You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by as...@apache.org on 2026/04/20 20:25:07 UTC
(tooling-agents) branch main updated: CI scan: security analysis (apache)
This is an automated email from the ASF dual-hosted git repository.
asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git
The following commit(s) were added to refs/heads/main by this push:
new 0e98f21 CI scan: security analysis (apache)
0e98f21 is described below
commit 0e98f210f800ae6092492a8d487c1d4c9bf13ec7
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Mon Apr 20 22:25:01 2026 +0200
CI scan: security analysis (apache)
---
repos/apache/github-review/reports/security.md | 9534 ++++++++++++++++++++++++
1 file changed, 9534 insertions(+)
diff --git a/repos/apache/github-review/reports/security.md b/repos/apache/github-review/reports/security.md
new file mode 100644
index 0000000..20ad2ac
--- /dev/null
+++ b/repos/apache/github-review/reports/security.md
@@ -0,0 +1,9534 @@
+# CI Security Scan: apache
+
+## Contents
+
+- [Executive Summary](#executive-summary)
+- [Findings by Check Type](#findings-by-check-type)
+- [HIGH Findings](#high-findings) (194)
+- [MEDIUM Findings](#medium-findings) (322)
+- [LOW Findings](#low-findings) (1437)
+- [INFO Findings](#info-findings) (875)
+- [Detailed Results](#detailed-results-by-repository)
+ - [apache/accumulo](#apacheaccumulo)
+ - [apache/accumulo-access](#apacheaccumulo-access)
+ - [apache/accumulo-classloaders](#apacheaccumulo-classloaders)
+ - [apache/accumulo-examples](#apacheaccumulo-examples)
+ - [apache/accumulo-fluo](#apacheaccumulo-fluo)
+ - [apache/accumulo-fluo-bytes](#apacheaccumulo-fluo-bytes)
+ - [apache/accumulo-fluo-examples](#apacheaccumulo-fluo-examples)
+ - [apache/accumulo-fluo-muchos](#apacheaccumulo-fluo-muchos)
+ - [apache/accumulo-fluo-recipes](#apacheaccumulo-fluo-recipes)
+ - [apache/accumulo-fluo-uno](#apacheaccumulo-fluo-uno)
+ - [apache/accumulo-fluo-website](#apacheaccumulo-fluo-website)
+ - [apache/accumulo-fluo-yarn](#apacheaccumulo-fluo-yarn)
+ - [apache/accumulo-instamo-archetype](#apacheaccumulo-instamo-archetype)
+ - [apache/accumulo-maven-plugin](#apacheaccumulo-maven-plugin)
+ - [apache/accumulo-proxy](#apacheaccumulo-proxy)
+ - [apache/accumulo-testing](#apacheaccumulo-testing)
+ - [apache/accumulo-website](#apacheaccumulo-website)
+ - [apache/accumulo-wikisearch](#apacheaccumulo-wikisearch)
+ - [apache/activemq](#apacheactivemq)
+ - [apache/activemq-nms-amqp](#apacheactivemq-nms-amqp)
+ - [apache/activemq-nms-openwire](#apacheactivemq-nms-openwire)
+ - [apache/age](#apacheage)
+ - [apache/age-viewer](#apacheage-viewer)
+ - [apache/age-website](#apacheage-website)
+ - [apache/airavata](#apacheairavata)
+ - [apache/airavata-django-portal](#apacheairavata-django-portal)
+ - [apache/airavata-mft](#apacheairavata-mft)
+ - [apache/airflow](#apacheairflow)
+ - [apache/airflow-client-go](#apacheairflow-client-go)
+ - [apache/airflow-client-python](#apacheairflow-client-python)
+ - [apache/airflow-publish](#apacheairflow-publish)
+ - [apache/airflow-site](#apacheairflow-site)
+ - [apache/airflow-site-archive](#apacheairflow-site-archive)
+ - [apache/allura](#apacheallura)
+ - [apache/ambari-metrics](#apacheambari-metrics)
+ - [apache/ambari-website](#apacheambari-website)
+ - [apache/amoro](#apacheamoro)
+ - [apache/amoro-shade](#apacheamoro-shade)
+ - [apache/answer](#apacheanswer)
+ - [apache/answer-plugins](#apacheanswer-plugins)
+ - [apache/answer-website](#apacheanswer-website)
+ - [apache/apachecon-acasia](#apacheapachecon-acasia)
+ - [apache/apachecon-eu](#apacheapachecon-eu)
+ - [apache/apisix](#apacheapisix)
+ - [apache/apisix-control-plane](#apacheapisix-control-plane)
+ - [apache/apisix-dashboard](#apacheapisix-dashboard)
+ - [apache/apisix-docker](#apacheapisix-docker)
+ - [apache/apisix-go-plugin-runner](#apacheapisix-go-plugin-runner)
+ - [apache/apisix-helm-chart](#apacheapisix-helm-chart)
+ - [apache/apisix-ingress-controller](#apacheapisix-ingress-controller)
+ - [apache/apisix-java-plugin-runner](#apacheapisix-java-plugin-runner)
+ - [apache/apisix-python-plugin-runner](#apacheapisix-python-plugin-runner)
+ - [apache/apisix-website](#apacheapisix-website)
+ - [apache/apr](#apacheapr)
+ - [apache/apr-util](#apacheapr-util)
+ - [apache/aries](#apachearies)
+ - [apache/aries-cdi](#apachearies-cdi)
+ - [apache/aries-component-dsl](#apachearies-component-dsl)
+ - [apache/aries-jax-rs-whiteboard](#apachearies-jax-rs-whiteboard)
+ - [apache/aries-jpa](#apachearies-jpa)
+ - [apache/aries-rsa](#apachearies-rsa)
+ - [apache/arrow](#apachearrow)
+ - [apache/arrow-adbc](#apachearrow-adbc)
+ - [apache/arrow-cookbook](#apachearrow-cookbook)
+ - [apache/arrow-dotnet](#apachearrow-dotnet)
+ - [apache/arrow-flight-sql-postgresql](#apachearrow-flight-sql-postgresql)
+ - [apache/arrow-go](#apachearrow-go)
+ - [apache/arrow-java](#apachearrow-java)
+ - [apache/arrow-js](#apachearrow-js)
+ - [apache/arrow-julia](#apachearrow-julia)
+ - [apache/arrow-nanoarrow](#apachearrow-nanoarrow)
+ - [apache/arrow-rs](#apachearrow-rs)
+ - [apache/arrow-rs-object-store](#apachearrow-rs-object-store)
+ - [apache/arrow-site](#apachearrow-site)
+ - [apache/arrow-swift](#apachearrow-swift)
+ - [apache/artemis](#apacheartemis)
+ - [apache/artemis-console](#apacheartemis-console)
+ - [apache/artemis-examples](#apacheartemis-examples)
+ - [apache/artemis-native](#apacheartemis-native)
+ - [apache/atlas](#apacheatlas)
+ - [apache/attic](#apacheattic)
+ - [apache/auron](#apacheauron)
+ - [apache/auron-sites](#apacheauron-sites)
+ - [apache/avro](#apacheavro)
+ - [apache/avro-rs](#apacheavro-rs)
+ - [apache/axis-axis1-java](#apacheaxis-axis1-java)
+ - [apache/axis-axis2-c-core](#apacheaxis-axis2-c-core)
+ - [apache/axis-axis2-java-core](#apacheaxis-axis2-java-core)
+ - [apache/axis-axis2-java-rampart](#apacheaxis-axis2-java-rampart)
+ - [apache/beam](#apachebeam)
+ - [apache/beam-starter-go](#apachebeam-starter-go)
+ - [apache/beam-starter-java](#apachebeam-starter-java)
+ - [apache/beam-starter-java-provider](#apachebeam-starter-java-provider)
+ - [apache/beam-starter-kotlin](#apachebeam-starter-kotlin)
+ - [apache/beam-starter-python](#apachebeam-starter-python)
+ - [apache/beam-starter-typescript](#apachebeam-starter-typescript)
+ - [apache/bifromq](#apachebifromq)
+ - [apache/bifromq-sites](#apachebifromq-sites)
+ - [apache/bigtop-manager](#apachebigtop-manager)
+ - [apache/bookkeeper](#apachebookkeeper)
+ - [apache/brpc](#apachebrpc)
+ - [apache/brpc-website](#apachebrpc-website)
+ - [apache/buildstream](#apachebuildstream)
+ - [apache/buildstream-plugins](#apachebuildstream-plugins)
+ - [apache/burr](#apacheburr)
+ - [apache/bval](#apachebval)
+ - [apache/calcite](#apachecalcite)
+ - [apache/calcite-avatica](#apachecalcite-avatica)
+ - [apache/calcite-avatica-go](#apachecalcite-avatica-go)
+ - [apache/camel](#apachecamel)
+ - [apache/camel-examples](#apachecamel-examples)
+ - [apache/camel-jbang-examples](#apachecamel-jbang-examples)
+ - [apache/camel-k](#apachecamel-k)
+ - [apache/camel-k-runtime](#apachecamel-k-runtime)
+ - [apache/camel-kafka-connector](#apachecamel-kafka-connector)
+ - [apache/camel-kameleon](#apachecamel-kameleon)
+ - [apache/camel-kamelets](#apachecamel-kamelets)
+ - [apache/camel-karaf](#apachecamel-karaf)
+ - [apache/camel-karavan](#apachecamel-karavan)
+ - [apache/camel-performance-tests](#apachecamel-performance-tests)
+ - [apache/camel-quarkus](#apachecamel-quarkus)
+ - [apache/camel-quarkus-examples](#apachecamel-quarkus-examples)
+ - [apache/camel-spring-boot](#apachecamel-spring-boot)
+ - [apache/camel-spring-boot-examples](#apachecamel-spring-boot-examples)
+ - [apache/camel-upgrade-recipes](#apachecamel-upgrade-recipes)
+ - [apache/camel-website](#apachecamel-website)
+ - [apache/carbondata](#apachecarbondata)
+ - [apache/casbin](#apachecasbin)
+ - [apache/casbin-3rd-party-casbin-pg-adapter](#apachecasbin-3rd-party-casbin-pg-adapter)
+ - [apache/casbin-Casbin.NET](#apachecasbin-casbinnet)
+ - [apache/casbin-Casbin.NET-dotnet-cli](#apachecasbin-casbinnet-dotnet-cli)
+ - [apache/casbin-Casbin.NET-ef-adapter](#apachecasbin-casbinnet-ef-adapter)
+ - [apache/casbin-Casbin.NET-redis-adapter](#apachecasbin-casbinnet-redis-adapter)
+ - [apache/casbin-Casbin.NET-redis-watcher](#apachecasbin-casbinnet-redis-watcher)
+ - [apache/casbin-SwiftCasbin](#apachecasbin-swiftcasbin)
+ - [apache/casbin-actix-casbin-auth](#apachecasbin-actix-casbin-auth)
+ - [apache/casbin-admission-webhook](#apachecasbin-admission-webhook)
+ - [apache/casbin-aspnetcore](#apachecasbin-aspnetcore)
+ - [apache/casbin-axum-casbin](#apachecasbin-axum-casbin)
+ - [apache/casbin-beego-orm-adapter](#apachecasbin-beego-orm-adapter)
+ - [apache/casbin-casbin.js](#apachecasbin-casbinjs)
+ - [apache/casbin-confita](#apachecasbin-confita)
+ - [apache/casbin-core](#apachecasbin-core)
+ - [apache/casbin-cpp](#apachecasbin-cpp)
+ - [apache/casbin-cpp-Cvaluate](#apachecasbin-cpp-cvaluate)
+ - [apache/casbin-cpp-casbin-CMake-setup](#apachecasbin-cpp-casbin-cmake-setup)
+ - [apache/casbin-cpp-sqlpp11-adapter](#apachecasbin-cpp-sqlpp11-adapter)
+ - [apache/casbin-crd-adapter](#apachecasbin-crd-adapter)
+ - [apache/casbin-dart-casbin](#apachecasbin-dart-casbin)
+ - [apache/casbin-docker-plugin](#apachecasbin-docker-plugin)
+ - [apache/casbin-docker_auth](#apachecasbin-docker_auth)
+ - [apache/casbin-editor](#apachecasbin-editor)
+ - [apache/casbin-efcore-adapter](#apachecasbin-efcore-adapter)
+ - [apache/casbin-ent-adapter](#apachecasbin-ent-adapter)
+ - [apache/casbin-etcd-watcher](#apachecasbin-etcd-watcher)
+ - [apache/casbin-ex](#apachecasbin-ex)
+ - [apache/casbin-express-authz](#apachecasbin-express-authz)
+ - [apache/casbin-fasthttp-auth](#apachecasbin-fasthttp-auth)
+ - [apache/casbin-gateway](#apachecasbin-gateway)
+ - [apache/casbin-go-cli](#apachecasbin-go-cli)
+ - [apache/casbin-go-client](#apachecasbin-go-client)
+ - [apache/casbin-gorm-adapter](#apachecasbin-gorm-adapter)
+ - [apache/casbin-gorm-adapter-ex](#apachecasbin-gorm-adapter-ex)
+ - [apache/casbin-govaluate](#apachecasbin-govaluate)
+ - [apache/casbin-hraft-dispatcher](#apachecasbin-hraft-dispatcher)
+ - [apache/casbin-informer-watcher](#apachecasbin-informer-watcher)
+ - [apache/casbin-jcasbin](#apachecasbin-jcasbin)
+ - [apache/casbin-jcasbin-dynamodb-adapter](#apachecasbin-jcasbin-dynamodb-adapter)
+ - [apache/casbin-jcasbin-hibernate-adapter](#apachecasbin-jcasbin-hibernate-adapter)
+ - [apache/casbin-jcasbin-java-cli](#apachecasbin-jcasbin-java-cli)
+ - [apache/casbin-jcasbin-jdbc-adapter](#apachecasbin-jcasbin-jdbc-adapter)
+ - [apache/casbin-jcasbin-jfinal-authz](#apachecasbin-jcasbin-jfinal-authz)
+ - [apache/casbin-jcasbin-kafka-casbin](#apachecasbin-jcasbin-kafka-casbin)
+ - [apache/casbin-jcasbin-kafka-watcher](#apachecasbin-jcasbin-kafka-watcher)
+ - [apache/casbin-jcasbin-lettuce-redis-watcher](#apachecasbin-jcasbin-lettuce-redis-watcher)
+ - [apache/casbin-jcasbin-menu-permission](#apachecasbin-jcasbin-menu-permission)
+ - [apache/casbin-jcasbin-mongo-adapter](#apachecasbin-jcasbin-mongo-adapter)
+ - [apache/casbin-jcasbin-mybatis-adapter](#apachecasbin-jcasbin-mybatis-adapter)
+ - [apache/casbin-jcasbin-mybatisplus-adapter](#apachecasbin-jcasbin-mybatisplus-adapter)
+ - [apache/casbin-jcasbin-nutz-authz](#apachecasbin-jcasbin-nutz-authz)
+ - [apache/casbin-jcasbin-play-authz](#apachecasbin-jcasbin-play-authz)
+ - [apache/casbin-jcasbin-postgres-watcher](#apachecasbin-jcasbin-postgres-watcher)
+ - [apache/casbin-jcasbin-pulsar-authz](#apachecasbin-jcasbin-pulsar-authz)
+ - [apache/casbin-jcasbin-rabbitmq-watcher](#apachecasbin-jcasbin-rabbitmq-watcher)
+ - [apache/casbin-jcasbin-redis-adapter](#apachecasbin-jcasbin-redis-adapter)
+ - [apache/casbin-jcasbin-redis-watcher](#apachecasbin-jcasbin-redis-watcher)
+ - [apache/casbin-jcasbin-redis-watcher-ex](#apachecasbin-jcasbin-redis-watcher-ex)
+ - [apache/casbin-jcasbin-shiro-casbin](#apachecasbin-jcasbin-shiro-casbin)
+ - [apache/casbin-jcasbin-spring-security-starter](#apachecasbin-jcasbin-spring-security-starter)
+ - [apache/casbin-jcasbin-string-adapter](#apachecasbin-jcasbin-string-adapter)
+ - [apache/casbin-jcasbin-vertx-authz](#apachecasbin-jcasbin-vertx-authz)
+ - [apache/casbin-jcasbin-zookeeper-watcher](#apachecasbin-jcasbin-zookeeper-watcher)
+ - [apache/casbin-js-vue-authz](#apachecasbin-js-vue-authz)
+ - [apache/casbin-json-adapter](#apachecasbin-json-adapter)
+ - [apache/casbin-k8s-gatekeeper](#apachecasbin-k8s-gatekeeper)
+ - [apache/casbin-kubesphere-authz](#apachecasbin-kubesphere-authz)
+ - [apache/casbin-laravel-rbac](#apachecasbin-laravel-rbac)
