{
  "history": [
    {
      "added": 0,
      "commit": "7625e203c17c88c91fa1b1b8e2937907f22a1523",
      "date": "2026-11-01",
      "dependencies": 42,
      "errors": [],
      "fixable": 0,
      "go_version": null,
      "in_binary": null,
      "new_vulnerabilities": 0,
      "osv_confirmed": 0,
      "osv_only": 0,
      "ref": "0.45.2",
      "release_changed": false,
      "release_integrity": "none",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 7.5,
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 0
      },
      "workflow": {
        "High": 106,
        "Low": 34,
        "Medium": 13,
        "files": 22
      }
    },
    {
      "added": 0,
      "commit": "7625e203c17c88c91fa1b1b8e2937907f22a1523",
      "date": "2026-11-02",
      "dependencies": 41,
      "errors": [],
      "fixable": 0,
      "go_version": null,
      "in_binary": null,
      "kev": null,
      "kev_new": 0,
      "new_vulnerabilities": 0,
      "osv_confirmed": 0,
      "osv_only": 0,
      "ref": "0.45.2",
      "release_changed": false,
      "release_integrity": "none",
      "removed": 1,
      "resolved_vulnerabilities": 0,
      "scorecard": 7.5,
      "scorecard_date": "2026-11-02",
      "scorecard_note": null,
      "scorecard_source": "openssf-api",
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 0
      },
      "vulnerable_packages": 0,
      "workflow": {
        "High": 106,
        "Low": 34,
        "Medium": 13,
        "files": 21
      }
    }
  ],
  "latest": {
    "archived": false,
    "category": "Container Security \u203a Runtime Security",
    "changes": {
      "added": [],
      "any": true,
      "baseline": false,
      "integrity_drift": 0,
      "license_changes": [],
      "new_vulnerabilities": [],
      "previous_ref": "0.45.2",
      "release_changed": false,
      "removed": [
        "falcosecurity/event-generator@2bfdbb7f7a98ad3d44b45e2230dc3f850dee65c9"
      ],
      "resolved_vulnerabilities": [],
      "upgraded": [],
      "workflow_new": 0,
      "workflow_resolved": 0
    },
    "commit": "7625e203c17c88c91fa1b1b8e2937907f22a1523",
    "compliance": {
      "overall_score": 55,
      "standards": {
        "bsi_tr03183": {
          "failed_checks": [
            "Component Creator",
            "Distribution Licences",
            "SHA-512 Hash",
            "Dependency Relationship",
            "SBOM Creator Contact"
          ],
          "passed": 4,
          "score": 44,
          "total": 9
        },
        "cisa": {
          "failed_checks": [
            "Software Producer",
            "Dependency Relationship",
            "License Information",
            "Component Hash",
            "SBOM Author"
          ],
          "passed": 5,
          "score": 50,
          "total": 10
        },
        "ntia": {
          "failed_checks": [
            "Supplier Name",
            "Dependency Relationship"
          ],
          "passed": 5,
          "score": 71,
          "total": 7
        }
      }
    },
    "components": [
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/reusable_publish_docker.yaml",
        "name": "actions/attest-build-provenance",
        "purl": "pkg:github/actions/attest-build-provenance@v1.1.2",
        "version": "v1.1.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/reusable_test_packages_with_evtgen.yaml",
        "name": "actions/checkout",
        "purl": "pkg:github/actions/checkout@v4",
        "version": "v4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "actions/checkout",
        "purl": "pkg:github/actions/checkout@v4.1.0",
        "version": "v4.1.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/bump-libs.yaml",
        "name": "actions/checkout",
        "purl": "pkg:github/actions/checkout@v4.1.1",
        "version": "v4.1.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/helm-check.yaml",
        "name": "actions/checkout",
        "purl": "pkg:github/actions/checkout@v6.0.2",
        "version": "v6.0.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yaml",
        "name": "actions/download-artifact",
        "purl": "pkg:github/actions/download-artifact@v4.1.8",
        "version": "v4.1.8"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/helm-check.yaml",
        "name": "actions/setup-go",
        "purl": "pkg:github/actions/setup-go@v6.4.0",
        "version": "v6.4.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/reusable_build_packages.yaml",
        "name": "actions/setup-node",
        "purl": "pkg:github/actions/setup-node@v3.8.1",
        "version": "v3.8.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/helm-check.yaml",
        "name": "actions/setup-python",
        "purl": "pkg:github/actions/setup-python@v6.2.0",
        "version": "v6.2.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/format.yaml",
        "name": "actions/upload-artifact",
        "purl": "pkg:github/actions/upload-artifact@v4.6.0",
        "version": "v4.6.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/reusable_publish_docker.yaml",
        "name": "aws-actions/amazon-ecr-login",
        "purl": "pkg:github/aws-actions/amazon-ecr-login@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/reusable_publish_docker.yaml",
        "name": "aws-actions/configure-aws-credentials",
        "purl": "pkg:github/aws-actions/configure-aws-credentials@v4.0.1",
        "version": "v4.0.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/helm-check.yaml",
        "name": "azure/setup-helm",
        "purl": "pkg:github/azure/setup-helm@v5.0.0",
        "version": "v5.0.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/codespell.yml",
        "name": "codespell-project/actions-codespell",
        "purl": "pkg:github/codespell-project/actions-codespell@v2.0",
        "version": "v2.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/reusable_publish_docker.yaml",
        "name": "docker/login-action",
        "purl": "pkg:github/docker/login-action@v4.6.0",
        "version": "v4.6.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/reusable_build_docker.yaml",
        "name": "docker/setup-buildx-action",
        "purl": "pkg:github/docker/setup-buildx-action@v3.0.0",
        "version": "v3.0.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/engine-version-weakcheck.yaml",
        "name": "dorny/paths-filter",
        "purl": "pkg:github/dorny/paths-filter@v2.11.1",
        "version": "v2.11.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yaml",
        "name": "ekoops/rn2md",
        "purl": "pkg:github/ekoops/rn2md@2",
