{"version":"1.182.1","results":[{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/ci.yml","start":{"line":15,"col":9,"offset":274},"end":{"line":15,"col":34,"offset":299},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/ci.yml","start":{"line":16,"col":9,"offset":308},"end":{"line":16,"col":59,"offset":358},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/ci.yml","start":{"line":39,"col":9,"offset":1032},"end":{"line":39,"col":34,"offset":1057},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/ci.yml","start":{"line":44,"col":9,"offset":1317},"end":{"line":44,"col":59,"offset":1367},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/e3-two-node-manual.yml","start":{"line":25,"col":9,"offset":698},"end":{"line":25,"col":34,"offset":723},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/e3-two-node-manual.yml","start":{"line":33,"col":9,"offset":923},"end":{"line":33,"col":59,"offset":973},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/e3-two-node-manual.yml","start":{"line":64,"col":9,"offset":2101},"end":{"line":64,"col":41,"offset":2133},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/e3-ui.yml","start":{"line":28,"col":9,"offset":386},"end":{"line":28,"col":34,"offset":411},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/e3-ui.yml","start":{"line":41,"col":9,"offset":668},"end":{"line":41,"col":59,"offset":718},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/e3-ui.yml","start":{"line":62,"col":9,"offset":1372},"end":{"line":62,"col":41,"offset":1404},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/release.yml","start":{"line":31,"col":9,"offset":736},"end":{"line":31,"col":34,"offset":761},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/release.yml","start":{"line":36,"col":9,"offset":1021},"end":{"line":36,"col":59,"offset":1071},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/release.yml","start":{"line":61,"col":9,"offset":2284},"end":{"line":61,"col":41,"offset":2316},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/release.yml","start":{"line":67,"col":9,"offset":2494},"end":{"line":67,"col":45,"offset":2530},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/windows-build.yml","start":{"line":17,"col":9,"offset":265},"end":{"line":17,"col":34,"offset":290},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/windows-build.yml","start":{"line":25,"col":9,"offset":490},"end":{"line":25,"col":59,"offset":540},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}},{"check_id":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","path":".github/workflows/windows-build.yml","start":{"line":54,"col":9,"offset":1524},"end":{"line":54,"col":41,"offset":1556},"extra":{"message":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.","metadata":{"category":"security","cwe":["CWE-1357: Reliance on Insufficiently Trustworthy Component","CWE-353: Missing Support for Integrity Check"],"owasp":["A08:2021 - Software and Data Integrity Failures","A08:2025 - Software and Data Integrity Failures"],"references":["https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"],"technology":["github-actions"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cryptographic Issues","Other"],"source":"https://semgrep.dev/r/yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag","shortlink":"https://sg.run/2LgAL"},"severity":"WARNING","fingerprint":"requires login","lines":"requires login","validation_state":"NO_VALIDATOR","engine_kind":"OSS"}}],"errors":[{"code":3,"level":"warn","type":"Syntax error","message":"Syntax error at line scripts/test-core.sh:1:\n `#!/usr/bin/env bash\n# Build and run forumer_core's unit tests.\n#\n#     ./scripts/test-core.sh\n#\n# Needs only Nix: cmake, a C++ compiler, libsodium, SQLite and nlohmann/json are\n# fetched from nixpkgs automatically. Set FORUMER_NO_NIX=1 to use the system's\n# instead.\nset -euo pipefail\ncd \"$(dirname \"$0\")/..\"\n\n# Path of lib<name>.dylib / lib<name>.so inside a Nix store output, or \"\".