+ - [apache/casbin-ldap-role-manager](#apachecasbin-ldap-role-manager)
+ - [apache/casbin-lego](#apachecasbin-lego)
+ - [apache/casbin-lua-4daysorm-adapter](#apachecasbin-lua-4daysorm-adapter)
+ - [apache/casbin-lua-apisix-authz](#apachecasbin-lua-apisix-authz)
+ - [apache/casbin-lua-casbin](#apachecasbin-lua-casbin)
+ - [apache/casbin-lua-kong-authz](#apachecasbin-lua-kong-authz)
+ - [apache/casbin-lua-luasql-adapter](#apachecasbin-lua-luasql-adapter)
+ - [apache/casbin-mcp-gateway](#apachecasbin-mcp-gateway)
+ - [apache/casbin-mesh](#apachecasbin-mesh)
+ - [apache/casbin-mongodb-adapter](#apachecasbin-mongodb-adapter)
+ - [apache/casbin-nest-authz](#apachecasbin-nest-authz)
+ - [apache/casbin-node-casbin](#apachecasbin-node-casbin)
+ - [apache/casbin-node-casbin-basic-adapter](#apachecasbin-node-casbin-basic-adapter)
+ - [apache/casbin-node-casbin-couchdb-adapter](#apachecasbin-node-casbin-couchdb-adapter)
+ - [apache/casbin-node-casbin-drizzle-adapter](#apachecasbin-node-casbin-drizzle-adapter)
+ - [apache/casbin-node-casbin-etcd-watcher](#apachecasbin-node-casbin-etcd-watcher)
+ - [apache/casbin-node-casbin-examples](#apachecasbin-node-casbin-examples)
+ - [apache/casbin-node-casbin-expression-eval](#apachecasbin-node-casbin-expression-eval)
+ - [apache/casbin-node-casbin-file-adapter](#apachecasbin-node-casbin-file-adapter)
+ - [apache/casbin-node-casbin-graphql-authz](#apachecasbin-node-casbin-graphql-authz)
+ - [apache/casbin-node-casbin-mongo-changestream-watcher](#apachecasbin-node-casbin-mongo-changestream-watcher)
+ - [apache/casbin-node-casbin-mongoose-adapter](#apachecasbin-node-casbin-mongoose-adapter)
+ - [apache/casbin-node-casbin-node-pubsub-watcher](#apachecasbin-node-casbin-node-pubsub-watcher)
+ - [apache/casbin-node-casbin-node-redis-adapter](#apachecasbin-node-casbin-node-redis-adapter)
+ - [apache/casbin-node-casbin-prisma-adapter](#apachecasbin-node-casbin-prisma-adapter)
+ - [apache/casbin-node-casbin-redis-watcher](#apachecasbin-node-casbin-redis-watcher)
+ - [apache/casbin-node-casbin-session-role-manager](#apachecasbin-node-casbin-session-role-manager)
+ - [apache/casbin-okta-role-manager](#apachecasbin-okta-role-manager)
+ - [apache/casbin-opentelemetry-logger](#apachecasbin-opentelemetry-logger)
+ - [apache/casbin-pg-adapter](#apachecasbin-pg-adapter)
+ - [apache/casbin-policyguard](#apachecasbin-policyguard)
+ - [apache/casbin-prometheus-logger](#apachecasbin-prometheus-logger)
+ - [apache/casbin-pycasbin](#apachecasbin-pycasbin)
+ - [apache/casbin-python-async-django-orm-adapter](#apachecasbin-python-async-django-orm-adapter)
+ - [apache/casbin-python-async-postgres-watcher](#apachecasbin-python-async-postgres-watcher)
+ - [apache/casbin-python-async-sqlalchemy-adapter](#apachecasbin-python-async-sqlalchemy-adapter)
+ - [apache/casbin-python-casbin-databases-adapter](#apachecasbin-python-casbin-databases-adapter)
+ - [apache/casbin-python-cli](#apachecasbin-python-cli)
+ - [apache/casbin-python-django-casbin](#apachecasbin-python-django-casbin)
+ - [apache/casbin-python-django-casbin-auth](#apachecasbin-python-django-casbin-auth)
+ - [apache/casbin-python-django-orm-adapter](#apachecasbin-python-django-orm-adapter)
+ - [apache/casbin-python-etcd-watcher](#apachecasbin-python-etcd-watcher)
+ - [apache/casbin-python-fastapi-casbin-auth](#apachecasbin-python-fastapi-casbin-auth)
+ - [apache/casbin-python-flask-authz](#apachecasbin-python-flask-authz)
+ - [apache/casbin-python-graphql-authz](#apachecasbin-python-graphql-authz)
+ - [apache/casbin-python-postgresql-watcher](#apachecasbin-python-postgresql-watcher)
+ - [apache/casbin-python-pymongo-adapter](#apachecasbin-python-pymongo-adapter)
+ - [apache/casbin-python-rabbitmq-watcher](#apachecasbin-python-rabbitmq-watcher)
+ - [apache/casbin-python-redis-adapter](#apachecasbin-python-redis-adapter)
+ - [apache/casbin-python-redis-watcher](#apachecasbin-python-redis-watcher)
+ - [apache/casbin-python-sanic-authz](#apachecasbin-python-sanic-authz)
+ - [apache/casbin-python-sqlalchemy-adapter](#apachecasbin-python-sqlalchemy-adapter)
+ - [apache/casbin-python-sqlobject-adapter](#apachecasbin-python-sqlobject-adapter)
+ - [apache/casbin-raft](#apachecasbin-raft)
+ - [apache/casbin-redis-adapter](#apachecasbin-redis-adapter)
+ - [apache/casbin-redis-watcher](#apachecasbin-redis-watcher)
+ - [apache/casbin-rs](#apachecasbin-rs)
+ - [apache/casbin-rust-actix-casbin](#apachecasbin-rust-actix-casbin)
+ - [apache/casbin-rust-actix-file-adapter-rbac](#apachecasbin-rust-actix-file-adapter-rbac)
+ - [apache/casbin-rust-actix-middleware-example](#apachecasbin-rust-actix-middleware-example)
+ - [apache/casbin-rust-actix-postgresql-simple](#apachecasbin-rust-actix-postgresql-simple)
+ - [apache/casbin-rust-axum-middleware-example](#apachecasbin-rust-axum-middleware-example)
+ - [apache/casbin-rust-casbin-grpc](#apachecasbin-rust-casbin-grpc)
+ - [apache/casbin-rust-casbin-rust-cli](#apachecasbin-rust-casbin-rust-cli)
+ - [apache/casbin-rust-diesel-adapter](#apachecasbin-rust-diesel-adapter)
+ - [apache/casbin-rust-dufs-with-casbin](#apachecasbin-rust-dufs-with-casbin)
+ - [apache/casbin-rust-json-adapter](#apachecasbin-rust-json-adapter)
+ - [apache/casbin-rust-ntex-file-adapter-acl](#apachecasbin-rust-ntex-file-adapter-acl)
+ - [apache/casbin-rust-poem-casbin](#apachecasbin-rust-poem-casbin)
+ - [apache/casbin-rust-poem-todo](#apachecasbin-rust-poem-todo)
+ - [apache/casbin-rust-postgres-adapter](#apachecasbin-rust-postgres-adapter)
+ - [apache/casbin-rust-redis-watcher](#apachecasbin-rust-redis-watcher)
+ - [apache/casbin-rust-rocket-authz](#apachecasbin-rust-rocket-authz)
+ - [apache/casbin-rust-salvo-casbin](#apachecasbin-rust-salvo-casbin)
+ - [apache/casbin-rust-semantic-release-action-rust](#apachecasbin-rust-semantic-release-action-rust)
+ - [apache/casbin-rust-string-adapter](#apachecasbin-rust-string-adapter)
+ - [apache/casbin-rust-yaml-adapter](#apachecasbin-rust-yaml-adapter)
+ - [apache/casbin-sequelize-adapter](#apachecasbin-sequelize-adapter)
+ - [apache/casbin-server](#apachecasbin-server)
+ - [apache/casbin-spring-boot-starter](#apachecasbin-spring-boot-starter)
+ - [apache/casbin-sqlx-adapter](#apachecasbin-sqlx-adapter)
+ - [apache/casbin-tikv-watcher](#apachecasbin-tikv-watcher)
+ - [apache/casbin-typeorm-adapter](#apachecasbin-typeorm-adapter)
+ - [apache/casbin-ucon](#apachecasbin-ucon)
+ - [apache/casbin-vscode-plugin](#apachecasbin-vscode-plugin)
+ - [apache/casbin-website](#apachecasbin-website)
+ - [apache/casbin-website-v1-deprecated](#apachecasbin-website-v1-deprecated)
+ - [apache/casbin-website-v3](#apachecasbin-website-v3)
+ - [apache/casbin-xorm-adapter](#apachecasbin-xorm-adapter)
+ - [apache/casbin-zap-logger](#apachecasbin-zap-logger)
+ - [apache/cassandra](#apachecassandra)
+ - [apache/cassandra-analytics](#apachecassandra-analytics)
+ - [apache/cassandra-builds](#apachecassandra-builds)
+ - [apache/cassandra-ccm](#apachecassandra-ccm)
+ - [apache/cassandra-diff](#apachecassandra-diff)
+ - [apache/cassandra-easy-stress](#apachecassandra-easy-stress)
+ - [apache/cassandra-gocql-driver](#apachecassandra-gocql-driver)
+ - [apache/cassandra-sidecar](#apachecassandra-sidecar)
+ - [apache/cassandra-spark-connector](#apachecassandra-spark-connector)
+ - [apache/cassandra-website](#apachecassandra-website)
+ - [apache/causeway](#apachecauseway)
+ - [apache/cayenne](#apachecayenne)
+ - [apache/celeborn](#apacheceleborn)
+ - [apache/celeborn-website](#apacheceleborn-website)
+ - [apache/celix](#apachecelix)
+ - [apache/cloudberry](#apachecloudberry)
+ - [apache/cloudberry-backup](#apachecloudberry-backup)
+ - [apache/cloudberry-go-libs](#apachecloudberry-go-libs)
+ - [apache/cloudberry-pxf](#apachecloudberry-pxf)
+ - [apache/cloudberry-site](#apachecloudberry-site)
+ - [apache/cloudstack](#apachecloudstack)
+ - [apache/cloudstack-cloudmonkey](#apachecloudstack-cloudmonkey)
+ - [apache/cloudstack-csbench](#apachecloudstack-csbench)
+ - [apache/cloudstack-documentation](#apachecloudstack-documentation)
+ - [apache/cloudstack-go](#apachecloudstack-go)
+ - [apache/cloudstack-kubernetes-provider](#apachecloudstack-kubernetes-provider)
+ - [apache/cloudstack-terraform-provider](#apachecloudstack-terraform-provider)
+ - [apache/cloudstack-www](#apachecloudstack-www)
+ - [apache/comdev-events-site](#apachecomdev-events-site)
+ - [apache/commons-bcel](#apachecommons-bcel)
+ - [apache/commons-beanutils](#apachecommons-beanutils)
+ - [apache/commons-bsf](#apachecommons-bsf)
+ - [apache/commons-build-plugin](#apachecommons-build-plugin)
+ - [apache/commons-chain](#apachecommons-chain)
+ - [apache/commons-cli](#apachecommons-cli)
+ - [apache/commons-codec](#apachecommons-codec)
+ - [apache/commons-collections](#apachecommons-collections)
+ - [apache/commons-compress](#apachecommons-compress)
+ - [apache/commons-configuration](#apachecommons-configuration)
+ - [apache/commons-crypto](#apachecommons-crypto)
+ - [apache/commons-csv](#apachecommons-csv)
+ - [apache/commons-daemon](#apachecommons-daemon)
+ - [apache/commons-dbcp](#apachecommons-dbcp)
+ - [apache/commons-dbutils](#apachecommons-dbutils)
+ - [apache/commons-digester](#apachecommons-digester)
+ - [apache/commons-email](#apachecommons-email)
+ - [apache/commons-exec](#apachecommons-exec)
+ - [apache/commons-fileupload](#apachecommons-fileupload)
+ - [apache/commons-geometry](#apachecommons-geometry)
+ - [apache/commons-graph](#apachecommons-graph)
+ - [apache/commons-imaging](#apachecommons-imaging)
+ - [apache/commons-io](#apachecommons-io)
+ - [apache/commons-jci](#apachecommons-jci)
+ - [apache/commons-jcs](#apachecommons-jcs)
+ - [apache/commons-jelly](#apachecommons-jelly)
+ - [apache/commons-jexl](#apachecommons-jexl)
+ - [apache/commons-jxpath](#apachecommons-jxpath)
+ - [apache/commons-lang](#apachecommons-lang)
+ - [apache/commons-logging](#apachecommons-logging)
+ - [apache/commons-math](#apachecommons-math)
+ - [apache/commons-net](#apachecommons-net)
+ - [apache/commons-numbers](#apachecommons-numbers)
+ - [apache/commons-ognl](#apachecommons-ognl)
+ - [apache/commons-parent](#apachecommons-parent)
+ - [apache/commons-pool](#apachecommons-pool)
+ - [apache/commons-rdf](#apachecommons-rdf)
+ - [apache/commons-release-plugin](#apachecommons-release-plugin)
+ - [apache/commons-rng](#apachecommons-rng)
+ - [apache/commons-scxml](#apachecommons-scxml)
+ - [apache/commons-skin](#apachecommons-skin)
+ - [apache/commons-statistics](#apachecommons-statistics)
+ - [apache/commons-text](#apachecommons-text)
+ - [apache/commons-validator](#apachecommons-validator)
+ - [apache/commons-vfs](#apachecommons-vfs)
+ - [apache/commons-weaver](#apachecommons-weaver)
+ - [apache/cordova](#apachecordova)
+ - [apache/cordova-android](#apachecordova-android)
+ - [apache/cordova-app-hello-world](#apachecordova-app-hello-world)
+ - [apache/cordova-browser](#apachecordova-browser)
+ - [apache/cordova-cli](#apachecordova-cli)
+ - [apache/cordova-coho](#apachecordova-coho)
+ - [apache/cordova-common](#apachecordova-common)
+ - [apache/cordova-create](#apachecordova-create)
+ - [apache/cordova-docs](#apachecordova-docs)
+ - [apache/cordova-electron](#apachecordova-electron)
+ - [apache/cordova-eslint](#apachecordova-eslint)
+ - [apache/cordova-fetch](#apachecordova-fetch)
+ - [apache/cordova-ios](#apachecordova-ios)
+ - [apache/cordova-js](#apachecordova-js)
+ - [apache/cordova-lib](#apachecordova-lib)
+ - [apache/cordova-mobile-spec](#apachecordova-mobile-spec)
+ - [apache/cordova-node-xcode](#apachecordova-node-xcode)
+ - [apache/cordova-paramedic](#apachecordova-paramedic)
+ - [apache/cordova-plugin-battery-status](#apachecordova-plugin-battery-status)
+ - [apache/cordova-plugin-camera](#apachecordova-plugin-camera)
+ - [apache/cordova-plugin-device](#apachecordova-plugin-device)
+ - [apache/cordova-plugin-device-motion](#apachecordova-plugin-device-motion)
+ - [apache/cordova-plugin-device-orientation](#apachecordova-plugin-device-orientation)
+ - [apache/cordova-plugin-dialogs](#apachecordova-plugin-dialogs)
+ - [apache/cordova-plugin-file](#apachecordova-plugin-file)
+ - [apache/cordova-plugin-file-transfer](#apachecordova-plugin-file-transfer)
+ - [apache/cordova-plugin-geolocation](#apachecordova-plugin-geolocation)
+ - [apache/cordova-plugin-inappbrowser](#apachecordova-plugin-inappbrowser)
+ - [apache/cordova-plugin-media](#apachecordova-plugin-media)
+ - [apache/cordova-plugin-media-capture](#apachecordova-plugin-media-capture)
+ - [apache/cordova-plugin-network-information](#apachecordova-plugin-network-information)
+ - [apache/cordova-plugin-screen-orientation](#apachecordova-plugin-screen-orientation)