        "version": "2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/reusable_build_packages.yaml",
        "name": "falcosecurity/libs/.github/actions/install-zig",
        "purl": "pkg:github/falcosecurity/libs@master#.github/actions/install-zig",
        "version": "master"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/reusable_test_packages.yaml",
        "name": "falcosecurity/testing",
        "purl": "pkg:github/falcosecurity/testing@main",
        "version": "main"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/codeql.yaml",
        "name": "github/codeql-action/analyze",
        "purl": "pkg:github/github/codeql-action@v3.24.5#analyze",
        "version": "v3.24.5"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/codeql.yaml",
        "name": "github/codeql-action/init",
        "purl": "pkg:github/github/codeql-action@v3.24.5#init",
        "version": "v3.24.5"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/scorecard.yaml",
        "name": "github/codeql-action/upload-sarif",
        "purl": "pkg:github/github/codeql-action@v3.24.5#upload-sarif",
        "version": "v3.24.5"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/helm-check.yaml",
        "name": "helm/chart-testing-action",
        "purl": "pkg:github/helm/chart-testing-action@v2.8.0",
        "version": "v2.8.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/helm-check.yaml",
        "name": "helm/kind-action",
        "purl": "pkg:github/helm/kind-action@v1.14.0",
        "version": "v1.14.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/reusable_publish_docker.yaml",
        "name": "imjasonh/setup-crane",
        "purl": "pkg:github/imjasonh/setup-crane@v0.7",
        "version": "v0.7"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/engine-version-weakcheck.yaml",
        "name": "mshick/add-pr-comment",
        "purl": "pkg:github/mshick/add-pr-comment@v2.8.1",
        "version": "v2.8.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/scorecard.yaml",
        "name": "ossf/scorecard-action",
        "purl": "pkg:github/ossf/scorecard-action@v2.4.4",
        "version": "v2.4.4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/bump-libs.yaml",
        "name": "peter-evans/create-pull-request",
        "purl": "pkg:github/peter-evans/create-pull-request@v7.0.5",
        "version": "v7.0.5"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yaml",
        "name": "rez0n/actions-github-release",
        "purl": "pkg:github/rez0n/actions-github-release@v2.0",
        "version": "v2.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/reusable_publish_docker.yaml",
        "name": "sigstore/cosign-installer",
        "purl": "pkg:github/sigstore/cosign-installer@v3.5.0",
        "version": "v3.5.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yaml",
        "name": "softprops/action-gh-release",
        "purl": "pkg:github/softprops/action-gh-release@v0.1.15",
        "version": "v0.1.15"
      },
      {
        "ecosystem": "unknown",
        "licenses": [],
        "location": ".github/workflows/reusable_test_packages_with_evtgen.yaml",
        "name": "./.github/actions/event-generator-tests",
        "purl": "",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "unknown",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "./.github/workflows/reusable_build_dev.yaml",
        "purl": "",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "unknown",
        "licenses": [],
        "location": ".github/workflows/image-trust.yaml",
        "name": "./.github/workflows/reusable_build_docker.yaml",
        "purl": "",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "unknown",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "./.github/workflows/reusable_build_packages.yaml",
        "purl": "",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "unknown",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "./.github/workflows/reusable_fetch_version.yaml",
        "purl": "",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "unknown",
        "licenses": [],
        "location": ".github/workflows/master.yaml",
        "name": "./.github/workflows/reusable_publish_docker.yaml",
        "purl": "",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "unknown",
        "licenses": [],
        "location": ".github/workflows/master.yaml",
        "name": "./.github/workflows/reusable_publish_packages.yaml",
        "purl": "",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "unknown",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "./.github/workflows/reusable_test_packages.yaml",
        "purl": "",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "unknown",
        "licenses": [],
        "location": ".github/workflows/ci.yml",
        "name": "./.github/workflows/reusable_test_packages_with_evtgen.yaml",
        "purl": "",
        "version": "UNKNOWN"
      }
    ],
    "description": "Detect runtime threats in cloud-native environments",
    "errors": [],
    "id": "falcosecurity__falco",
    "manifests": [
      ".github/workflows/bump-libs.yaml",
      ".github/workflows/ci.yml",
      ".github/workflows/codeql.yaml",
      ".github/workflows/codespell.yml",
      ".github/workflows/engine-version-weakcheck.yaml",
      ".github/workflows/format.yaml",
      ".github/workflows/helm-check.yaml",
      ".github/workflows/image-trust.yaml",
      ".github/workflows/insecure-api.yaml",
      ".github/workflows/master.yaml",
      ".github/workflows/release.yaml",
      ".github/workflows/reusable_build_dev.yaml",
      ".github/workflows/reusable_build_docker.yaml",
      ".github/workflows/reusable_build_packages.yaml",
      ".github/workflows/reusable_fetch_version.yaml",
      ".github/workflows/reusable_publish_docker.yaml",
      ".github/workflows/reusable_publish_packages.yaml",
      ".github/workflows/reusable_test_packages.yaml",
      ".github/workflows/reusable_test_packages_with_evtgen.yaml",
      ".github/workflows/scorecard.yaml",
      ".github/workflows/staticanalysis.yaml"
    ],
    "name": "falco",
    "osv": {
      "advisories": 0,
      "available": true,
      "confirmed": 0,
      "osv_only": [],
      "warning": null
    },
    "ref": "0.45.2",
    "ref_kind": "release",
    "release_integrity": {
      "asset": "falco-x86_64.debug",
      "assets": 2,
      "build_provenance": null,
      "checksums_published": false,
      "digest_matches_github": true,
      "immutable_release": null,
      "methods": [],
      "provenance_published": false,
