← Legacy view v2 (rp.*)

ebookfoundation/free-programming-books

https://github.com/EbookFoundation/free-programming-books.git · lang: python · LOC: · source: both

Quality

73.9

Grade B

Security

100.0

Findings

23

0 critical · 19 high

Status

completed

Jun 4, 2026 04:05

high: 19 medium: 3 info: 1

Top rules by occurrence

Rule	Severity	Count
`MINED115` GitHub Action pinned to mutable ref (not 40-char SHA)	high	19
`MINED111` Bare except continues silently	medium	2
`CORE_LARGE_FILES` Average file size is 1080 lines (recommend <300)	medium	1
`CORE_NO_TESTS` No test files found	high	1

First 23 findings (severity-sorted)

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/check-urls.yml:40 · conf 0.90

[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/check-urls.yml:45 · conf 0.90

[MINED115] Action `tj-actions/changed-files` pinned to mutable ref `@v46`: `uses: tj-actions/changed-files@v46` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; …

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/check-urls.yml:78 · conf 0.90

[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/check-urls.yml:83 · conf 0.90

[MINED115] Action `ruby/setup-ruby` pinned to mutable ref `@v1`: `uses: ruby/setup-ruby@v1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-act…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/check-urls.yml:110 · conf 0.90

[MINED115] Action `actions/upload-artifact` pinned to mutable ref `@v7`: `uses: actions/upload-artifact@v7` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/check-urls.yml:122 · conf 0.90

[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/check-urls.yml:125 · conf 0.90

[MINED115] Action `actions/download-artifact` pinned to mutable ref `@v8`: `uses: actions/download-artifact@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; …

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/comment-pr.yml:18 · conf 0.90

[MINED115] Action `actions/github-script` pinned to mutable ref `@v9`: `uses: actions/github-script@v9` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that mad…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/detect-conflicting-prs.yml:32 · conf 0.90

[MINED115] Action `eps1lon/actions-label-merge-conflict` pinned to mutable ref `@v3.0.3`: `uses: eps1lon/[email protected]` resolves at workflow-run time. Tags and branches can be r…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/fpb-lint.yml:14 · conf 0.90

[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/fpb-lint.yml:16 · conf 0.90

[MINED115] Action `actions/setup-node` pinned to mutable ref `@v6`: `uses: actions/setup-node@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/fpb-lint.yml:31 · conf 0.90

[MINED115] Action `actions/upload-artifact` pinned to mutable ref `@v7`: `uses: actions/upload-artifact@v7` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/issues-pinner.yml:38 · conf 0.90

[MINED115] Action `actions-ecosystem/action-add-labels` pinned to mutable ref `@v1`: `uses: actions-ecosystem/action-add-labels@v1` resolves at workflow-run time. Tags and branches can be re-pushed b…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/issues-pinner.yml:48 · conf 0.90

[MINED115] Action `actions-ecosystem/action-remove-labels` pinned to mutable ref `@v1`: `uses: actions-ecosystem/action-remove-labels@v1` resolves at workflow-run time. Tags and branches can be re-pu…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/rtl-ltr-linter.yml:15 · conf 0.90

[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/rtl-ltr-linter.yml:23 · conf 0.90

[MINED115] Action `actions/setup-python` pinned to mutable ref `@v6`: `uses: actions/setup-python@v6` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made …

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/rtl-ltr-linter.yml:43 · conf 0.90

[MINED115] Action `tj-actions/changed-files` pinned to mutable ref `@v46`: `uses: tj-actions/changed-files@v46` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; …

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/rtl-ltr-linter.yml:97 · conf 0.90

[MINED115] Action `actions/upload-artifact` pinned to mutable ref `@v7`: `uses: actions/upload-artifact@v7` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that…

high MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) CWE-829

.github/workflows/stale.yml:22 · conf 0.90

[MINED115] Action `actions/stale` pinned to mutable ref `@v10`: `uses: actions/stale@v10` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actio…

medium CORE_LARGE_FILES Average file size is 1080 lines (recommend <300)

Average file size is 605 lines (recommend <300)

medium MINED111 Bare except continues silently

scripts/rtl_ltr_linter.py:70 · conf 1.00

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

medium MINED111 Bare except continues silently

scripts/rtl_ltr_linter.py:214 · conf 1.00

[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

info CORE_NO_TESTS No test files found

· conf 0.35

No test files found in a documentation, catalog, or template-heavy repository

Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/6e12f592-776f-45a0-bace-d304b3f7903a/.