+ - [apache/cordova-plugin-splashscreen](#apachecordova-plugin-splashscreen)
+ - [apache/cordova-plugin-statusbar](#apachecordova-plugin-statusbar)
+ - [apache/cordova-plugin-test-framework](#apachecordova-plugin-test-framework)
+ - [apache/cordova-plugin-vibration](#apachecordova-plugin-vibration)
+ - [apache/cordova-plugman](#apachecordova-plugman)
+ - [apache/cordova-serve](#apachecordova-serve)
+ - [apache/couchdb-ci](#apachecouchdb-ci)
+ - [apache/couchdb-erlfdb](#apachecouchdb-erlfdb)
+ - [apache/couchdb-fast-pbkdf2](#apachecouchdb-fast-pbkdf2)
+ - [apache/couchdb-fauxton](#apachecouchdb-fauxton)
+ - [apache/couchdb-helm](#apachecouchdb-helm)
+ - [apache/couchdb-jiffy](#apachecouchdb-jiffy)
+ - [apache/couchdb-meck](#apachecouchdb-meck)
+ - [apache/couchdb-mochiweb](#apachecouchdb-mochiweb)
+ - [apache/couchdb-nano](#apachecouchdb-nano)
+ - [apache/couchdb-recon](#apachecouchdb-recon)
+ - [apache/creadur-rat](#apachecreadur-rat)
+ - [apache/creadur-tentacles](#apachecreadur-tentacles)
+ - [apache/creadur-whisker](#apachecreadur-whisker)
+ - [apache/ctakes-website](#apachectakes-website)
+ - [apache/curator](#apachecurator)
+ - [apache/curator-site](#apachecurator-site)
+ - [apache/cxf](#apachecxf)
+ - [apache/cxf-build-utils](#apachecxf-build-utils)
+ - [apache/cxf-fediz](#apachecxf-fediz)
+ - [apache/cxf-xjc-utils](#apachecxf-xjc-utils)
+ - [apache/daffodil](#apachedaffodil)
+ - [apache/daffodil-infrastructure](#apachedaffodil-infrastructure)
+ - [apache/daffodil-sbt](#apachedaffodil-sbt)
+ - [apache/daffodil-schema.g8](#apachedaffodil-schemag8)
+ - [apache/daffodil-site](#apachedaffodil-site)
+ - [apache/daffodil-vscode](#apachedaffodil-vscode)
+ - [apache/datafu](#apachedatafu)
+ - [apache/datafusion](#apachedatafusion)
+ - [apache/datafusion-ballista](#apachedatafusion-ballista)
+ - [apache/datafusion-ballista-python](#apachedatafusion-ballista-python)
+ - [apache/datafusion-benchmarks](#apachedatafusion-benchmarks)
+ - [apache/datafusion-comet](#apachedatafusion-comet)
+ - [apache/datafusion-python](#apachedatafusion-python)
+ - [apache/datafusion-ray](#apachedatafusion-ray)
+ - [apache/datafusion-sandbox](#apachedatafusion-sandbox)
+ - [apache/datafusion-site](#apachedatafusion-site)
+ - [apache/datafusion-sqlparser-rs](#apachedatafusion-sqlparser-rs)
+ - [apache/datafusion-testing](#apachedatafusion-testing)
+ - [apache/datasketches-cpp](#apachedatasketches-cpp)
+ - [apache/datasketches-go](#apachedatasketches-go)
+ - [apache/datasketches-hive](#apachedatasketches-hive)
+ - [apache/datasketches-java](#apachedatasketches-java)
+ - [apache/datasketches-memory](#apachedatasketches-memory)
+ - [apache/datasketches-memory16](#apachedatasketches-memory16)
+ - [apache/datasketches-memory17](#apachedatasketches-memory17)
+ - [apache/datasketches-pig](#apachedatasketches-pig)
+ - [apache/datasketches-postgresql](#apachedatasketches-postgresql)
+ - [apache/datasketches-python](#apachedatasketches-python)
+ - [apache/datasketches-rust](#apachedatasketches-rust)
+ - [apache/datasketches-spark](#apachedatasketches-spark)
+ - [apache/datasketches-website](#apachedatasketches-website)
+ - [apache/db-jdo](#apachedb-jdo)
+ - [apache/db-jdo-site](#apachedb-jdo-site)
+ - [apache/db-site](#apachedb-site)
+ - [apache/deltaspike](#apachedeltaspike)
+ - [apache/directory-kerby](#apachedirectory-kerby)
+ - [apache/directory-ldap-api](#apachedirectory-ldap-api)
+ - [apache/directory-scimple](#apachedirectory-scimple)
+ - [apache/directory-server](#apachedirectory-server)
+ - [apache/directory-studio](#apachedirectory-studio)
+ - [apache/dolphinscheduler](#apachedolphinscheduler)
+ - [apache/dolphinscheduler-operator](#apachedolphinscheduler-operator)
+ - [apache/dolphinscheduler-sdk-python](#apachedolphinscheduler-sdk-python)
+ - [apache/dolphinscheduler-website](#apachedolphinscheduler-website)
+ - [apache/doris](#apachedoris)
+ - [apache/doris-flink-connector](#apachedoris-flink-connector)
+ - [apache/doris-kafka-connector](#apachedoris-kafka-connector)
+ - [apache/doris-opentelemetry-demo](#apachedoris-opentelemetry-demo)
+ - [apache/doris-operator](#apachedoris-operator)
+ - [apache/doris-sdk](#apachedoris-sdk)
+ - [apache/doris-shade](#apachedoris-shade)
+ - [apache/doris-spark-connector](#apachedoris-spark-connector)
+ - [apache/doris-streamloader](#apachedoris-streamloader)
+ - [apache/doris-thirdparty](#apachedoris-thirdparty)
+ - [apache/doris-website](#apachedoris-website)
+ - [apache/drill](#apachedrill)
+ - [apache/druid](#apachedruid)
+ - [apache/druid-operator](#apachedruid-operator)
+ - [apache/dubbo](#apachedubbo)
+ - [apache/dubbo-admin](#apachedubbo-admin)
+ - [apache/dubbo-awesome](#apachedubbo-awesome)
+ - [apache/dubbo-benchmark](#apachedubbo-benchmark)
+ - [apache/dubbo-getty](#apachedubbo-getty)
+ - [apache/dubbo-go](#apachedubbo-go)
+ - [apache/dubbo-go-contrib](#apachedubbo-go-contrib)
+ - [apache/dubbo-go-extensions](#apachedubbo-go-extensions)
+ - [apache/dubbo-go-hessian2](#apachedubbo-go-hessian2)
+ - [apache/dubbo-go-pixiu](#apachedubbo-go-pixiu)
+ - [apache/dubbo-go-pixiu-samples](#apachedubbo-go-pixiu-samples)
+ - [apache/dubbo-go-samples](#apachedubbo-go-samples)
+ - [apache/dubbo-hessian-lite](#apachedubbo-hessian-lite)
+ - [apache/dubbo-initializer](#apachedubbo-initializer)
+ - [apache/dubbo-integration-cases](#apachedubbo-integration-cases)
+ - [apache/dubbo-js](#apachedubbo-js)
+ - [apache/dubbo-kubernetes](#apachedubbo-kubernetes)
+ - [apache/dubbo-python](#apachedubbo-python)
+ - [apache/dubbo-rust](#apachedubbo-rust)
+ - [apache/dubbo-samples](#apachedubbo-samples)
+ - [apache/dubbo-spi-extensions](#apachedubbo-spi-extensions)
+ - [apache/dubbo-spi-samples](#apachedubbo-spi-samples)
+ - [apache/dubbo-spring-boot-project](#apachedubbo-spring-boot-project)
+ - [apache/dubbo-test-tools](#apachedubbo-test-tools)
+ - [apache/dubbo-website](#apachedubbo-website)
+ - [apache/echarts](#apacheecharts)
+ - [apache/echarts-bot](#apacheecharts-bot)
+ - [apache/echarts-doc](#apacheecharts-doc)
+ - [apache/echarts-examples](#apacheecharts-examples)
+ - [apache/echarts-handbook](#apacheecharts-handbook)
+ - [apache/echarts-theme-builder](#apacheecharts-theme-builder)
+ - [apache/echarts-website](#apacheecharts-website)
+ - [apache/eventmesh](#apacheeventmesh)
+ - [apache/eventmesh-catalog](#apacheeventmesh-catalog)
+ - [apache/eventmesh-dashboard](#apacheeventmesh-dashboard)
+ - [apache/eventmesh-go](#apacheeventmesh-go)
+ - [apache/eventmesh-site](#apacheeventmesh-site)
+ - [apache/eventmesh-workflow](#apacheeventmesh-workflow)
+ - [apache/felix-atomos](#apachefelix-atomos)
+ - [apache/felix-dev](#apachefelix-dev)
+ - [apache/fesod](#apachefesod)
+ - [apache/fineract](#apachefineract)
+ - [apache/fineract-backoffice-ui](#apachefineract-backoffice-ui)
+ - [apache/fineract-chat-archive](#apachefineract-chat-archive)
+ - [apache/fineract-credit-scorecard](#apachefineract-credit-scorecard)
+ - [apache/fineract-site](#apachefineract-site)
+ - [apache/flagon](#apacheflagon)
+ - [apache/flex-site](#apacheflex-site)
+ - [apache/flink](#apacheflink)
+ - [apache/flink-agents](#apacheflink-agents)
+ - [apache/flink-benchmarks](#apacheflink-benchmarks)
+ - [apache/flink-cdc](#apacheflink-cdc)
+ - [apache/flink-connector-aws](#apacheflink-connector-aws)
+ - [apache/flink-connector-cassandra](#apacheflink-connector-cassandra)
+ - [apache/flink-connector-elasticsearch](#apacheflink-connector-elasticsearch)
+ - [apache/flink-connector-gcp-pubsub](#apacheflink-connector-gcp-pubsub)
+ - [apache/flink-connector-hbase](#apacheflink-connector-hbase)
+ - [apache/flink-connector-hive](#apacheflink-connector-hive)
+ - [apache/flink-connector-http](#apacheflink-connector-http)
+ - [apache/flink-connector-jdbc](#apacheflink-connector-jdbc)
+ - [apache/flink-connector-kafka](#apacheflink-connector-kafka)
+ - [apache/flink-connector-kudu](#apacheflink-connector-kudu)
+ - [apache/flink-connector-mongodb](#apacheflink-connector-mongodb)
+ - [apache/flink-connector-opensearch](#apacheflink-connector-opensearch)
+ - [apache/flink-connector-prometheus](#apacheflink-connector-prometheus)
+ - [apache/flink-connector-pulsar](#apacheflink-connector-pulsar)
+ - [apache/flink-connector-rabbitmq](#apacheflink-connector-rabbitmq)
+ - [apache/flink-connector-redis-streams](#apacheflink-connector-redis-streams)
+ - [apache/flink-docker](#apacheflink-docker)
+ - [apache/flink-jira-bot](#apacheflink-jira-bot)
+ - [apache/flink-kubernetes-operator](#apacheflink-kubernetes-operator)
+ - [apache/flink-ml](#apacheflink-ml)
+ - [apache/flink-shaded](#apacheflink-shaded)
+ - [apache/flink-statefun](#apacheflink-statefun)
+ - [apache/flink-training](#apacheflink-training)
+ - [apache/fluss](#apachefluss)
+ - [apache/fluss-blog](#apachefluss-blog)
+ - [apache/fluss-rust](#apachefluss-rust)
+ - [apache/fluss-shaded](#apachefluss-shaded)
+ - [apache/fluss-website](#apachefluss-website)
+ - [apache/fory](#apachefory)
+ - [apache/fory-site](#apachefory-site)
+ - [apache/freemarker](#apachefreemarker)
+ - [apache/geaflow](#apachegeaflow)
+ - [apache/geaflow-website](#apachegeaflow-website)
+ - [apache/geode](#apachegeode)
+ - [apache/geode-benchmarks](#apachegeode-benchmarks)
+ - [apache/geode-examples](#apachegeode-examples)
+ - [apache/geode-kafka-connector](#apachegeode-kafka-connector)
+ - [apache/geode-site](#apachegeode-site)
+ - [apache/geronimo-arthur](#apachegeronimo-arthur)
+ - [apache/geronimo-batchee](#apachegeronimo-batchee)
+ - [apache/geronimo-mail](#apachegeronimo-mail)
+ - [apache/geronimo-txmanager](#apachegeronimo-txmanager)
+ - [apache/gluten](#apachegluten)
+ - [apache/gobblin](#apachegobblin)
+ - [apache/gora](#apachegora)
+ - [apache/grails-core](#apachegrails-core)
+ - [apache/grails-forge-ui](#apachegrails-forge-ui)
+ - [apache/grails-github-actions](#apachegrails-github-actions)
+ - [apache/grails-gradle-publish](#apachegrails-gradle-publish)
+ - [apache/grails-plugins-metadata](#apachegrails-plugins-metadata)
+ - [apache/grails-quartz](#apachegrails-quartz)
+ - [apache/grails-redis](#apachegrails-redis)
+ - [apache/grails-spring-security](#apachegrails-spring-security)
+ - [apache/grails-static-website](#apachegrails-static-website)
+ - [apache/gravitino](#apachegravitino)
+ - [apache/gravitino-site](#apachegravitino-site)
+ - [apache/groovy](#apachegroovy)
+ - [apache/groovy-geb](#apachegroovy-geb)
+ - [apache/guacamole-client](#apacheguacamole-client)
+ - [apache/guacamole-manual](#apacheguacamole-manual)
+ - [apache/guacamole-server](#apacheguacamole-server)
+ - [apache/guacamole-website](#apacheguacamole-website)
+ - [apache/hadoop](#apachehadoop)
+ - [apache/hadoop-api-shim](#apachehadoop-api-shim)
+ - [apache/hadoop-thirdparty](#apachehadoop-thirdparty)
+ - [apache/hamilton](#apachehamilton)
+ - [apache/hbase](#apachehbase)
+ - [apache/helix](#apachehelix)
+ - [apache/hertzbeat](#apachehertzbeat)
+ - [apache/hertzbeat-collector-go](#apachehertzbeat-collector-go)
+ - [apache/hertzbeat-helm-chart](#apachehertzbeat-helm-chart)
+ - [apache/hive](#apachehive)
+ - [apache/hive-site](#apachehive-site)
+ - [apache/hop](#apachehop)
+ - [apache/httpcomponents-client](#apachehttpcomponents-client)
+ - [apache/httpcomponents-core](#apachehttpcomponents-core)
+ - [apache/httpd](#apachehttpd)
+ - [apache/httpd-tests](#apachehttpd-tests)
+ - [apache/hudi](#apachehudi)
+ - [apache/hudi-rs](#apachehudi-rs)
+ - [apache/hugegraph](#apachehugegraph)
+ - [apache/hugegraph-ai](#apachehugegraph-ai)
+ - [apache/hugegraph-computer](#apachehugegraph-computer)
+ - [apache/hugegraph-doc](#apachehugegraph-doc)
+ - [apache/hugegraph-toolchain](#apachehugegraph-toolchain)
+ - [apache/incubator-baremaps](#apacheincubator-baremaps)
+ - [apache/incubator-baremaps-site](#apacheincubator-baremaps-site)
+ - [apache/incubator-devlake-helm-chart](#apacheincubator-devlake-helm-chart)
+ - [apache/kafka](#apachekafka)
+ - [apache/kafka-merge-queue-sandbox](#apachekafka-merge-queue-sandbox)
+ - [apache/kafka-site](#apachekafka-site)
+ - [apache/karaf](#apachekaraf)
+ - [apache/karaf-cellar](#apachekaraf-cellar)
+ - [apache/karaf-decanter](#apachekaraf-decanter)
+ - [apache/karaf-minho](#apachekaraf-minho)
+ - [apache/karaf-winegrower](#apachekaraf-winegrower)
+ - [apache/knox](#apacheknox)
+ - [apache/kvrocks](#apachekvrocks)
+ - [apache/kvrocks-controller](#apachekvrocks-controller)
+ - [apache/kvrocks-website](#apachekvrocks-website)
+ - [apache/kyuubi](#apachekyuubi)
+ - [apache/kyuubi-docker](#apachekyuubi-docker)
+ - [apache/kyuubi-shaded](#apachekyuubi-shaded)
+ - [apache/kyuubi-website](#apachekyuubi-website)
+
+---
+
+Analyzed **634** repositories using cached workflow YAML from the Publishing Analyzer.
