}, "properties": {"repobilityId": "0aaa6a3bdaaf69e6", "scanner": "scanner-primary", "fingerprint": "b34ca2266da0d5e3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dab633400506a4ad", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/langchain/issue_optimizer.py:180"}, "properties": {"repobilityId": "e15313d1051253b0", "scanner": "scanner-primary", "fingerprint": "dab633400506a4ad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-14fa150fb195dacb", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/langchain/issue_formatter.py:451"}, "properties": {"repobilityId": "c8fb4725b2642ea0", "scanner": "scanner-primary", "fingerprint": "14fa150fb195dacb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-23241d4397c04a4a", "level": "none", "message": {"text": "Commented-code block (7 lines) in templates/consumer-repo/.github/scripts/issue_scope_parser.js:587"}, "properties": {"repobilityId": "2c34d2db1a432666", "scanner": "scanner-primary", "fingerprint": "23241d4397c04a4a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-728f44055d37efb7", "level": "none", "message": {"text": "Commented-code block (6 lines) in templates/consumer-repo/.github/scripts/agents-guard.js:50"}, "properties": {"repobilityId": "043207fd8976f49e", "scanner": "scanner-primary", "fingerprint": "728f44055d37efb7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2e6bf1880963f623", "level": "none", "message": {"text": "Commented-code block (5 lines) in templates/consumer-repo/.github/scripts/parse_chatgpt_topics.py:16"}, "properties": {"repobilityId": "74c34c1fe10e5d34", "scanner": "scanner-primary", "fingerprint": "2e6bf1880963f623", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-868e2d37ca6b8fd4", "level": "none", "message": {"text": "Commented-code block (8 lines) in templates/consumer-repo/.github/scripts/agent_delegation_policy.js:227"}, "properties": {"repobilityId": "666c6e742799b61c", "scanner": "scanner-primary", "fingerprint": "868e2d37ca6b8fd4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cb73e61c3e7bf03d", "level": "none", "message": {"text": "Commented-code block (6 lines) in templates/consumer-repo/.github/scripts/keepalive_loop.js:1726"}, "properties": {"repobilityId": "f2b2a8a93004ec73", "scanner": "scanner-primary", "fingerprint": "cb73e61c3e7bf03d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e7c53c1d72dd71e5", "level": "none", "message": {"text": "Commented-code block (7 lines) in templates/consumer-repo/.github/scripts/agents_pr_meta_keepalive.js:446"}, "properties": {"repobilityId": "57cf6d81bf821223", "scanner": "scanner-primary", "fingerprint": "e7c53c1d72dd71e5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a8bbcff51ff0a7c1", "level": "none", "message": {"text": "Commented-code block (5 lines) in templates/consumer-repo/.github/scripts/github-api-with-retry.js:148"}, "properties": {"repobilityId": "a63d20adc5f5f05e", "scanner": "scanner-primary", "fingerprint": "a8bbcff51ff0a7c1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ce06652298571657", "level": "none", "message": {"text": "Commented-code block (6 lines) in templates/consumer-repo/.github/scripts/agent_registry.js:74"}, "properties": {"repobilityId": "96843e7fe8858721", "scanner": "scanner-primary", "fingerprint": "ce06652298571657", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-557196a152190d64", "level": "note", "message": {"text": "Legacy-named symbol `isLegacy` in templates/consumer-repo/.github/scripts/comment-dedupe.js:65"}, "properties": {"repobilityId": "49166f95e881b50d", "scanner": "scanner-primary", "fingerprint": "557196a152190d64", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9341b125e484b66b", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/coverage_guard.py:387"}, "properties": {"repobilityId": "617441b7f0db23c0", "scanner": "scanner-primary", "fingerprint": "9341b125e484b66b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cd525cb775d390e3", "level": "none", "message": {"text": "Commented-code block (7 lines) in .github/scripts/issue_scope_parser.js:587"}, "properties": {"repobilityId": "7b8db4f8432ca2fd", "scanner": "scanner-primary", "fingerprint": "cd525cb775d390e3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f667c363f40efacd", "level": "none", "message": {"text": "Commented-code block (6 lines) in .github/scripts/agents-guard.js:50"}, "properties": {"repobilityId": "aa3a6d91220c9a49", "scanner": "scanner-primary", "fingerprint": "f667c363f40efacd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-83792da8f370e5a1", "level": "none", "message": {"text": "Commented-code block (5 lines) in .github/scripts/parse_chatgpt_topics.py:16"}, "properties": {"repobilityId": "49aa040e0963a002", "scanner": "scanner-primary", "fingerprint": "83792da8f370e5a1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-75c7358b7a61fe7f", "level": "none", "message": {"text": "Commented-code block (8 lines) in .github/scripts/agent_delegation_policy.js:227"}, "properties": {"repobilityId": "6ce955d7e72db090", "scanner": "scanner-primary", "fingerprint": "75c7358b7a61fe7f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-59c107355a35943b", "level": "none", "message": {"text": "Commented-code block (6 lines) in .github/scripts/keepalive_loop.js:1726"}, "properties": {"repobilityId": "264032bae8164a88", "scanner": "scanner-primary", "fingerprint": "59c107355a35943b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d799b8d5aa7d1db6", "level": "none", "message": {"text": "Commented-code block (7 lines) in .github/scripts/agents_pr_meta_keepalive.js:446"}, "properties": {"repobilityId": "0a9c6d034221c014", "scanner": "scanner-primary", "fingerprint": "d799b8d5aa7d1db6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b3e2958eeae9bd0", "level": "none", "message": {"text": "Commented-code block (5 lines) in .github/scripts/github-api-with-retry.js:148"}, "properties": {"repobilityId": "773bcfb5f3c69ae9", "scanner": "scanner-primary", "fingerprint": "4b3e2958eeae9bd0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e6e9ae8cb1796b39", "level": "none", "message": {"text": "Commented-code block (6 lines) in .github/scripts/agent_registry.js:74"}, "properties": {"repobilityId": "becf01a76a7ac1c4", "scanner": "scanner-primary", "fingerprint": "e6e9ae8cb1796b39", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-adabb75f2201ed96", "level": "note", "message": {"text": "Legacy-named symbol `isLegacy` in .github/scripts/comment-dedupe.js:65"}, "properties": {"repobilityId": "194d9fe3a76b3bf4", "scanner": "scanner-primary", "fingerprint": "adabb75f2201ed96", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-abe8715d7576b84f", "level": "note", "message": {"text": "Legacy-named symbol `nOld` in .github/scripts/__tests__/agents-pr-meta-update-body.test.js:1507"}, "properties": {"repobilityId": "c4d3d89a62b0abc3", "scanner": "scanner-primary", "fingerprint": "abe8715d7576b84f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5fbee23caec6bfd9", "level": "note", "message": {"text": "Legacy-named symbol `nOld` in .github/scripts/__tests__/sync-tracker-state.test.js:480"}, "properties": {"repobilityId": "31a130a5eca28511", "scanner": "scanner-primary", "fingerprint": "5fbee23caec6bfd9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5e6d1383f3ec0db0", "level": "none", "message": {"text": "Commented-code block (6 lines) in .github/scripts/__tests__/conflict-detector.test.js:69"}, "properties": {"repobilityId": "d89da8ebe55afbd4", "scanner": "scanner-primary", "fingerprint": "5e6d1383f3ec0db0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d728ada752befac4", "level": "note", "message": {"text": "Stub function `unused_func` (body is just `pass`/`return`) \u2014 src/trend_analysis/_autofix_violation_case2.py:20"}, "properties": {"repobilityId": "805512d5bbb044d4", "scanner": "scanner-primary", "fingerprint": "d728ada752befac4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "81991be90107b9b9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "57a297e0748ae186", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "73e76127807be29e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "67d2d43fc11fdfdb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "063fc5fdfb54ac02", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "500c15a19bb4bf0f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5934a0e59fabe20b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ed7904a760dbe22f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0e0abec9fcc88d02", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3349d375b427b5f4", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "03292d76b2975ed5", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bb38600b31f9ae8e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ac12f4a0176c983f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "69aaefe6abdec8a4", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "867daf4437f34e80", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9d93156a9cc3cbc7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6a2b47d3d68211b1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6afe3909a0dd26ca", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "820601238277c9e3", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "8eb882e5d2d1c19c", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}