\nfind_lib() {\n    local dir=\"$1\" name=\"$2\" f\n    for f in \"$dir/lib/lib$name.dylib\" \"$dir/lib/lib$name.so\"; do\n        if [[ -e \"$f\" ]]; then echo \"$f\"; return; fi\n    done\n    echo \"\"\n}\n\nCMAKE_ARGS=()\nif [[ -z \"${FORUMER_NO_NIX:-}\" ]] && command -v nix >/dev/null 2>&1; then\n    # Re-run ourselves inside a shell with Nix's cmake and compiler. (Nix's\n    # cmake ignores the macOS SDK, so the system AppleClang can't be mixed in.)\n    if [[ -z \"${FORUMER_IN_NIX_SHELL:-}\" ]]; then\n        export FORUMER_IN_NIX_SHELL=1\n        exec nix shell nixpkgs#cmake nixpkgs#stdenv.cc -c \"$0\" \"$@\"\n    fi\n    # Headers (.dev) and libraries (.out) are separate store paths.\n    SODIUM_DEV=\"$(nix build --no-link --print-out-paths nixpkgs#libsodium.dev)\"\n    SODIUM_LIB=\"$(find_lib \"$(nix build --no-link --print-out-paths nixpkgs#libsodium.out)\" sodium)\"\n    SQLITE_DEV=\"$(nix build --no-link --print-out-paths nixpkgs#sqlite.dev)\"\n    SQLITE_LIB=\"$(find_lib \"$(nix build --no-link --print-out-paths nixpkgs#sqlite.out)\" sqlite3)\"\n    # nlohmann/json is header-only.\n    JSON_DIR=\"$(nix build --no-link --print-out-paths nixpkgs#nlohmann_json)\"\n\n    echo \"libsodium: $SODIUM_DEV/include  $SODIUM_LIB\"\n    echo \"sqlite:    $SQLITE_DEV/include  $SQLITE_LIB\"\n    echo \"json:      $JSON_DIR\"\n    CMAKE_ARGS+=(\"-DSODIUM_INCLUDE_DIR=$SODIUM_DEV/include\" \"-DSODIUM_LIBRARY=$SODIUM_LIB\")\n    CMAKE_ARGS+=(\"-DSQLite3_INCLUDE_DIR=$SQLITE_DEV/include\" \"-DSQLite3_LIBRARY=$SQLITE_LIB\")\n    CMAKE_ARGS+=(\"-DCMAKE_PREFIX_PATH=$JSON_DIR\")\n    CMAKE_ARGS+=(\"-DCMAKE_CXX_COMPILER=$(command -v c++)\")\nfi\n\nBUILD_DIR=\"${BUILD_DIR:-build/core-tests}\"\ncmake -S lib/forumer_core -B \"$BUILD_DIR\" -D... (truncated 194 more characters)","path":"scripts/test-core.sh"},{"code":3,"level":"warn","type":"Syntax error","message":"Syntax error at line scripts/test-image-pipeline.sh:1:\n `#!/usr/bin/env bash\nset -euo pipefail\ncd \"$(dirname \"$0\")/..\"\n\n# Enter a reproducible Nix environment.\nif command -v nix >/dev/null && [[ -z \"${FORUMER_IMAGE_IN_NIX:-}\" ]]; then\n    export FORUMER_IMAGE_IN_NIX=1\n\n    packages=(\n        nixpkgs#cmake\n        nixpkgs#stdenv.cc\n        nixpkgs#qt6.qtbase.dev\n        nixpkgs#qt6.qtbase.out\n    )\n\n    # Linux Qt6Gui requires GLVND OpenGL headers/libraries.\n    if [[ \"$(uname -s)\" == Linux ]]; then\n        packages+=(nixpkgs#libglvnd.dev nixpkgs#libglvnd.out)\n    fi\n\n    exec nix shell \"${packages[@]}\" -c bash \"$0\"\nfi\n\ncmake_args=(-DCMAKE_BUILD_TYPE=Debug)\n\nif command -v nix >/dev/null; then\n    QT_DEV=\"$(nix build --no-link --print-out-paths nixpkgs#qt6.qtbase.dev)\"\n    cmake_args+=(\"-DCMAKE_PREFIX_PATH=$QT_DEV\")\n\n    if [[ \"$(uname -s)\" == Linux ]]; then\n        GL_DEV=\"$(nix build --no-link --print-out-paths nixpkgs#libglvnd.dev)\"\n        GL_OUT=\"$(nix build --no-link --print-out-paths nixpkgs#libglvnd.out)\"\n\n        find_gl_lib() {\n            local name=\"$1\" path\n            for path in \"$GL_DEV/lib/lib${name}.so\" \"$GL_OUT/lib/lib${name}.so\"; do\n                if [[ -e \"$path\" ]]; then\n                    printf '%s\\n' \"$path\"\n                    return 0\n                fi\n            done\n            echo \"Missing lib${name}.so in GLVND outputs\" >&2\n            return 1\n        }\n\n        cmake_args+=(\n            \"-DCMAKE_PREFIX_PATH=$QT_DEV;$GL_DEV;$GL_OUT\"\n            \"-DOPENGL_INCLUDE_DIR=$GL_DEV/include\"\n            \"-DOPENGL_GLX_INCLUDE_DIR=$GL_DEV/include\"\n            \"-DOPENGL_opengl_LIBRARY=$(find_gl_lib OpenGL)\"\n            \"-DOPENGL_glx_LIBRARY=$(find_gl_lib GLX)\"\n        )\n    fi\nfi\n\ncmake -S tests/image-pipeline -B build/image-pipeline \\\n    \"${cmake_args[@]}\"\n\ncmake --build build/image-pipeline --parallel\n\nQT_QPA_PLATFORM=offscreen \\\n    ctest --test-dir build/image-pipeline --output-on-failure\n` was