+
+## Executive Summary
+
+| Severity | Count |
+|----------|-------|
+| **HIGH** | **194** |
+| **MEDIUM** | **322** |
+| **LOW** | **1437** |
+| **INFO** | **875** |
+
+## Findings by Check Type
+
+| Check | Count | Description |
+|-------|-------|-------------|
+| missing_codeowners | 634 | No CODEOWNERS file |
+| missing_dependency_updates | 474 | No dependabot/renovate configuration (ASF policy violation) |
+| self_hosted_runner | 320 | Self-hosted runners exposed to PR triggers |
+| unpinned_actions | 288 | Third-party actions not SHA-pinned (ASF policy violation) |
+| third_party_actions | 278 | Actions from outside actions/*/github/*/apache/* namespaces |
+| cache_poisoning | 271 | Potential cache poisoning via PR-controlled keys |
+| prt_checkout | 206 | pull_request_target + checkout (CRITICAL only when ref: points to PR head) |
+| broad_permissions | 187 | Overly broad GITHUB_TOKEN permissions |
+| run_block_injection | 116 | Direct ${{ }} interpolation in workflow run blocks |
+| composite_action_injection | 26 | Injection in composite action run block |
+| composite_action_input_injection | 26 | Latent injection surface — composite action interpolates inputs.* in run block |
+| composite_action_unpinned | 2 | Third-party unpinned action ref inside composite action |
+
+## HIGH Findings
+
+- **apache/beam** (`IO_Iceberg_Integration_Tests.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`IO_Iceberg_Integration_Tests_Dataflow.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`IO_Iceberg_Managed_Integration_Tests_Dataflow.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`IO_Iceberg_Performance_Tests.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`IO_Iceberg_Unit_Tests.yml:83`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_CloudML_Benchmarks_Dataflow.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_Java_JMH.yml:61`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_Playground_Precommit.yml:39`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Go.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Go_Dataflow_ARM.yml:61`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Go_VR_Flink.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Go_VR_Samza.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Go_VR_Spark.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Avro_Versions.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_BigQueryEarlyRollout.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_DataflowV1.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_DataflowV2.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow_ARM.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow_Java.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow_V2.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow_V2_Java.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Direct.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Flink.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Spark.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Hadoop_Versions.yml:54`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_IO_Performance_Tests.yml:61`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_InfluxDbIO_IT.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Dataflow.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Dataflow_Versions.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Direct.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Direct_Versions.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Flink_Java11.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Spark_Java11.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Dataflow.yml:81`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Dataflow_V2.yml:82`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Dataflow_V2_Java.yml:81`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Direct.yml:76`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Flink.yml:75`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Spark.yml:75`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Flink_Batch.yml:74`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Flink_Streaming.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Samza.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Spark3_Streaming.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Spark_Batch.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_SingleStoreIO_IT.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Tpcds_Dataflow.yml:85`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Tpcds_Flink.yml:82`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_Tpcds_Spark.yml:80`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_JavaVersions.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_Engine.yml:55`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_TagEncodingV2.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_V2.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_V2_Streaming.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Direct.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Direct_JavaVersions.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Flink.yml:54`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Flink_Java8.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Samza.yml:54`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Spark.yml:54`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_SparkStructuredStreaming.yml:54`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Spark_Java8.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Twister2.yml:54`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_ULR.yml:54`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Javadoc.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_PortableJar_Flink.yml:59`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_PortableJar_Spark.yml:59`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python.yml:65`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_Arm.yml:108`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_Dependency.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_Examples_Dataflow.yml:59`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_Examples_Direct.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_Examples_Flink.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_Examples_Spark.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_MongoDBIO_IT.yml:59`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_Nexmark_Direct.yml:93`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_Portable_Flink.yml:57`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesContainer_Dataflow.yml:60`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesContainer_Dataflow_With_RC.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesRunner_Dataflow.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesRunner_Flink.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesRunner_Samza.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesRunner_Spark.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_Xlang_Gcp_Dataflow.yml:59`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_Xlang_Gcp_Direct.yml:59`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_Xlang_IO_Dataflow.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Python_Xlang_IO_Direct.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_SQL.yml:56`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_TransformService_Direct.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Website_Test.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_XVR_Direct.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_XVR_Flink.yml:59`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_XVR_GoUsingJava_Dataflow.yml:61`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_XVR_JavaUsingPython_Dataflow.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_XVR_PythonUsingJavaSQL_Dataflow.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_XVR_PythonUsingJava_Dataflow.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_XVR_Samza.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_XVR_Spark3.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PostCommit_Yaml_Xlang_Direct.yml:57`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_CommunityMetrics.yml:62`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Flink_Container.yml:93`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_GHA.yml:61`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Go.yml:61`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_GoPortable.yml:63`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_GoPrism.yml:61`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_ItFramework.yml:67`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java.yml:157`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Amazon-Web-Services2_IO_Direct.yml:95`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Amqp_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Azure_IO_Direct.yml:95`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Cassandra_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Cdap_IO_Direct.yml:81`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Clickhouse_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Csv_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Datadog_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Debezium_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_ElasticSearch_IO_Direct.yml:79`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Examples_Dataflow.yml:78`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Examples_Dataflow_Java21.yml:87`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_File-schema-transform_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Flink_Versions.yml:69`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_GCP_IO_Direct.yml:95`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Google-ads_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_HBase_IO_Direct.yml:79`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_HCatalog_IO_Direct.yml:79`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Hadoop_IO_Direct.yml:103`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_IOs_Direct.yml:80`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_InfluxDb_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_JDBC_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Jms_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Kafka_IO_Direct.yml:85`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Kudu_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_MongoDb_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Mqtt_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Neo4j_IO_Direct.yml:79`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_PVR_Flink_Batch.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_PVR_Flink_Docker.yml:76`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_PVR_Prism_Loopback.yml:83`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Parquet_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Pulsar_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_RabbitMq_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Redis_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_RequestResponse_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_SingleStore_IO_Direct.yml:79`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Snowflake_IO_Direct.yml:81`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Solace_IO_Direct.yml:89`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Solr_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Spark3_Versions.yml:68`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Splunk_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Thrift_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Java_Tika_IO_Direct.yml:77`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Kotlin_Examples.yml:79`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Portable_Python.yml:79`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Prism_Python.yml:73`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Python.yml:79`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_PythonDocker.yml:58`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_PythonDocs.yml:61`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_PythonFormatter.yml:60`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_PythonLint.yml:60`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Python_Coverage.yml:62`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Python_Dataframes.yml:60`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Python_Dill.yml:70`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Python_Examples.yml:61`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Python_Integration.yml:60`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Python_ML.yml:69`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Python_PVR_Flink.yml:91`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Python_Runners.yml:60`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Python_Transforms.yml:61`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_RAT.yml:59`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_SQL.yml:61`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_SQL_Java17.yml:72`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_SQL_Java8.yml:61`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Spotless.yml:66`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Typescript.yml:63`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Website.yml:61`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Website_Stage_GCS.yml:63`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Whitespace.yml:60`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Xlang_Generated_Transforms.yml:81`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_PreCommit_Yaml_Xlang_Direct.yml:72`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`beam_Prober_CommunityMetrics.yml:57`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`build_runner_image.yml:24`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`build_wheels.yml:48`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`go_tests.yml:39`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`java_tests.yml:48`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`python_tests.yml:44`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/beam** (`typescript_tests.yml:54`): [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **apache/doris-website** (`cron-deploy-website.yml:6`): [broad_permissions] Workflow uses `permissions: write-all`. Follow least-privilege principle.
+- **apache/dubbo-python** (`license-check.yaml:9`): [broad_permissions] Workflow uses `permissions: write-all`. Follow least-privilege principle.
+- **apache/gluten** (`clickhouse_be_trigger.yml:44`): [broad_permissions] Workflow uses `permissions: write-all`. Follow least-privilege principle.
+- **apache/helix** (`Helix-CI.yml:8`): [broad_permissions] Workflow uses `permissions: write-all`. Follow least-privilege principle.
+- **apache/helix** (`Helix-Manual-CI.yml:18`): [broad_permissions] Workflow uses `permissions: write-all`. Follow least-privilege principle.
+
+## MEDIUM Findings
+
+<details>
+<summary>Show 322 medium findings</summary>
+
+- **apache/accumulo-fluo-website** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `ruby/setup-ruby` (1).
+- **apache/accumulo-website** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `ruby/setup-ruby` (1).
+- **apache/activemq** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `EnricoMi/publish-unit-test-result-action` (3).
+- **apache/age-website** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (2).
+- **apache/airavata** (`(repo-wide)`): [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/metadata-action` (1), `docker/build-push-action` (1).
+- **apache/airflow-publish** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pypa/gh-action-pypi-publish` (4).
+- **apache/ambari-website** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **apache/amoro** (`(repo-wide)`): [unpinned_actions] 22 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (3), `docker/setup-qemu-action` (3), `docker/setup-buildx-action` (3), `docker/metadata-action` (3), `docker/login-action` (3).
+- **apache/answer** (`(repo-wide)`): [unpinned_actions] 22 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/metadata-action` (4), `docker/setup-qemu-action` (4), `docker/setup-buildx-action` (4), `docker/login-action` (4), `docker/build-push-action` (4).
+- **apache/answer-plugins** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `korandoru/hawkeye` (1), `peter-evans/create-pull-request` (1).
+- **apache/answer-website** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pnpm/action-setup` (1), `peaceiris/actions-gh-pages` (1).
+- **apache/apisix-control-plane** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **apache/apisix-dashboard** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pnpm/action-setup` (2).
+- **apache/apisix-docker** (`(repo-wide)`): [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/login-action` (2), `docker/setup-qemu-action` (2), `docker/setup-buildx-action` (2).
+- **apache/apisix-ingress-controller** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/login-action` (1), `release-drafter/release-drafter` (1).
+- **apache/apisix-website** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **apache/arrow** (`(repo-wide)`): [unpinned_actions] 9 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `r-lib/actions` (4), `msys2/setup-msys2` (2), `ruby/setup-ruby` (2), `eps1lon/actions-label-merge-conflict` (1).
+- **apache/arrow** (`.github/actions/sync-nightlies/action.yml:85`): [composite_action_input_injection] Composite action `sync-nightlies` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/arrow** (`cpp.yml:134`): [self_hosted_runner] Self-hosted runner with PR trigger, but permissions are limited to: read-only. Blast radius is reduced — no access to publishing secrets or contents:write.
+- **apache/arrow-cookbook** (`(repo-wide)`): [unpinned_actions] 12 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `r-lib/actions` (8), `conda-incubator/setup-miniconda` (4).
+- **apache/arrow-flight-sql-postgresql** (`(repo-wide)`): [unpinned_actions] 9 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `ruby/setup-ruby` (5), `docker/login-action` (1), `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/build-push-action` (1).
+- **apache/arrow-go** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `msys2/setup-msys2` (1).
+- **apache/arrow-julia** (`(repo-wide)`): [unpinned_actions] 17 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `julia-actions/setup-julia` (6), `julia-actions/julia-buildpkg` (3), `julia-actions/julia-runtest` (2), `julia-actions/julia-processcoverage` (2), `codecov/codecov-action` (2).
+- **apache/arrow-nanoarrow** (`(repo-wide)`): [unpinned_actions] 11 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `r-lib/actions` (8), `ilammy/msvc-dev-cmd` (2), `codecov/codecov-action` (1).
+- **apache/arrow-nanoarrow** (`build-and-test-device.yaml:78`): [self_hosted_runner] Self-hosted runner with PR trigger, but permissions are limited to: read-only. Blast radius is reduced — no access to publishing secrets or contents:write.
+- **apache/arrow-rs** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **apache/arrow-rs-object-store** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `taiki-e/install-action` (1).
+- **apache/arrow-site** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `ruby/setup-ruby` (1).
+- **apache/attic** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `ruby/setup-ruby` (2).
+- **apache/auron** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `arduino/setup-protoc` (3), `Mattraks/delete-workflow-runs` (1).
+- **apache/avro** (`(repo-wide)`): [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `shogo82148/actions-setup-perl` (2), `shivammathur/setup-php` (2), `ruby/setup-ruby` (2).
+- **apache/avro-rs** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `taiki-e/install-action` (3), `shogo82148/actions-setup-perl` (1).
+- **apache/beam** (`(repo-wide)`): [unpinned_actions] 208 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `EnricoMi/publish-unit-test-result-action` (140), `jwgmeligmeyling/spotbugs-github-action` (42), `jlumbroso/free-disk-space` (7), `codecov/codecov-action` (5), `dawidd6/action-send-mail` (4).
+- **apache/beam** (`.github/actions/build-push-docker-action/action.yml:37`): [composite_action_input_injection] Composite action `build-push-docker-action` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/beam** (`.github/actions/dind-up-action/action.yml:112`): [composite_action_input_injection] Composite action `dind-up-action` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/beam** (`.github/actions/gradle-command-self-hosted-action/action.yml:44`): [composite_action_input_injection] Composite action `gradle-command-self-hosted-action` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/beam** (`.github/actions/rerun-job-action/action.yml:49`): [composite_action_input_injection] Composite action `rerun-job-action` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/beam** (`.github/actions/setup-action/action.yml:39`): [composite_action_input_injection] Composite action `setup-action` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/beam** (`.github/actions/setup-k8s-access/action.yml:71`): [composite_action_unpinned] Composite action uses unpinned action `pyTooling/Actions/with-post-step@v4.2.2`. Supply chain risk.
+- **apache/beam** (`.github/actions/setup-k8s-access/action.yml:48`): [composite_action_input_injection] Composite action `setup-k8s-access` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/beam** (`.github/actions/test-arguments-action/action.yml:42`): [composite_action_input_injection] Composite action `test-arguments-action` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/beam** (`beam_Infrastructure_UsersPermissions.yml:50`): [prt_checkout] pull_request_target checks out PR head code, but permissions are limited to: pull-requests. Blast radius is reduced — no access to publishing secrets or contents:write.
+- **apache/beam** (`beam_Infrastructure_UsersPermissions.yml:44`): [self_hosted_runner] Self-hosted runner with PR trigger, but permissions are limited to: pull-requests. Blast radius is reduced — no access to publishing secrets or contents:write.
+- **apache/beam** (`run_perf_alert_tool.yml:33`): [self_hosted_runner] Self-hosted runner with PR trigger, but permissions are limited to: issues. Blast radius is reduced — no access to publishing secrets or contents:write.
+- **apache/beam-starter-java** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `sbt/setup-sbt` (1).
+- **apache/bifromq** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/login-action` (1).
+- **apache/bifromq-sites** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pnpm/action-setup` (1), `peaceiris/actions-gh-pages` (1).
+- **apache/bigtop-manager** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `crate-ci/typos` (1), `amannn/action-semantic-pull-request` (1).
+- **apache/bookkeeper** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `crate-ci/typos` (1).
+- **apache/brpc** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `google/oss-fuzz` (2).
+- **apache/brpc-website** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-hugo` (1), `peaceiris/actions-gh-pages` (1).
+- **apache/burr** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `hasura/comment-progress` (2), `peaceiris/actions-gh-pages` (2).
+- **apache/calcite** (`(repo-wide)`): [unpinned_actions] 18 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `burrunan/gradle-cache-action` (17), `gradle/actions` (1).
+- **apache/calcite-avatica** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `google/oss-fuzz` (2), `gradle/wrapper-validation-action` (1).
+- **apache/camel-k** (`.github/actions/automatic-updates/action.yml:101`): [composite_action_input_injection] Composite action `automatic-updates` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/camel-k** (`.github/actions/build/action.yml:55`): [composite_action_input_injection] Composite action `build` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/camel-k** (`.github/actions/infra-setting/action.yml:42`): [composite_action_unpinned] Composite action uses unpinned action `medyagh/setup-minikube@v0.0.18`. Supply chain risk.