      "sbom_published": false,
      "signature": null,
      "signatures_published": false,
      "signer": null,
      "verdict": "none"
    },
    "released_at": "2026-10-29T16:48:27Z",
    "repository": "falcosecurity/falco",
    "sbomlyze_diff": {
      "added": 0,
      "changed": 0,
      "drift": {},
      "findings": [
        "Attack surface: -2 packages (-2.0%)",
        "0 version changes among 98 shared packages \u2014 no actual upgrades",
        "Core system packages stable: library (20) unchanged"
      ],
      "html": "sbomlyze-diff.html",
      "removed": 2
    },
    "scanned_at": "2026-11-02T03:06:43+00:00",
    "scorecard": {
      "checks": [
        {
          "name": "Fuzzing",
          "reason": "project is not fuzzed",
          "score": 0
        },
        {
          "name": "Signed-Releases",
          "reason": "Project has not signed or included provenance with any releases.",
          "score": 0
        },
        {
          "name": "Vulnerabilities",
          "reason": "14 existing vulnerabilities detected",
          "score": 0
        },
        {
          "name": "CII-Best-Practices",
          "reason": "badge detected: Passing",
          "score": 5
        },
        {
          "name": "Pinned-Dependencies",
          "reason": "dependency not pinned by hash detected -- score normalized to 7",
          "score": 7
        },
        {
          "name": "SAST",
          "reason": "SAST tool detected but not run on all commits",
          "score": 9
        },
        {
          "name": "Binary-Artifacts",
          "reason": "no binaries found in the repo",
          "score": 10
        },
        {
          "name": "CI-Tests",
          "reason": "20 out of 20 merged PRs checked by a CI test -- score normalized to 10",
          "score": 10
        },
        {
          "name": "Code-Review",
          "reason": "all changesets reviewed",
          "score": 10
        },
        {
          "name": "Contributors",
          "reason": "project has 36 contributing companies or organizations",
          "score": 10
        },
        {
          "name": "Dangerous-Workflow",
          "reason": "no dangerous workflow patterns detected",
          "score": 10
        },
        {
          "name": "Dependency-Update-Tool",
          "reason": "update tool detected",
          "score": 10
        },
        {
          "name": "License",
          "reason": "license file detected",
          "score": 10
        },
        {
          "name": "Maintained",
          "reason": "30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10",
          "score": 10
        },
        {
          "name": "Security-Policy",
          "reason": "security policy file detected",
          "score": 10
        },
        {
          "name": "Token-Permissions",
          "reason": "GitHub workflow tokens follow principle of least privilege",
          "score": 10
        },
        {
          "name": "Branch-Protection",
          "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
          "score": -1
        },
        {
          "name": "Packaging",
          "reason": "packaging workflow not detected",
          "score": -1
        }
      ],
      "date": "2026-11-02",
      "score": 7.5,
      "source": "openssf-api",
      "version": "v5.5.0"
    },
    "vulnerabilities": [],
    "workflow_audit": {
      "files": 21,
      "findings": [
        {
          "confidence": "Medium",
          "description": "use of fundamentally insecure workflow trigger",
          "file": ".github/workflows/engine-version-weakcheck.yaml",
          "line": 6,
          "note": "this workflow",
          "rule": "dangerous-triggers",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#dangerous-triggers"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/release.yaml",
          "line": 29,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/release.yaml",
          "line": 175,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/release.yaml",
          "line": 189,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_dev.yaml",
          "line": 62,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_dev.yaml",
          "line": 87,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 44,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 44,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 44,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 44,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 44,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 44,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 44,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 54,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 54,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 54,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 54,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 54,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 54,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 54,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 64,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 64,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 64,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 64,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 64,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 64,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 64,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 64,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 75,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 75,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 75,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 75,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 75,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 75,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_docker.yaml",
          "line": 75,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_packages.yaml",
          "line": 61,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_packages.yaml",
          "line": 85,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/reusable_build_packages.yaml",
          "line": 100,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_packages.yaml",
          "line": 104,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/reusable_build_packages.yaml",
          "line": 173,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_packages.yaml",
          "line": 177,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_packages.yaml",