unexpected","path":"scripts/test-image-pipeline.sh"},{"code":3,"level":"warn","type":["PartialParsing",[{"path":".github/workflows/release.yml","start":{"line":57,"col":39,"offset":1863},"end":{"line":57,"col":56,"offset":1880}},{"path":".github/workflows/release.yml","start":{"line":58,"col":57,"offset":1863},"end":{"line":58,"col":74,"offset":1880}}]],"message":"Syntax error at line .github/workflows/release.yml:57:\n When parsing a snippet as Bash for metavariable-pattern in rule 'yaml.github-actions.security.curl-eval.curl-eval', `{ matrix.platform` was unexpected","path":".github/workflows/release.yml","spans":[{"file":".github/workflows/release.yml","start":{"line":57,"col":39,"offset":1863},"end":{"line":57,"col":56,"offset":1880}},{"file":".github/workflows/release.yml","start":{"line":58,"col":57,"offset":1863},"end":{"line":58,"col":74,"offset":1880}}]},{"code":3,"level":"warn","type":["PartialParsing",[{"path":".github/workflows/release.yml","start":{"line":57,"col":39,"offset":1863},"end":{"line":57,"col":56,"offset":1880}},{"path":".github/workflows/release.yml","start":{"line":58,"col":57,"offset":1863},"end":{"line":58,"col":74,"offset":1880}}]],"message":"Syntax error at line .github/workflows/release.yml:57:\n When parsing a snippet as Bash for metavariable-pattern in rule 'yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell', `{ matrix.platform` was unexpected","path":".github/workflows/release.yml","spans":[{"file":".github/workflows/release.yml","start":{"line":57,"col":39,"offset":1863},"end":{"line":57,"col":56,"offset":1880}},{"file":".github/workflows/release.yml","start":{"line":58,"col":57,"offset":1863},"end":{"line":58,"col":74,"offset":1880}}]},{"code":3,"level":"warn","type":["PartialParsing",[{"path":"src/qml/links.js","start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":8,"offset":7}}]],"message":"Syntax error at line src/qml/links.js:1:\n `.pragma` was unexpected","path":"src/qml/links.js","spans":[{"file":"src/qml/links.js","start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":8,"offset":7}}]},{"code":3,"level":"warn","type":["PartialParsing",[{"path":"src/qml/markdown.js","start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":8,"offset":7}}]],"message":"Syntax error at line src/qml/markdown.js:1:\n `.pragma` was unexpected","path":"src/qml/markdown.js","spans":[{"file":"src/qml/markdown.js","start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":8,"offset":7}}]}],"paths":{"scanned":[".github/workflows/ci.yml",".github/workflows/e3-two-node-manual.yml",".github/workflows/e3-ui.yml",".github/workflows/release.yml",".github/workflows/windows-build.yml",".gitignore","AGENTS.md","CMakeLists.txt","LICENSE-APACHE-v2","LICENSE-MIT","README.md","docs/Forumer-android.md","docs/Forumer-description.md","docs/architecture.md","docs/e3/offline-send-restart.md","docs/e3/reelcut-integration.md","docs/e3-testing.md","docs/releases/v0.2.5.md","docs/security.md","docs/testing.md","flake.nix","forum-topic-plan.md","helper-mds/module-actions.md","helper-mds/module-considerations.md","helper-mds/module-info.md","lib/forumer_core/CMakeLists.txt","lib/forumer_core/include/forumer_core/account_store.h","lib/forumer_core/include/forumer_core/bytes.h","lib/forumer_core/include/forumer_core/crypto.h","lib/forumer_core/include/forumer_core/digest_plan.h","lib/forumer_core/include/forumer_core/flood.h","lib/forumer_core/include/forumer_core/forums.h","lib/forumer_core/include/forumer_core/identity.h","lib/forumer_core/include/forumer_core/media.h","lib/forumer_core/include/forumer_core/mnemonic.h","lib/forumer_core/include/forumer_core/post.h","lib/forumer_core/include/forumer_core/post_store.h","lib/forumer_core/include/forumer_core/redact.h","lib/forumer_core/include/forumer_core/sealed.h","lib/forumer_core/include/forumer_core/sync.h","lib/forumer_core/include/forumer_core/thread.h","lib/forumer_core/include/forumer_core/vault.h","lib/forumer_core/src/account_store.cpp","lib/forumer_core/src/bip39_english.inc","lib/forumer_core/src/bytes.cpp","lib/forumer_core/src/crypto.cpp","lib/forumer_core/src/digest_plan.cpp","lib/forumer_core/src/flood.cpp","lib/forumer_core/src/forums.cpp","lib/forumer_core/src/identity.cpp","lib/forumer_core/src/media.cpp","lib/forumer_core/src/mnemonic.cpp","lib/forumer_core/src/post.cpp","lib/forumer_core/src/post_store.cpp","lib/forumer_core/src/sealed.cpp","lib/forumer_core/src/sync.cpp","lib/forumer_core/src/thread.cpp","lib/forumer_core/src/vault.cpp","metadata.json","module.json","scripts/check-logs.sh","scripts/create_config_for_clangd.sh","scripts/rename-to-forumer.sh","scripts/t_build_install_all.sh","scripts/t_integration_tests.sh","scripts/test-core.sh","scripts/test-image-pipeline.sh","scripts/test-links.mjs","scripts/test-log-safety.mjs","scripts/test-markdown.mjs","scripts/test-phase-a-handler.mjs","scripts/two-instances.sh","skills/rename-logos-module/SKILL.md","skills/surface-metadata-in-ui/SKILL.md","skills/use-another-module/SKILL.md","skills/use-delivery-module/SKILL.md","skills/use-design-system/SKILL.md","src/base64.cpp","src/base64.h","src/delivery_module_transport.cpp","src/delivery_module_transport.h","src/forumer.rep","src/forumer_backend.cpp","src/forumer_backend.h","src/image_prep.cpp","src/image_prep.h","src/qml/BackupScreen.qml","src/qml/ChatsScreen.qml","src/qml/Chip.qml","src/qml/ComposerSheet.qml","src/qml/FArea.qml","src/qml/FButton.qml","src/qml/FField.qml","src/qml/FeedColumn.qml","src/qml/ForumStore.qml","src/qml/HomeScreen.qml","src/qml/Icon.qml","src/qml/JoinForumSheet.qml","src/qml/Main.qml","src/qml/MdEditor.qml","src/qml/MdText.qml","src/qml/MdTool.qml","src/qml/MediaCards.qml","src/qml/MediaStrip.qml","src/qml/MissedScreen.qml","src/qml/MuteBell.qml","src/qml/MyPostsScreen.qml","src/qml/NavItem.qml","src/qml/NewForumSheet.qml","src/qml/Notice.qml","src/qml/OnboardingScreen.qml","src/qml/Page.qml","src/qml/PhraseScreen.qml","src/qml/PostLine.qml","src/qml/ProfileScreen.qml","src/qml/QuotaLine.qml","src/qml/RepliesScreen.qml","src/qml/ReplyItem.qml","src/qml/ReplyLine.qml","src/qml/ReplyToast.qml","src/qml/RestoreNotice.qml","src/qml/Section.qml","src/qml/Segmented.qml","src/qml/SettingsScreen.qml","src/qml/Sheet.qml","src/qml/Sidebar.qml","src/qml/StateTag.qml","src/qml/StorageProbe.qml","src/qml/ThreadScreen.qml","src/qml/TopicRow.qml","src/qml/Ui.qml","src/qml/fonts/OFL-ChakraPetch.txt","src/qml/fonts/OFL-ShareTechMono.txt","src/qml/links.js","src/qml/markdown.js","src/qml/qmldir"]},"time":{"rules":[],"rules_parse_time":1.2986550331115723,"profiling_times":{"config_time":4.05324649810791,"core_time":4.318006992340088,"ignores_time":0.0036096572875976562,"total_time":8.413591623306274},"parsing_time":{"total_time":1.3920130729675293,"per_file_time":{"mean":0.006000056348997971,"std_dev":0.0007254435963833829},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"scanning_time":{"total_time":5.435649394989014,"per_file_time":{"mean":0.017366291996770016,"std_dev":0.0028592360780394926},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_files":[]},"matching_time":{"total_time":0.8207404613494873,"per_file_and_rule_time":{"mean":0.00353767440236848,"std_dev":8.39787122356493e-05},"very_slow_stats":{"time_ratio":0.0,"count_ratio":0.0},"very_slow_rules_on_files":[]},"tainting_time":{"total_time":0.2576749324798584,"per_def_and_rule_time":{"mean":0.0019229472573123762,"std_dev":3.772245092573985e-05},"very_slow_stats":{"time_ratio":0.25599319742368154,"count_ratio":0.007462686567164179},"very_slow_rules_on_defs":[{"fpath":"scripts/test-log-safety.mjs","fline":1,"rule_id":"javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","time":0.0659630298614502}]},"fixpoint_timeouts":[],"prefiltering":{"project_level_time":0.0,"file_level_time":0.0,"rules_with_project_prefilters_ratio":0.0,"rules_with_file_prefilters_ratio":0.9750557962452409,"rules_selected_ratio":0.03623473808586058,"rules_matched_ratio":0.03623473808586058},"targets":[],"total_bytes":0,"max_memory_bytes":964755200},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]}