+- **apache/camel-k** (`.github/actions/install-otlp-collector/action.yml:89`): [composite_action_input_injection] Composite action `install-otlp-collector` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/camel-k-runtime** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `AdoptOpenJDK/install-jdk` (3).
+- **apache/camel-k-runtime** (`.github/actions/automatic-updates/action.yml:88`): [composite_action_input_injection] Composite action `automatic-updates` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/camel-kafka-connector** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peter-evans/create-pull-request` (1).
+- **apache/camel-karaf** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `EnricoMi/publish-unit-test-result-action` (1).
+- **apache/camel-spring-boot** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peter-evans/create-pull-request` (2).
+- **apache/camel-upgrade-recipes** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `googleapis/code-suggester` (1).
+- **apache/camel-website** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peter-evans/create-pull-request` (1).
+- **apache/casbin** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **apache/casbin-3rd-party-casbin-pg-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `isbang/compose-action` (1).
+- **apache/casbin-Casbin.NET** (`(repo-wide)`): [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `microsoft/infersharpaction` (5), `amannn/action-semantic-pull-request` (1).
+- **apache/casbin-Casbin.NET-redis-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `amannn/action-semantic-pull-request` (1).
+- **apache/casbin-actix-casbin-auth** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-admission-webhook** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/build-push-action` (1).
+- **apache/casbin-axum-casbin** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-confita** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `c-hive/gha-yarn-cache` (1).
+- **apache/casbin-core** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (1).
+- **apache/casbin-cpp** (`(repo-wide)`): [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `jwlawson/actions-setup-cmake` (5).
+- **apache/casbin-crd-adapter** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1), `golangci/golangci-lint-action` (1).
+- **apache/casbin-dart-casbin** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dart-lang/setup-dart` (3).
+- **apache/casbin-docker_auth** (`(repo-wide)`): [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `haya14busa/action-cond` (1), `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/build-push-action` (1).
+- **apache/casbin-editor** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **apache/casbin-ent-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `shogo82148/actions-goveralls` (1).
+- **apache/casbin-ex** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `erlef/setup-beam` (2).
+- **apache/casbin-gateway** (`(repo-wide)`): [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `cycjimmy/semantic-release-action` (1), `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/build-push-action` (1).
+- **apache/casbin-go-cli** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `goreleaser/goreleaser-action` (1), `golangci/golangci-lint-action` (1).
+- **apache/casbin-go-client** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker-practice/actions-setup-docker` (1).
+- **apache/casbin-gorm-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `shogo82148/actions-goveralls` (1).
+- **apache/casbin-gorm-adapter-ex** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `shogo82148/actions-goveralls` (1).
+- **apache/casbin-govaluate** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **apache/casbin-informer-watcher** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-dynamodb-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-hibernate-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-jdbc-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-jfinal-authz** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-kafka-casbin** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-lettuce-redis-watcher** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `getong/redis-action` (1), `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-mongo-adapter** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `supercharge/mongodb-github-action` (1), `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-mybatis-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-mybatisplus-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-nutz-authz** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-play-authz** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-rabbitmq-watcher** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-redis-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-redis-watcher** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `getong/redis-action` (1), `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-redis-watcher-ex** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-shiro-casbin** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker-practice/actions-setup-docker` (1), `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-spring-security-starter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-string-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-vertx-authz** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-jcasbin-zookeeper-watcher** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-js-vue-authz** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-laravel-rbac** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `shivammathur/setup-php` (1), `coverallsapp/github-action` (1).
+- **apache/casbin-lego** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `niden/actions-memcached` (1), `crazy-max/ghaction-github-pages` (1), `goreleaser/goreleaser-action` (1).
+- **apache/casbin-lua-4daysorm-adapter** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `leafo/gh-actions-lua` (1), `leafo/gh-actions-luarocks` (1).
+- **apache/casbin-lua-casbin** (`(repo-wide)`): [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `leafo/gh-actions-lua` (3), `leafo/gh-actions-luarocks` (3).
+- **apache/casbin-lua-kong-authz** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `leafo/gh-actions-lua` (1), `leafo/gh-actions-luarocks` (1).
+- **apache/casbin-lua-luasql-adapter** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `leafo/gh-actions-lua` (1), `leafo/gh-actions-luarocks` (1).
+- **apache/casbin-mcp-gateway** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-mesh** (`(repo-wide)`): [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/metadata-action` (1), `docker/build-push-action` (1).
+- **apache/casbin-mongodb-adapter** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `supercharge/mongodb-github-action` (1), `shogo82148/actions-goveralls` (1).
+- **apache/casbin-nest-authz** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **apache/casbin-node-casbin** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **apache/casbin-node-casbin-couchdb-adapter** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **apache/casbin-node-casbin-drizzle-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (1).
+- **apache/casbin-node-casbin-expression-eval** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **apache/casbin-node-casbin-file-adapter** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **apache/casbin-node-casbin-mongo-changestream-watcher** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **apache/casbin-node-casbin-mongoose-adapter** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **apache/casbin-node-casbin-node-redis-adapter** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **apache/casbin-node-casbin-prisma-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (1).
+- **apache/casbin-node-casbin-redis-watcher** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (1).
+- **apache/casbin-opentelemetry-logger** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-policyguard** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **apache/casbin-prometheus-logger** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-pycasbin** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `super-linter/super-linter` (1).
+- **apache/casbin-python-cli** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `semantic-release-action/next-release-version` (1).
+- **apache/casbin-python-fastapi-casbin-auth** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (1).
+- **apache/casbin-python-graphql-authz** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `wearerequired/lint-action` (1).
+- **apache/casbin-python-pymongo-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `supercharge/mongodb-github-action` (1).
+- **apache/casbin-python-rabbitmq-watcher** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `nijel/rabbitmq-action` (1).
+- **apache/casbin-python-redis-adapter** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `nnhy/redis-github-action` (1).
+- **apache/casbin-raft** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **apache/casbin-rs** (`(repo-wide)`): [unpinned_actions] 17 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (7), `actions-rs/toolchain` (4), `ruby/setup-ruby` (1), `stefanzweifel/git-auto-commit-action` (1), `baptiste0928/cargo-install` (1).
+- **apache/casbin-rust-actix-casbin** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-rust-actix-file-adapter-rbac** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (2), `actions-rs/toolchain` (1), `Swatinem/rust-cache` (1).
+- **apache/casbin-rust-actix-middleware-example** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (2), `actions-rs/toolchain` (1), `Swatinem/rust-cache` (1).
+- **apache/casbin-rust-actix-postgresql-simple** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (2), `actions-rs/toolchain` (1), `Swatinem/rust-cache` (1).
+- **apache/casbin-rust-axum-middleware-example** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (2), `actions-rs/toolchain` (1), `Swatinem/rust-cache` (1).
+- **apache/casbin-rust-casbin-grpc** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (2), `actions-rs/toolchain` (1), `Swatinem/rust-cache` (1).
+- **apache/casbin-rust-casbin-rust-cli** (`(repo-wide)`): [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (3), `actions-rs/toolchain` (1), `casbin-rs/semantic-release-action-rust` (1).
+- **apache/casbin-rust-diesel-adapter** (`(repo-wide)`): [unpinned_actions] 12 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (9), `actions-rs/toolchain` (2), `codecov/codecov-action` (1).
+- **apache/casbin-rust-dufs-with-casbin** (`(repo-wide)`): [unpinned_actions] 10 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/toolchain` (3), `Swatinem/rust-cache` (1), `actions-rs/cargo` (1), `softprops/action-gh-release` (1), `docker/setup-qemu-action` (1).
+- **apache/casbin-rust-json-adapter** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/toolchain` (1), `actions-rs/tarpaulin` (1), `codecov/codecov-action` (1).
+- **apache/casbin-rust-ntex-file-adapter-acl** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (2), `actions-rs/toolchain` (1), `Swatinem/rust-cache` (1).
+- **apache/casbin-rust-poem-casbin** (`(repo-wide)`): [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (5), `actions-rs/toolchain` (1).
+- **apache/casbin-rust-poem-todo** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (2), `actions-rs/toolchain` (1), `Swatinem/rust-cache` (1).
+- **apache/casbin-rust-postgres-adapter** (`(repo-wide)`): [unpinned_actions] 11 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (6), `actions-rs/toolchain` (3), `actions-rs/tarpaulin` (1), `codecov/codecov-action` (1).
+- **apache/casbin-rust-redis-watcher** (`(repo-wide)`): [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dtolnay/rust-toolchain` (3), `Swatinem/rust-cache` (3), `codecov/codecov-action` (1), `casbin-rs/semantic-release-action-rust` (1).
+- **apache/casbin-rust-rocket-authz** (`(repo-wide)`): [unpinned_actions] 11 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (6), `actions-rs/toolchain` (3), `actions-rs/tarpaulin` (1), `codecov/codecov-action` (1).
+- **apache/casbin-rust-salvo-casbin** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/casbin-rust-semantic-release-action-rust** (`(repo-wide)`): [unpinned_actions] 14 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dtolnay/rust-toolchain` (3), `Swatinem/rust-cache` (3), `taiki-e/install-action` (2), `casbin-rs/semantic-release-action-rust` (2), `DeterminateSystems/nix-installer-action` (1).
+- **apache/casbin-rust-string-adapter** (`(repo-wide)`): [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (4), `actions-rs/toolchain` (2), `baptiste0928/cargo-install` (1), `codecov/codecov-action` (1).
+- **apache/casbin-sequelize-adapter** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **apache/casbin-server** (`(repo-wide)`): [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-ecosystem/action-get-latest-tag` (2), `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/build-push-action` (1).
+- **apache/casbin-sqlx-adapter** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dtolnay/rust-toolchain` (2), `baptiste0928/cargo-install` (1), `codecov/codecov-action` (1).
+- **apache/casbin-typeorm-adapter** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `mirromutth/mysql-action` (2), `coverallsapp/github-action` (1).
+- **apache/casbin-ucon** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `benchmark-action/github-action-benchmark` (1), `golangci/golangci-lint-action` (1).
+- **apache/casbin-vscode-plugin** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `HaaLeo/publish-vscode-extension` (1).
+- **apache/casbin-website** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `tcort/github-action-markdown-link-check` (3), `peaceiris/actions-gh-pages` (1).
+- **apache/casbin-website-v1-deprecated** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `crowdin/github-action` (1).
+- **apache/casbin-zap-logger** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-ecosystem/action-get-latest-tag` (2).
+- **apache/cassandra-ccm** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `mikepenz/action-junit-report` (2).
+- **apache/cassandra-easy-stress** (`(repo-wide)`): [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (6), `docker/login-action` (1), `softprops/action-gh-release` (1).
+- **apache/cassandra-sidecar** (`(repo-wide)`): [unpinned_actions] 11 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (10), `softprops/action-gh-release` (1).
+- **apache/cassandra-spark-connector** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `mikepenz/action-junit-report` (1).
+- **apache/causeway** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `stCarolas/setup-maven` (1).
+- **apache/celeborn** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pnpm/action-setup` (2), `docker/login-action` (1), `codecov/codecov-action` (1).
+- **apache/cloudberry** (`(repo-wide)`): [unpinned_actions] 10 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (2), `docker/login-action` (2), `docker/setup-buildx-action` (2), `docker/build-push-action` (2), `SonarSource/sonarqube-scan-action` (2).
+- **apache/cloudberry-site** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **apache/cloudstack** (`(repo-wide)`): [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (3), `docker/login-action` (1), `eps1lon/actions-label-merge-conflict` (1).
+- **apache/cloudstack-documentation** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `readthedocs/actions` (1).
+- **apache/cloudstack-kubernetes-provider** (`(repo-wide)`): [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/build-push-action` (1), `codecov/codecov-action` (1), `golangci/golangci-lint-action` (1).
+- **apache/cloudstack-www** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (2).
+- **apache/cordova** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gr2m/twitter-together` (2).
+- **apache/cordova-fetch** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/cordova-plugin-battery-status** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **apache/cordova-plugin-device** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **apache/cordova-plugin-device-motion** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **apache/cordova-plugin-device-orientation** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **apache/cordova-plugin-dialogs** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **apache/cordova-plugin-file** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **apache/cordova-plugin-file-transfer** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **apache/cordova-plugin-geolocation** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **apache/cordova-plugin-media** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **apache/cordova-plugin-media-capture** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **apache/cordova-plugin-screen-orientation** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **apache/cordova-plugin-statusbar** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **apache/cordova-plugman** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/couchdb-ci** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/login-action` (1), `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/build-push-action` (1).
+- **apache/couchdb-fast-pbkdf2** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `erlef/setup-beam` (1), `ilammy/msvc-dev-cmd` (1), `uraimo/run-on-arch-action` (1).
+- **apache/couchdb-meck** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `erlef/setup-beam` (1).
+- **apache/couchdb-mochiweb** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `erlangpack/github-action` (1).
+- **apache/curator-site** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **apache/daffodil-sbt** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `msys2/setup-msys2` (1).
+- **apache/daffodil-site** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker:/` (1).
+- **apache/datafusion** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `eps1lon/actions-label-merge-conflict` (1).
+- **apache/datafusion** (`.github/actions/setup-builder/action.yml:39`): [composite_action_input_injection] Composite action `setup-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/datafusion-ballista** (`(repo-wide)`): [unpinned_actions] 13 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dtolnay/rust-toolchain` (6), `astral-sh/setup-uv` (5), `pypa/gh-action-pypi-publish` (1), `eps1lon/actions-label-merge-conflict` (1).
+- **apache/datafusion-ballista** (`.github/actions/setup-builder/action.yml:36`): [composite_action_input_injection] Composite action `setup-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/datafusion-ballista-python** (`(repo-wide)`): [unpinned_actions] 7 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `potiuk/cancel-workflow-runs` (2), `r-lib/actions` (2), `eps1lon/actions-label-merge-conflict` (1), `actions-rs/toolchain` (1), `pypa/gh-action-pypi-publish` (1).
+- **apache/datafusion-ballista-python** (`.github/actions/setup-builder/action.yml:36`): [composite_action_input_injection] Composite action `setup-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/datafusion-comet** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/build-push-action` (1).
+- **apache/datafusion-comet** (`.github/actions/java-test/action.yml:79`): [composite_action_input_injection] Composite action `java-test` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/datafusion-comet** (`.github/actions/setup-builder/action.yml:55`): [composite_action_input_injection] Composite action `setup-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/datafusion-comet** (`.github/actions/setup-iceberg-builder/action.yml:39`): [composite_action_input_injection] Composite action `setup-iceberg-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/datafusion-comet** (`.github/actions/setup-macos-builder/action.yml:47`): [composite_action_input_injection] Composite action `setup-macos-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/datafusion-comet** (`.github/actions/setup-spark-builder/action.yml:46`): [composite_action_input_injection] Composite action `setup-spark-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/datafusion-python** (`(repo-wide)`): [unpinned_actions] 16 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `PyO3/maturin-action` (6), `Swatinem/rust-cache` (5), `arduino/setup-protoc` (3), `taiki-e/install-action` (2).
+- **apache/datafusion-ray** (`(repo-wide)`): [unpinned_actions] 21 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `astral-sh/setup-uv` (5), `dtolnay/rust-toolchain` (3), `arduino/setup-protoc` (3), `PyO3/maturin-action` (3), `docker/metadata-action` (1).
+- **apache/datafusion-sandbox** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `eps1lon/actions-label-merge-conflict` (1).
+- **apache/datafusion-sandbox** (`.github/actions/setup-builder/action.yml:39`): [composite_action_input_injection] Composite action `setup-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/datafusion-sqlparser-rs** (`.github/actions/setup-builder/action.yml:35`): [composite_action_input_injection] Composite action `setup-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/datasketches-cpp** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **apache/datasketches-memory16** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `AdoptOpenJDK/install-jdk` (1).
+- **apache/datasketches-memory17** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `AdoptOpenJDK/install-jdk` (2).
+- **apache/datasketches-python** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (1), `peaceiris/actions-gh-pages` (1).
+- **apache/datasketches-rust** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `Swatinem/rust-cache` (2), `taiki-e/install-action` (1).
+- **apache/dolphinscheduler** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `EnricoMi/publish-unit-test-result-action` (1).
+- **apache/dolphinscheduler-operator** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/login-action` (1).
+- **apache/dolphinscheduler-sdk-python** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/dolphinscheduler-website** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **apache/doris** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `mxschmitt/action-tmate` (1).