          "line": 225,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_packages.yaml",
          "line": 274,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_packages.yaml",
          "line": 295,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_packages.yaml",
          "line": 295,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_packages.yaml",
          "line": 327,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_packages.yaml",
          "line": 371,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_build_packages.yaml",
          "line": 405,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 78,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 78,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 78,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 78,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 78,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 78,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 78,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 78,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 89,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 89,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 89,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 96,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 96,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 96,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 103,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 103,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 103,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 110,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 110,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 110,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 117,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 117,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 117,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 117,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 125,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 125,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 125,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 125,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 125,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 125,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 125,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 125,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 132,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 132,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 132,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 132,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 132,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 132,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 132,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_docker.yaml",
          "line": 132,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_packages.yaml",
          "line": 85,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_packages.yaml",
          "line": 89,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_packages.yaml",
          "line": 89,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_packages.yaml",
          "line": 89,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_packages.yaml",
          "line": 93,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_packages.yaml",
          "line": 93,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_packages.yaml",
          "line": 93,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_packages.yaml",
          "line": 93,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_packages.yaml",
          "line": 98,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_packages.yaml",
          "line": 98,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_packages.yaml",
          "line": 139,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_packages.yaml",
          "line": 139,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_publish_packages.yaml",
          "line": 139,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_test_packages.yaml",
          "line": 45,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_test_packages.yaml",
          "line": 45,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "unpinned action reference",
          "file": ".github/workflows/reusable_test_packages.yaml",
          "line": 69,
          "note": "this step",
          "rule": "unpinned-uses",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#unpinned-uses"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_test_packages_with_evtgen.yaml",
          "line": 54,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "code injection via template expansion",
          "file": ".github/workflows/reusable_test_packages_with_evtgen.yaml",
          "line": 54,
          "note": "this step",
          "rule": "template-injection",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "Medium",
          "description": "overly broad permissions",
          "file": ".github/workflows/helm-check.yaml",
          "line": 26,
          "note": "this job",
          "rule": "excessive-permissions",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "High",
          "description": "secrets unconditionally inherited by called workflow",
          "file": ".github/workflows/master.yaml",
          "line": 20,
          "note": "this reusable workflow",
          "rule": "secrets-inherit",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#secrets-inherit"
        },
        {
          "confidence": "High",
          "description": "secrets unconditionally inherited by called workflow",
          "file": ".github/workflows/master.yaml",
          "line": 28,
          "note": "this reusable workflow",
          "rule": "secrets-inherit",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#secrets-inherit"
        },
        {
          "confidence": "High",
          "description": "secrets unconditionally inherited by called workflow",
          "file": ".github/workflows/master.yaml",
          "line": 77,
          "note": "this reusable workflow",
          "rule": "secrets-inherit",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#secrets-inherit"
        },
        {
          "confidence": "High",
          "description": "secrets unconditionally inherited by called workflow",
          "file": ".github/workflows/master.yaml",
          "line": 85,
          "note": "this reusable workflow",