+- **apache/doris** (`code-checks.yml:35`): [prt_checkout] pull_request_target checks out PR head code, but permissions are limited to: read-only. Blast radius is reduced — no access to publishing secrets or contents:write.
+- **apache/doris-opentelemetry-demo** (`(repo-wide)`): [unpinned_actions] 9 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/login-action` (2), `dyladan/component-owners` (1), `umbrelladocs/action-linkspector` (1), `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1).
+- **apache/doris-operator** (`(repo-wide)`): [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/metadata-action` (2), `docker/build-push-action` (2), `docker/setup-buildx-action` (1), `docker/login-action` (1), `azure/setup-helm` (1).
+- **apache/doris-thirdparty** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/build-push-action` (2), `docker/setup-buildx-action` (1), `docker/login-action` (1).
+- **apache/doris-website** (`(repo-wide)`): [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (4), `peter-evans/create-pull-request` (1).
+- **apache/druid** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `amannn/action-semantic-pull-request` (1), `mikepenz/action-junit-report` (1).
+- **apache/dubbo** (`(repo-wide)`): [unpinned_actions] 11 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `msys2/setup-msys2` (5), `codecov/codecov-action` (3), `graalvm/setup-graalvm` (3).
+- **apache/dubbo-awesome** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **apache/dubbo-getty** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `zcong1993/actions-ding` (2).
+- **apache/dubbo-go** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1), `release-drafter/release-drafter` (1).
+- **apache/dubbo-go-contrib** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **apache/dubbo-go-extensions** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1), `codecov/codecov-action` (1).
+- **apache/dubbo-go-hessian2** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `zcong1993/actions-ding` (2).
+- **apache/dubbo-go-pixiu** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1), `codecov/codecov-action` (1), `wangyoucao577/go-release-action` (1).
+- **apache/dubbo-go-pixiu-samples** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1), `wangyoucao577/go-release-action` (1).
+- **apache/dubbo-go-samples** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **apache/dubbo-initializer** (`(repo-wide)`): [unpinned_actions] 7 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (2), `docker/setup-buildx-action` (2), `docker/build-push-action` (2), `docker/login-action` (1).
+- **apache/dubbo-js** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/dubbo-kubernetes** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1), `azure/setup-helm` (1).
+- **apache/dubbo-rust** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/toolchain` (2).
+- **apache/dubbo-spi-extensions** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `msys2/setup-msys2` (2), `codecov/codecov-action` (2).
+- **apache/dubbo-website** (`(repo-wide)`): [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-hugo` (4), `peaceiris/actions-gh-pages` (4).
+- **apache/eventmesh** (`(repo-wide)`): [unpinned_actions] 7 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (3), `dependabot/fetch-metadata` (1), `docker/login-action` (1), `docker/metadata-action` (1), `docker/build-push-action` (1).
+- **apache/eventmesh-catalog** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **apache/eventmesh-dashboard** (`(repo-wide)`): [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dependabot/fetch-metadata` (1), `gradle/actions` (1), `docker/login-action` (1), `docker/metadata-action` (1), `docker/build-push-action` (1).
+- **apache/eventmesh-go** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **apache/eventmesh-site** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **apache/eventmesh-workflow** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **apache/fesod** (`(repo-wide)`): [unpinned_actions] 7 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pnpm/action-setup` (3), `EnricoMi/publish-unit-test-result-action` (2), `peaceiris/actions-gh-pages` (1), `korandoru/hawkeye` (1).
+- **apache/flagon** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pnpm/action-setup` (2), `snok/install-poetry` (1), `ruby/setup-ruby` (1).
+- **apache/flink** (`.github/actions/job_init/action.yml:74`): [composite_action_input_injection] Composite action `job_init` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/flink** (`.github/actions/run_mvn/action.yml:41`): [composite_action_input_injection] Composite action `run_mvn` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/flink** (`.github/actions/stringify/action.yml:41`): [composite_action_input_injection] Composite action `stringify` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/flink-agents** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `astral-sh/setup-uv` (4).
+- **apache/flink-benchmarks** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `stCarolas/setup-maven` (1).
+- **apache/flink-cdc** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `ruby/setup-ruby` (2), `stCarolas/setup-maven` (1).
+- **apache/flink-connector-aws** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `stCarolas/setup-maven` (1).
+- **apache/flink-connector-jdbc** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `stCarolas/setup-maven` (1).
+- **apache/flink-connector-prometheus** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `stCarolas/setup-maven` (1).
+- **apache/flink-docker** (`(repo-wide)`): [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (2), `docker/setup-buildx-action` (2), `docker/login-action` (2), `docker/build-push-action` (1), `docker/bake-action` (1).
+- **apache/flink-kubernetes-operator** (`.github/actions/rsync-deployments/action.yml:38`): [composite_action_input_injection] Composite action `rsync-deployments` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **apache/flink-shaded** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `stCarolas/setup-maven` (1).
+- **apache/fluss-rust** (`(repo-wide)`): [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `PyO3/maturin-action` (5), `taiki-e/install-action` (1).
+- **apache/fluss-shaded** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `stCarolas/setup-maven` (1).
+- **apache/fory** (`(repo-wide)`): [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `Swatinem/rust-cache` (2), `subosito/flutter-action` (1), `korandoru/hawkeye` (1), `amannn/action-semantic-pull-request` (1).
+- **apache/fory-site** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1), `gaurav-nelson/github-action-markdown-link-check` (1).
+- **apache/freemarker** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (1).
+- **apache/geaflow** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `arduino/setup-protoc` (2).
+- **apache/geaflow-website** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **apache/geode** (`(repo-wide)`): [unpinned_actions] 9 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (9).
+- **apache/geode-benchmarks** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/gradle-build-action` (1).
+- **apache/geode-examples** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/gradle-build-action` (1).
+- **apache/geode-site** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/gradle-build-action` (1).
+- **apache/gluten** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dawidd6/action-download-artifact` (2), `jidicula/clang-format-action` (1).
+- **apache/gobblin** (`(repo-wide)`): [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/login-action` (2), `codecov/codecov-action` (1), `docker/setup-buildx-action` (1), `docker/build-push-action` (1).
+- **apache/gora** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `scacap/action-surefire-report` (2).
+- **apache/grails-core** (`(repo-wide)`): [unpinned_actions] 32 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `testlens-app/setup-testlens` (26), `softprops/action-gh-release` (5), `release-drafter/release-drafter` (1).
+- **apache/grails-forge-ui** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (2).
+- **apache/grails-gradle-publish** (`(repo-wide)`): [unpinned_actions] 9 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (5), `softprops/action-gh-release` (3), `release-drafter/release-drafter` (1).
+- **apache/grails-plugins-metadata** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peter-evans/create-pull-request` (2).
+- **apache/gravitino** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `azure/setup-helm` (1), `container-tools/kind-action` (1), `docker/setup-qemu-action` (1), `pnpm/action-setup` (1).
+- **apache/gravitino-site** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `korandoru/hawkeye` (1), `pnpm/action-setup` (1), `peaceiris/actions-gh-pages` (1).
+- **apache/groovy** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/groovy-geb** (`(repo-wide)`): [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (5), `gradle/wrapper-validation-action` (1).
+- **apache/hadoop** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **apache/hamilton** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pypa/gh-action-pypi-publish` (1), `docker/login-action` (1).
+- **apache/helix** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dorny/test-reporter` (2).
+- **apache/hertzbeat** (`(repo-wide)`): [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pnpm/action-setup` (4), `codecov/codecov-action` (2), `peaceiris/actions-gh-pages` (1), `dtolnay/rust-toolchain` (1).
+- **apache/hertzbeat-collector-go** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `amannn/action-semantic-pull-request` (1).
+- **apache/hertzbeat-helm-chart** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `azure/setup-helm` (1), `helm/chart-testing-action` (1).
+- **apache/hive** (`(repo-wide)`): [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/build-push-action` (4), `docker/login-action` (1), `docker/setup-buildx-action` (1), `helm/kind-action` (1), `azure/setup-helm` (1).
+- **apache/hive-site** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-hugo` (1), `peaceiris/actions-gh-pages` (1).
+- **apache/hudi** (`(repo-wide)`): [unpinned_actions] 15 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (14), `amannn/action-semantic-pull-request` (1).
+- **apache/hudi-rs** (`(repo-wide)`): [unpinned_actions] 7 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `PyO3/maturin-action` (4), `Swatinem/rust-cache` (2), `codecov/codecov-action` (1).
+- **apache/hugegraph** (`(repo-wide)`): [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (5), `peter-evans/create-or-update-comment` (1).
+- **apache/hugegraph-ai** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peter-evans/create-or-update-comment` (1), `aormsby/Fork-Sync-With-Upstream-action` (1).
+- **apache/hugegraph-computer** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/hugegraph-doc** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peter-evans/create-or-update-comment` (1), `peaceiris/actions-hugo` (1), `peaceiris/actions-gh-pages` (1).
+- **apache/hugegraph-toolchain** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (4).
+- **apache/incubator-baremaps-site** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **apache/incubator-devlake-helm-chart** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `container-tools/kind-action` (1), `docker/login-action` (1).
+- **apache/kafka-site** (`(repo-wide)`): [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/metadata-action` (1), `docker/build-push-action` (1).
+- **apache/karaf** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dawidd6/action-download-artifact` (2), `EnricoMi/publish-unit-test-result-action` (1).
+- **apache/karaf-decanter** (`(repo-wide)`): [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dawidd6/action-download-artifact` (2), `EnricoMi/publish-unit-test-result-action` (1).
+- **apache/knox** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `EnricoMi/publish-unit-test-result-action` (1).
+- **apache/kvrocks** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `crate-ci/typos` (1), `amannn/action-semantic-pull-request` (1).
+- **apache/kvrocks-controller** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/kvrocks-website** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **apache/kyuubi** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **apache/kyuubi-docker** (`(repo-wide)`): [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/login-action` (1).
+- **apache/kyuubi-website** (`(repo-wide)`): [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-hugo` (1), `peaceiris/actions-gh-pages` (1).
+
+</details>
+
+## LOW Findings
+
+<details>
+<summary>Show 1437 low findings</summary>
+
+- **apache/accumulo** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo** (`maven-full-its.yaml:75`): [run_block_injection] Workflow input `${{ github.event.inputs.numITsPerTask }}` directly interpolated in run block at step 'Build with Maven (Fast Build)' in workflow maven-full-its.yaml. Trusted committer input but should use env: block.
+- **apache/accumulo** (`maven-on-demand.yaml:90`): [run_block_injection] 5 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.addOpts`, `github.event.inputs.goals`, `github.event.inputs.itOpts`, `github.event.inputs.mvnOpts`, `github.event.inputs.utOpts`.
+- **apache/accumulo-access** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-access** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-access** (`maven-on-demand.yaml:53`): [run_block_injection] Workflow input `${{ github.event.inputs.goals }}` directly interpolated in run block at step 'Build with Maven' in workflow maven-on-demand.yaml. Trusted committer input but should use env: block.
+- **apache/accumulo-classloaders** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-classloaders** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-classloaders** (`maven-on-demand.yaml:53`): [run_block_injection] Workflow input `${{ github.event.inputs.goals }}` directly interpolated in run block at step 'Build with Maven' in workflow maven-on-demand.yaml. Trusted committer input but should use env: block.
+- **apache/accumulo-examples** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-examples** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-fluo** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-fluo** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-fluo-bytes** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-fluo-bytes** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-fluo-examples** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-fluo-examples** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-fluo-muchos** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-fluo-muchos** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-fluo-recipes** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-fluo-recipes** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-fluo-uno** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-fluo-uno** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-fluo-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-fluo-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-fluo-yarn** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-fluo-yarn** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-instamo-archetype** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-instamo-archetype** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-maven-plugin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-maven-plugin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-proxy** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-proxy** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-testing** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-testing** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/accumulo-wikisearch** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/accumulo-wikisearch** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/activemq** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/activemq-nms-amqp** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/activemq-nms-amqp** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/activemq-nms-openwire** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/activemq-nms-openwire** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/age** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/age** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/age-viewer** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/age-viewer** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/age-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/age-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/airavata** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/airavata** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/airavata-django-portal** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/airavata-django-portal** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/airavata-mft** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/airavata-mft** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/airflow** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/airflow** (`release_single_dockerhub_image.yml:91,92,185,186`): [run_block_injection] 4 instances of direct interpolation in run blocks. Expressions: `secrets.DOCKERHUB_TOKEN`, `secrets.DOCKERHUB_USER`.
+- **apache/airflow-client-go** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/airflow-client-go** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/airflow-client-python** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/airflow-client-python** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/airflow-publish** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/airflow-publish** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/airflow-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/airflow-site-archive** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/allura** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/allura** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/ambari-metrics** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/ambari-metrics** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/ambari-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/ambari-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/amoro** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/amoro** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/amoro-shade** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/amoro-shade** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/answer** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/answer** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/answer-plugins** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/answer-plugins** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/answer-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/answer-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/apachecon-acasia** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/apachecon-eu** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/apisix** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/apisix-control-plane** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/apisix-control-plane** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/apisix-dashboard** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/apisix-docker** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/apisix-docker** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/apisix-go-plugin-runner** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/apisix-go-plugin-runner** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/apisix-helm-chart** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/apisix-helm-chart** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/apisix-ingress-controller** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/apisix-ingress-controller** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/apisix-java-plugin-runner** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/apisix-java-plugin-runner** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/apisix-python-plugin-runner** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/apisix-python-plugin-runner** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/apisix-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/apr** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/apr** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/apr-util** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/apr-util** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/aries** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/aries-cdi** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/aries-component-dsl** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/aries-jax-rs-whiteboard** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/aries-jpa** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/aries-jpa** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/aries-rsa** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/arrow** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/arrow** (`.github/actions/sync-nightlies/action.yml:85`): [composite_action_injection] Workflow input `${{ inputs.upload }}` directly interpolated in run block at step 'Sync files' in composite action .github/actions/sync-nightlies. Trusted committer input but should use env: block.
+- **apache/arrow** (`cpp_extra.yml:608,610`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.GITHUB_TOKEN`.
+- **apache/arrow** (`dev.yml:111`): [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Run Release Test' in workflow dev.yml. Trusted value but risks log leakage.
+- **apache/arrow** (`dev_pr.yml`): [prt_checkout] pull_request_target trigger with checkout action using custom ref. Verify the ref does not resolve to untrusted PR code.
+- **apache/arrow** (`pr_bot.yml`): [prt_checkout] pull_request_target trigger with checkout action using custom ref. Verify the ref does not resolve to untrusted PR code.
+- **apache/arrow** (`ruby.yml:427,429`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.GITHUB_TOKEN`.
+- **apache/arrow-adbc** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/arrow-adbc** (`packaging.yml:170,225,334,526,592,665,785,968,1067`): [run_block_injection] 9 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.upload_artifacts`, `inputs.upload_artifacts`.
+- **apache/arrow-adbc** (`r-check.yml:77`): [run_block_injection] Workflow input `${{ inputs.pkg }}` directly interpolated in run block at step 'Bootstrap R Package' in workflow r-check.yml. Trusted committer input but should use env: block.
+- **apache/arrow-adbc** (`verify.yml:76,131,143`): [run_block_injection] 6 instances of direct interpolation in run blocks. Expressions: `inputs.rc`, `inputs.version`.
+- **apache/arrow-cookbook** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/arrow-dotnet** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/arrow-flight-sql-postgresql** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/arrow-go** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/arrow-java** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/arrow-js** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/arrow-julia** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/arrow-nanoarrow** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/arrow-nanoarrow** (`verify.yaml:117`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `inputs.rc`, `inputs.version`.
+- **apache/arrow-rs** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/arrow-rs-object-store** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/arrow-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/arrow-swift** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/artemis** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/artemis-console** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/artemis-console** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/artemis-examples** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/artemis-examples** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/artemis-native** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/artemis-native** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/atlas** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/atlas** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/attic** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/attic** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/attic** (`retire.yml:48,74,88`): [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.comment`, `github.event.inputs.processId`.
+- **apache/auron** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/auron** (`tpcds-reusable.yml:124,127,128,132,133,137,138,141,145,178,201,205,206,211,212,229,230,232,237,238,262,263,265,315,349,350,354,355,356,363,372,384,405,406,407`): [run_block_injection] 51 instances of direct interpolation in run blocks. Expressions: `inputs.celebornver`, `inputs.extrasparkconf`, `inputs.hadoop-profile`, `inputs.hadoopver`, `inputs.scalaver` +3 more.
+- **apache/auron-sites** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/auron-sites** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/avro** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/avro-rs** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/axis-axis1-java** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/axis-axis1-java** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/axis-axis2-c-core** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/axis-axis2-c-core** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/axis-axis2-java-core** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/axis-axis2-java-rampart** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/axis-axis2-java-rampart** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/beam** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/beam** (`.github/actions/build-push-docker-action/action.yml:37,41`): [composite_action_injection] 4 instances of direct interpolation in run blocks. Expressions: `inputs.build_context`, `inputs.dockerfile_path`, `inputs.image_name`, `inputs.image_tag`.
+- **apache/beam** (`.github/actions/dind-up-action/action.yml:112,113,114,115,116,117,118,119,120,121,122,124,129,130,148,180,181,182,183,196,197,218`): [composite_action_injection] 22 instances of direct interpolation in run blocks. Expressions: `inputs.additional-dockerd-args`, `inputs.bind-address || '127.0.0.1'`, `inputs.container-name || 'dind-daemon'`, `inputs.dind-image || 'docker:27-dind'`, `inputs.ephemeral-volumes` +11 more.
+- **apache/beam** (`.github/actions/gradle-command-self-hosted-action/action.yml:44,46`): [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.arguments`, `inputs.gradle-command`, `inputs.max-workers`.
+- **apache/beam** (`.github/actions/rerun-job-action/action.yml:49,51,59,61,63,66,87,89,98,100,103,109,111,122,123`): [composite_action_injection] 15 instances of direct interpolation in run blocks. Expressions: `inputs.github_current_run_id`, `inputs.github_job`, `inputs.github_repository`, `inputs.github_token`, `inputs.pull_request_url`.
+- **apache/beam** (`.github/actions/setup-action/action.yml:39`): [composite_action_injection] Workflow input `${{ inputs.comment_phrase }}` directly interpolated in run block at step 'Check if the phrase is correct' in composite action .github/actions/setup-action. Trusted committer input but should use env: block.
+- **apache/beam** (`.github/actions/setup-k8s-access/action.yml:48,56,61`): [composite_action_injection] 4 instances of direct interpolation in run blocks. Expressions: `inputs.cluster_name`, `inputs.cluster_zone`, `inputs.k8s_namespace`.
+- **apache/beam** (`.github/actions/test-arguments-action/action.yml:42,49,65,71,82,85,87`): [composite_action_injection] 7 instances of direct interpolation in run blocks. Expressions: `inputs.argument-file-paths`, `inputs.arguments`, `inputs.test-language`, `inputs.test-language == 'java'`, `inputs.test-language == 'python' || inputs.test-language == 'go'` +2 more.
+- **apache/beam** (`IO_Iceberg_Integration_Tests.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`IO_Iceberg_Integration_Tests_Dataflow.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`IO_Iceberg_Managed_Integration_Tests_Dataflow.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`IO_Iceberg_Performance_Tests.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`IO_Iceberg_Unit_Tests.yml:44`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_LoadTests_Java_CoGBK_Dataflow_Streaming.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_LoadTests_Java_GBK_Dataflow_Batch.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_LoadTests_Java_GBK_Dataflow_Streaming.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_LoadTests_Java_GBK_Dataflow_V2_Batch.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_LoadTests_Java_GBK_Dataflow_V2_Batch_Java17.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_LoadTests_Java_GBK_Dataflow_V2_Streaming.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_LoadTests_Java_GBK_Dataflow_V2_Streaming_Java17.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_LoadTests_Java_GBK_SparkStructuredStreaming_Batch.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_AvroIOIT.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_AvroIOIT_HDFS.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_BigQueryIO_Batch_Java_Avro.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_BigQueryIO_Batch_Java_Json.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_BigQueryIO_Streaming_Java.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_BiqQueryIO_Read_Python.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_BiqQueryIO_Write_Python_Batch.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_Cdap.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_Compressed_TextIOIT.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_Compressed_TextIOIT_HDFS.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_HadoopFormat.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_JDBC.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_Kafka_IO.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_ManyFiles_TextIOIT.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_ManyFiles_TextIOIT_HDFS.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_MongoDBIO_IT.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_ParquetIOIT.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_ParquetIOIT_HDFS.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_PubsubIOIT_Python_Streaming.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_SQLBigQueryIO_Batch_Java.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_SpannerIO_Read_2GB_Python.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_SpannerIO_Write_2GB_Python_Batch.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_SparkReceiver_IO.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_TFRecordIOIT.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_TFRecordIOIT_HDFS.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_TextIOIT.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_TextIOIT_HDFS.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_TextIOIT_Python.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_WordCountIT_PythonVersions.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_XmlIOIT.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PerformanceTests_XmlIOIT_HDFS.yml:24`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Avro_Versions.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_DataflowV1.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_DataflowV2.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow_ARM.yml:40`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow_Java.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow_V2.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow_V2_Java.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Direct.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Flink.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Spark.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Hadoop_Versions.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_IO_Performance_Tests.yml:28`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Dataflow.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Dataflow_Versions.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Direct.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Direct_Versions.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Flink_Java11.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Spark_Java11.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Dataflow.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Dataflow_V2.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Dataflow_V2_Java.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Direct.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Flink.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Spark.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Flink_Batch.yml:44`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Flink_Streaming.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Samza.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Spark3_Streaming.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Spark_Batch.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_JavaVersions.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_Engine.yml:32`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_TagEncodingV2.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_V2.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_V2_Streaming.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Direct.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Direct_JavaVersions.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Flink.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Flink_Java8.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Samza.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Spark.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_SparkStructuredStreaming.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Spark_Java8.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Twister2.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_ULR.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_PortableJar_Flink.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_PortableJar_Spark.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_Arm.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_Dependency.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_Examples_Dataflow.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_Examples_Direct.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_Examples_Flink.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_Examples_Spark.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_MongoDBIO_IT.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_Portable_Flink.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesContainer_Dataflow.yml:28`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesContainer_Dataflow_With_RC.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesRunner_Dataflow.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesRunner_Flink.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesRunner_Samza.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesRunner_Spark.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_Xlang_Gcp_Dataflow.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_Xlang_Gcp_Direct.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_Xlang_IO_Dataflow.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Python_Xlang_IO_Direct.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_SQL.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_TransformService_Direct.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_XVR_GoUsingJava_Dataflow.yml:29`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_XVR_PythonUsingJavaSQL_Dataflow.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_XVR_PythonUsingJava_Dataflow.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PostCommit_Yaml_Xlang_Direct.yml:26`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_ItFramework.yml:50`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java.yml:134`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Amazon-Web-Services2_IO_Direct.yml:56`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Amqp_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Azure_IO_Direct.yml:56`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Cassandra_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Cdap_IO_Direct.yml:42`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Clickhouse_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Csv_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Datadog_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Debezium_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_ElasticSearch_IO_Direct.yml:40`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Examples_Dataflow.yml:60`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Examples_Dataflow_Java21.yml:48`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_File-schema-transform_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Flink_Versions.yml:41`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_GCP_IO_Direct.yml:56`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Google-ads_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_HBase_IO_Direct.yml:40`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_HCatalog_IO_Direct.yml:40`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Hadoop_IO_Direct.yml:64`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_IOs_Direct.yml:42`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_InfluxDb_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_JDBC_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Jms_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Kafka_IO_Direct.yml:46`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Kudu_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_MongoDb_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Mqtt_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Neo4j_IO_Direct.yml:40`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_PVR_Flink_Batch.yml:49`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_PVR_Flink_Docker.yml:48`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_PVR_Prism_Loopback.yml:55`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Parquet_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Pulsar_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_RabbitMq_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Redis_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_RequestResponse_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_SingleStore_IO_Direct.yml:40`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Snowflake_IO_Direct.yml:42`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Solace_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Solr_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Spark3_Versions.yml:45`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Splunk_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Thrift_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Java_Tika_IO_Direct.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Python.yml:32`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Python_Coverage.yml:32`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Python_Dataframes.yml:32`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Python_Dill.yml:34`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Python_Examples.yml:32`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Python_Integration.yml:32`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Python_ML.yml:32`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Python_PVR_Flink.yml:52`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Python_Runners.yml:32`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Python_Transforms.yml:32`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_SQL.yml:38`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_SQL_Java17.yml:33`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_SQL_Java8.yml:43`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_PreCommit_Yaml_Xlang_Direct.yml:40`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`beam_Release_NightlySnapshot.yml:75,76`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.NEXUS_PW`, `secrets.NEXUS_USER`.
+- **apache/beam** (`build_release_candidate.yml:87,88,92,93,114,118,135,136,137,139,140,141,165,181,185,249,301,383,386,389,392,396,399,402,403,404,407,417,445,449,551,599,600,614`): [run_block_injection] 43 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.APACHE_ID`, `github.event.inputs.APACHE_PASSWORD`, `github.event.inputs.RC`, `github.event.inputs.RELEASE`, `secrets.NEXUS_PW` +3 more.
+- **apache/beam** (`deploy_release_candidate_pypi.yaml:64,70,71,86`): [run_block_injection] 4 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.PYPI_API_TOKEN`, `github.event.inputs.RC`.
+- **apache/beam** (`finalize_release.yml:128`): [run_block_injection] Workflow input `${{ github.event.inputs.PYPI_API_TOKEN }}` directly interpolated in run block at step 'Deploy to Pypi' in workflow finalize_release.yml. Trusted committer input but should use env: block.
+- **apache/beam** (`git_tag_released_version.yml:47,48,51,52`): [run_block_injection] 6 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.RC_TAG`, `github.event.inputs.VERSION_TAG`.
+- **apache/beam** (`pr-bot-pr-updates.yml`): [prt_checkout] pull_request_target trigger with checkout action using custom ref. Verify the ref does not resolve to untrusted PR code.
+- **apache/beam** (`run_rc_validation_go_wordcount.yml:21`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **apache/beam** (`run_rc_validation_java_mobile_gaming.yml:78`): [run_block_injection] Workflow input `${{ github.event.inputs.GCS_BUCKET }}` directly interpolated in run block at step 'Extract GCS Bucket Name' in workflow run_rc_validation_java_mobile_gaming.yml. Trusted committer input but should use env: block.
+- **apache/beam-starter-go** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/beam-starter-java** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/beam-starter-java-provider** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/beam-starter-kotlin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/beam-starter-python** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/beam-starter-typescript** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/bifromq** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/bifromq** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/bifromq** (`docker-publish.yml:35,37,39,40,42,51,52,56,57`): [run_block_injection] 10 instances of direct interpolation in run blocks. Expressions: `inputs.artifact_url`, `inputs.version`.
+- **apache/bifromq-sites** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/bifromq-sites** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/bigtop-manager** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/bigtop-manager** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/bookkeeper** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/bookkeeper** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/brpc** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/brpc** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/brpc-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/brpc-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/buildstream** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/buildstream** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/buildstream** (`release.yml:149`): [run_block_injection] Secret `${{ secrets.PYPI_TOKEN }}` directly interpolated in run block at step 'Upload to PyPI' in workflow release.yml. Trusted value but risks log leakage.
+- **apache/buildstream-plugins** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/buildstream-plugins** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/burr** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/burr** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/bval** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/calcite** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/calcite** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/calcite-avatica** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/calcite-avatica** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/calcite-avatica-go** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/calcite-avatica-go** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/camel** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel** (`check-container-versions.yml:63,66`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.check_prereleases`, `github.event.inputs.scan_path || 'test-infra'`.
+- **apache/camel** (`pr-build-main.yml:142`): [run_block_injection] Workflow input `${{ github.event.number || inputs.pr_number }}` directly interpolated in run block at step 'Save PR number and test comment for commenter workflow' in workflow pr-build-main.yml. Trusted committer input but should use env: block.
+- **apache/camel** (`security-scan.yml:45`): [run_block_injection] Secret `${{ secrets.NVD_API_KEY }}` directly interpolated in run block at step 'OWASP Dependency Check' in workflow security-scan.yml. Trusted value but risks log leakage.
+- **apache/camel-examples** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-examples** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/camel-jbang-examples** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-jbang-examples** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/camel-k** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-k** (`.github/actions/automatic-updates/action.yml:101`): [composite_action_injection] Workflow input `${{ inputs.branch-ref }}` directly interpolated in run block at step 'Push changes' in composite action .github/actions/automatic-updates. Trusted committer input but should use env: block.
+- **apache/camel-k** (`.github/actions/build/action.yml:55,61,62,83`): [composite_action_injection] 4 instances of direct interpolation in run blocks. Expressions: `inputs.artifact-name`.
+- **apache/camel-k** (`.github/actions/install-otlp-collector/action.yml:89`): [composite_action_injection] 2 instances of direct interpolation in run blocks. Expressions: `inputs.otlp-collector-image-name`, `inputs.otlp-collector-image-version`.
+- **apache/camel-k-runtime** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-k-runtime** (`.github/actions/automatic-updates/action.yml:88`): [composite_action_injection] Workflow input `${{ inputs.branch-ref }}` directly interpolated in run block at step 'Push changes' in composite action .github/actions/automatic-updates. Trusted committer input but should use env: block.
+- **apache/camel-kafka-connector** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-kameleon** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-kameleon** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/camel-kameleon** (`main.yml:45`): [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Build application' in workflow main.yml. Trusted value but risks log leakage.
+- **apache/camel-kamelets** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-karaf** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-karaf** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/camel-karavan** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-karavan** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/camel-karavan** (`app.yml:58`): [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Build application' in workflow app.yml. Trusted value but risks log leakage.
+- **apache/camel-karavan** (`docker-devmode.yml:34`): [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Log in to the Container registry' in workflow docker-devmode.yml. Trusted value but risks log leakage.
+- **apache/camel-performance-tests** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-performance-tests** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/camel-quarkus** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-quarkus** (`camel-master-cron.yaml:137,226,324,379,490,579,616`): [run_block_injection] 7 instances of direct interpolation in run blocks. Expressions: `secrets.GITHUB_TOKEN`.
+- **apache/camel-quarkus** (`check-dependency-convergence.yml:182`): [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Report Build Status' in workflow check-dependency-convergence.yml. Trusted value but risks log leakage.
+- **apache/camel-quarkus** (`quarkus-lts-ci-build.yaml:62,74,120,140,220,315,363,418,480`): [run_block_injection] 9 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.branch`.
+- **apache/camel-quarkus** (`quarkus-master-cron.yaml:138,227,325,380,491,580,617`): [run_block_injection] 7 instances of direct interpolation in run blocks. Expressions: `secrets.GITHUB_TOKEN`.
+- **apache/camel-quarkus-examples** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-spring-boot** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-spring-boot-examples** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-spring-boot-examples** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/camel-upgrade-recipes** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-upgrade-recipes** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/camel-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/camel-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/carbondata** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/carbondata** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-3rd-party-casbin-pg-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-3rd-party-casbin-pg-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-Casbin.NET** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-Casbin.NET** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-Casbin.NET-dotnet-cli** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-Casbin.NET-dotnet-cli** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-Casbin.NET-ef-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-Casbin.NET-ef-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-Casbin.NET-redis-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-Casbin.NET-redis-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-Casbin.NET-redis-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-Casbin.NET-redis-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-SwiftCasbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-SwiftCasbin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-actix-casbin-auth** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-actix-casbin-auth** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-actix-casbin-auth** (`release.yml:25`): [run_block_injection] Secret `${{ secrets.CARGO_TOKEN }}` directly interpolated in run block at step 'Cargo Login' in workflow release.yml. Trusted value but risks log leakage.
+- **apache/casbin-admission-webhook** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-admission-webhook** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-aspnetcore** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-aspnetcore** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-axum-casbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-axum-casbin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-axum-casbin** (`release.yml:25`): [run_block_injection] Secret `${{ secrets.CARGO_TOKEN }}` directly interpolated in run block at step 'Cargo Login' in workflow release.yml. Trusted value but risks log leakage.