          "rule": "secrets-inherit",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#secrets-inherit"
        },
        {
          "confidence": "High",
          "description": "secrets unconditionally inherited by called workflow",
          "file": ".github/workflows/master.yaml",
          "line": 95,
          "note": "this reusable workflow",
          "rule": "secrets-inherit",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#secrets-inherit"
        },
        {
          "confidence": "High",
          "description": "secrets unconditionally inherited by called workflow",
          "file": ".github/workflows/master.yaml",
          "line": 109,
          "note": "this reusable workflow",
          "rule": "secrets-inherit",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#secrets-inherit"
        },
        {
          "confidence": "High",
          "description": "secrets unconditionally inherited by called workflow",
          "file": ".github/workflows/release.yaml",
          "line": 58,
          "note": "this reusable workflow",
          "rule": "secrets-inherit",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#secrets-inherit"
        },
        {
          "confidence": "High",
          "description": "secrets unconditionally inherited by called workflow",
          "file": ".github/workflows/release.yaml",
          "line": 67,
          "note": "this reusable workflow",
          "rule": "secrets-inherit",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#secrets-inherit"
        },
        {
          "confidence": "High",
          "description": "secrets unconditionally inherited by called workflow",
          "file": ".github/workflows/release.yaml",
          "line": 116,
          "note": "this reusable workflow",
          "rule": "secrets-inherit",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#secrets-inherit"
        },
        {
          "confidence": "High",
          "description": "secrets unconditionally inherited by called workflow",
          "file": ".github/workflows/release.yaml",
          "line": 125,
          "note": "this reusable workflow",
          "rule": "secrets-inherit",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#secrets-inherit"
        },
        {
          "confidence": "High",
          "description": "secrets unconditionally inherited by called workflow",
          "file": ".github/workflows/release.yaml",
          "line": 135,
          "note": "this reusable workflow",
          "rule": "secrets-inherit",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#secrets-inherit"
        },
        {
          "confidence": "High",
          "description": "secrets unconditionally inherited by called workflow",
          "file": ".github/workflows/release.yaml",
          "line": 149,
          "note": "this reusable workflow",
          "rule": "secrets-inherit",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#secrets-inherit"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/ci.yml",
          "line": 19,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/ci.yml",
          "line": 22,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/ci.yml",
          "line": 32,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/ci.yml",
          "line": 41,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/ci.yml",
          "line": 59,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/ci.yml",
          "line": 66,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/ci.yml",
          "line": 73,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/ci.yml",
          "line": 80,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/ci.yml",
          "line": 88,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/ci.yml",
          "line": 102,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/image-trust.yaml",
          "line": 23,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/master.yaml",
          "line": 15,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/master.yaml",
          "line": 18,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/master.yaml",
          "line": 26,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/master.yaml",
          "line": 34,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/master.yaml",
          "line": 50,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/master.yaml",
          "line": 57,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/master.yaml",
          "line": 64,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/master.yaml",
          "line": 71,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/master.yaml",
          "line": 83,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/master.yaml",
          "line": 93,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/master.yaml",
          "line": 103,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/release.yaml",
          "line": 56,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/release.yaml",
          "line": 65,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/release.yaml",
          "line": 74,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/release.yaml",
          "line": 90,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/release.yaml",
          "line": 97,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/release.yaml",
          "line": 104,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/release.yaml",
          "line": 111,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/release.yaml",
          "line": 123,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/release.yaml",
          "line": 133,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/release.yaml",
          "line": 143,
          "note": "this job",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/reusable_test_packages_with_evtgen.yaml",
          "line": 66,
          "note": "this step",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/reusable_test_packages_with_evtgen.yaml",
          "line": 71,
          "note": "this step",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "action functionality is already included by the runner",
          "file": ".github/workflows/release.yaml",
          "line": 210,
          "note": "this step",
          "rule": "superfluous-actions",
          "severity": "Informational",
          "url": "https://docs.zizmor.sh/audits/#superfluous-actions"
        }
      ]
    }
  },
  "updated": "2026-11-02"
}