+- **apache/casbin-beego-orm-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-beego-orm-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-casbin.js** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-casbin.js** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-confita** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-confita** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-core** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-core** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-cpp** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-cpp** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-cpp-Cvaluate** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-cpp-Cvaluate** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-cpp-casbin-CMake-setup** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-cpp-casbin-CMake-setup** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-cpp-sqlpp11-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-cpp-sqlpp11-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-crd-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-crd-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-dart-casbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-dart-casbin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-dart-casbin** (`dart.yml:68`): [run_block_injection] Secret `${{ secrets.PUB_CREDENTIALS }}` directly interpolated in run block at step 'Setup Pub Credentials' in workflow dart.yml. Trusted value but risks log leakage.
+- **apache/casbin-docker-plugin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-docker-plugin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-docker_auth** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-docker_auth** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-editor** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-editor** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-efcore-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-efcore-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-ent-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-ent-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-etcd-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-etcd-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-ex** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-ex** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-express-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-express-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-fasthttp-auth** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-fasthttp-auth** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-gateway** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-gateway** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-go-cli** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-go-cli** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-go-client** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-go-client** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-gorm-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-gorm-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-gorm-adapter-ex** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-gorm-adapter-ex** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-govaluate** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-govaluate** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-hraft-dispatcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-hraft-dispatcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-informer-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-informer-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-dynamodb-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-dynamodb-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-hibernate-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-hibernate-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-java-cli** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-java-cli** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-jdbc-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-jdbc-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-jfinal-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-jfinal-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-kafka-casbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-kafka-casbin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-kafka-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-kafka-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-lettuce-redis-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-lettuce-redis-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-menu-permission** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-menu-permission** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-mongo-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-mongo-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-mybatis-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-mybatis-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-mybatisplus-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-mybatisplus-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-nutz-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-nutz-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-play-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-play-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-postgres-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-postgres-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-pulsar-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-pulsar-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-rabbitmq-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-rabbitmq-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-redis-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-redis-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-redis-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-redis-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-redis-watcher-ex** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-redis-watcher-ex** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-shiro-casbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-shiro-casbin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-spring-security-starter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-spring-security-starter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-string-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-string-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-vertx-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-vertx-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-jcasbin-zookeeper-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-jcasbin-zookeeper-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-js-vue-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-js-vue-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-json-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-json-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-k8s-gatekeeper** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-k8s-gatekeeper** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-kubesphere-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-kubesphere-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-laravel-rbac** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-laravel-rbac** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-ldap-role-manager** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-ldap-role-manager** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-lego** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-lego** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-lua-4daysorm-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-lua-4daysorm-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-lua-apisix-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-lua-apisix-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-lua-casbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-lua-casbin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-lua-casbin** (`release.yml:48`): [run_block_injection] Secret `${{ secrets.LUAROCKS_API_KEY }}` directly interpolated in run block at step 'Upload' in workflow release.yml. Trusted value but risks log leakage.
+- **apache/casbin-lua-kong-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-lua-kong-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-lua-luasql-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-lua-luasql-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-mcp-gateway** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-mcp-gateway** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-mesh** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-mesh** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-mongodb-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-mongodb-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-nest-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-basic-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-basic-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-couchdb-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-couchdb-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-drizzle-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-drizzle-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-etcd-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-etcd-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-examples** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-examples** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-expression-eval** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-expression-eval** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-file-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-file-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-graphql-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-graphql-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-mongo-changestream-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-mongo-changestream-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-mongoose-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-mongoose-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-node-pubsub-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-node-pubsub-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-node-redis-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-node-redis-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-prisma-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-prisma-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-redis-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-redis-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-session-role-manager** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-node-casbin-session-role-manager** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-node-casbin-session-role-manager** (`release.yml:8`): [broad_permissions] Requests write access to 4 scopes: contents, issues, pull-requests, id-token.
+- **apache/casbin-okta-role-manager** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-okta-role-manager** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-opentelemetry-logger** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-opentelemetry-logger** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-pg-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-pg-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-policyguard** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-policyguard** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-prometheus-logger** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-prometheus-logger** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-pycasbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-pycasbin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-async-django-orm-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-async-django-orm-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-async-postgres-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-async-postgres-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-async-sqlalchemy-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-async-sqlalchemy-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-casbin-databases-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-casbin-databases-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-cli** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-cli** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-django-casbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-django-casbin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-django-casbin-auth** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-django-casbin-auth** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-django-orm-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-django-orm-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-etcd-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-etcd-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-fastapi-casbin-auth** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-fastapi-casbin-auth** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-flask-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-flask-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-graphql-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-graphql-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-postgresql-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-postgresql-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-pymongo-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-pymongo-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-rabbitmq-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-rabbitmq-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-redis-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-redis-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-redis-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-redis-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-sanic-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-sanic-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-sqlalchemy-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-sqlalchemy-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-python-sqlobject-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-python-sqlobject-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-raft** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-raft** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-redis-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-redis-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-redis-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-redis-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rs** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rs** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rs** (`changelog.yml:23`): [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Gen changelog' in workflow changelog.yml. Trusted value but risks log leakage.
+- **apache/casbin-rust-actix-casbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-actix-casbin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-actix-casbin** (`release.yml:25`): [run_block_injection] Secret `${{ secrets.CARGO_TOKEN }}` directly interpolated in run block at step 'Cargo Login' in workflow release.yml. Trusted value but risks log leakage.
+- **apache/casbin-rust-actix-file-adapter-rbac** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-actix-file-adapter-rbac** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-actix-middleware-example** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-actix-middleware-example** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-actix-postgresql-simple** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-actix-postgresql-simple** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-axum-middleware-example** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-axum-middleware-example** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-casbin-grpc** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-casbin-grpc** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-casbin-rust-cli** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-casbin-rust-cli** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-diesel-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-diesel-adapter** (`release.yml:27`): [run_block_injection] Secret `${{ secrets.CARGO_TOKEN }}` directly interpolated in run block at step 'Cargo Login' in workflow release.yml. Trusted value but risks log leakage.
+- **apache/casbin-rust-dufs-with-casbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-json-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-json-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-ntex-file-adapter-acl** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-ntex-file-adapter-acl** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-poem-casbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-poem-casbin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-poem-todo** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-poem-todo** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-postgres-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-redis-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-redis-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-rocket-authz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-rocket-authz** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-salvo-casbin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-salvo-casbin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-semantic-release-action-rust** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-string-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-string-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-string-adapter** (`release.yml:25`): [run_block_injection] Secret `${{ secrets.CARGO_TOKEN }}` directly interpolated in run block at step 'Cargo Login' in workflow release.yml. Trusted value but risks log leakage.
+- **apache/casbin-rust-yaml-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-rust-yaml-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-rust-yaml-adapter** (`release.yml:25`): [run_block_injection] Secret `${{ secrets.CARGO_TOKEN }}` directly interpolated in run block at step 'Cargo Login' in workflow release.yml. Trusted value but risks log leakage.
+- **apache/casbin-sequelize-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-sequelize-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-server** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-server** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-spring-boot-starter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-spring-boot-starter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-sqlx-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-sqlx-adapter** (`release.yml:25`): [run_block_injection] Secret `${{ secrets.CARGO_TOKEN }}` directly interpolated in run block at step 'Cargo Login' in workflow release.yml. Trusted value but risks log leakage.
+- **apache/casbin-tikv-watcher** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-tikv-watcher** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-typeorm-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-typeorm-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-ucon** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-ucon** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-vscode-plugin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-vscode-plugin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-website-v1-deprecated** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-website-v1-deprecated** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-website-v3** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-website-v3** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-website-v3** (`release.yml:13`): [broad_permissions] Requests write access to 4 scopes: contents, issues, pull-requests, id-token.
+- **apache/casbin-xorm-adapter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-xorm-adapter** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/casbin-zap-logger** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/casbin-zap-logger** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cassandra** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cassandra** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cassandra-analytics** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cassandra-analytics** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cassandra-builds** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cassandra-builds** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cassandra-ccm** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cassandra-ccm** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cassandra-diff** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cassandra-diff** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cassandra-easy-stress** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cassandra-gocql-driver** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cassandra-gocql-driver** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cassandra-sidecar** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cassandra-sidecar** (`publish-test-artifacts.yml:91`): [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Build and push Docker image (latest tag)' in workflow publish-test-artifacts.yml. Trusted value but risks log leakage.
+- **apache/cassandra-spark-connector** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cassandra-spark-connector** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cassandra-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cassandra-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/causeway** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cayenne** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cayenne** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/celeborn** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/celeborn** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/celeborn** (`docker-build.yml:25`): [run_block_injection] Workflow input `${{ github.event.inputs.celeborn_version }}` directly interpolated in run block at step 'Set Celeborn Version' in workflow docker-build.yml. Trusted committer input but should use env: block.
+- **apache/celeborn-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/celeborn-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/celix** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/celix** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cloudberry** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cloudberry** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cloudberry** (`build-cloudberry-rocky8.yml:226,376`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.test_selection`.
+- **apache/cloudberry** (`build-cloudberry.yml:219,371`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.test_selection`.
+- **apache/cloudberry** (`build-dbg-cloudberry.yml:214,250`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.test_selection`.
+- **apache/cloudberry** (`build-deb-cloudberry.yml:187,287`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.test_selection`.
+- **apache/cloudberry** (`coverity.yml:77,123`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.COVERITY_SCAN_TOKEN`.
+- **apache/cloudberry-backup** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cloudberry-backup** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cloudberry-go-libs** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cloudberry-go-libs** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cloudberry-pxf** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cloudberry-pxf** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cloudberry-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cloudberry-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cloudstack** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cloudstack** (`docker-cloudstack-simulator.yml:59`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.DOCKER_REGISTRY`.
+- **apache/cloudstack-cloudmonkey** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cloudstack-cloudmonkey** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cloudstack-csbench** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cloudstack-csbench** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cloudstack-documentation** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cloudstack-documentation** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cloudstack-go** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cloudstack-go** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cloudstack-kubernetes-provider** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cloudstack-kubernetes-provider** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cloudstack-kubernetes-provider** (`build-docker-image.yml:51`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.DOCKER_REGISTRY`.
+- **apache/cloudstack-terraform-provider** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cloudstack-www** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cloudstack-www** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/comdev-events-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/comdev-events-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/commons-bcel** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-beanutils** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-bsf** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-build-plugin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-chain** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-chain** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/commons-cli** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-codec** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-collections** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-compress** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-configuration** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-crypto** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-csv** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-daemon** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-dbcp** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-dbutils** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-digester** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-email** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-exec** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-fileupload** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-geometry** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-graph** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-imaging** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-io** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-jci** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-jcs** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-jelly** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-jexl** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-jxpath** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-lang** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-logging** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-math** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-net** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-numbers** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-ognl** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-ognl** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/commons-parent** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-pool** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-rdf** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-release-plugin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-rng** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-scxml** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-skin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-statistics** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-text** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-validator** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-vfs** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/commons-weaver** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-android** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-android** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-app-hello-world** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-app-hello-world** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-browser** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-browser** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-cli** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-cli** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-coho** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-coho** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-coho** (`nightly.yml:56,57,79`): [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.dispatchReason`, `github.event.inputs.verbose`, `github.event.inputs.verbose == 'true'`.
+- **apache/cordova-common** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-common** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-create** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-create** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-docs** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-docs** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-electron** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-electron** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-eslint** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-eslint** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-fetch** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-fetch** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-ios** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-ios** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-js** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-js** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-lib** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-lib** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-mobile-spec** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-mobile-spec** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-node-xcode** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-node-xcode** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-paramedic** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-paramedic** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-battery-status** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-battery-status** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-camera** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-camera** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-device** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-device** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-device-motion** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-device-motion** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-device-orientation** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-device-orientation** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-dialogs** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-dialogs** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-file** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-file** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-file-transfer** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-file-transfer** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-geolocation** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-geolocation** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-inappbrowser** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-inappbrowser** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-media** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-media** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-media-capture** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-media-capture** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-network-information** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-network-information** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-screen-orientation** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-screen-orientation** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-splashscreen** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-splashscreen** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-statusbar** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-statusbar** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-test-framework** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-test-framework** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugin-vibration** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugin-vibration** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-plugman** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-plugman** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cordova-serve** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cordova-serve** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/couchdb-ci** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/couchdb-ci** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/couchdb-erlfdb** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/couchdb-erlfdb** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/couchdb-erlfdb** (`ci.yml:185`): [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Finalize Coveralls report' in workflow ci.yml. Trusted value but risks log leakage.
+- **apache/couchdb-fast-pbkdf2** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/couchdb-fast-pbkdf2** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/couchdb-fauxton** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/couchdb-fauxton** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/couchdb-helm** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/couchdb-jiffy** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/couchdb-jiffy** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/couchdb-meck** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/couchdb-meck** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/couchdb-mochiweb** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/couchdb-mochiweb** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/couchdb-nano** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/couchdb-nano** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/couchdb-recon** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/couchdb-recon** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/creadur-rat** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/creadur-tentacles** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/creadur-whisker** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/ctakes-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/ctakes-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/curator** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/curator** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/curator-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/curator-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/cxf** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cxf-build-utils** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cxf-fediz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/cxf-xjc-utils** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/daffodil** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/daffodil-infrastructure** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/daffodil-infrastructure** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/daffodil-sbt** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/daffodil-sbt** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/daffodil-schema.g8** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/daffodil-schema.g8** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/daffodil-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/daffodil-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/daffodil-site** (`update-docs.yml:74,139`): [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.project`, `inputs.version`.
+- **apache/daffodil-vscode** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datafu** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datafu** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datafusion** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datafusion** (`.github/actions/setup-builder/action.yml:39,40,41`): [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.rust-version`.
+- **apache/datafusion-ballista** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datafusion-ballista** (`.github/actions/setup-builder/action.yml:36,37,38`): [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.rust-version`.
+- **apache/datafusion-ballista-python** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datafusion-ballista-python** (`.github/actions/setup-builder/action.yml:36,37,38`): [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.rust-version`.
+- **apache/datafusion-benchmarks** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datafusion-benchmarks** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datafusion-comet** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datafusion-comet** (`.github/actions/java-test/action.yml:79,88,90`): [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.maven_opts`, `inputs.suites`.
+- **apache/datafusion-comet** (`.github/actions/setup-builder/action.yml:55,56,57`): [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.rust-version`.
+- **apache/datafusion-comet** (`.github/actions/setup-iceberg-builder/action.yml:39`): [composite_action_injection] Workflow input `${{ inputs.iceberg-version }}` directly interpolated in run block at step 'Setup Iceberg for Comet' in composite action .github/actions/setup-iceberg-builder. Trusted committer input but should use env: block.
+- **apache/datafusion-comet** (`.github/actions/setup-macos-builder/action.yml:47,77,78,79`): [composite_action_injection] 4 instances of direct interpolation in run blocks. Expressions: `inputs.protoc-architecture`, `inputs.rust-version`.
+- **apache/datafusion-comet** (`.github/actions/setup-spark-builder/action.yml:46,62,69`): [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.spark-short-version`, `inputs.spark-version`.
+- **apache/datafusion-comet** (`spark_sql_test.yml:161,163`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.collect-fallback-logs`, `github.event.inputs.collect-fallback-logs || 'false'`.
+- **apache/datafusion-python** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datafusion-python** (`verify-release-candidate.yml:83`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `inputs.rc_number`, `inputs.version`.
+- **apache/datafusion-ray** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datafusion-ray** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datafusion-sandbox** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datafusion-sandbox** (`.github/actions/setup-builder/action.yml:39,40,41`): [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.rust-version`.
+- **apache/datafusion-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datafusion-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datafusion-sqlparser-rs** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datafusion-sqlparser-rs** (`.github/actions/setup-builder/action.yml:35,36,37,39,41`): [composite_action_injection] 6 instances of direct interpolation in run blocks. Expressions: `inputs.rust-version`, `inputs.targets`.
+- **apache/datafusion-testing** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datafusion-testing** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datasketches-cpp** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datasketches-cpp** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datasketches-go** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datasketches-go** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datasketches-hive** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datasketches-hive** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datasketches-java** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datasketches-java** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datasketches-java** (`javadoc.yml:100`): [run_block_injection] Workflow input `${{ github.event.inputs.tag_ref }}` directly interpolated in run block at step 'Confirm Deployment' in workflow javadoc.yml. Trusted committer input but should use env: block.
+- **apache/datasketches-memory** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datasketches-memory** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datasketches-memory** (`javadoc.yml:100`): [run_block_injection] Workflow input `${{ github.event.inputs.tag_ref }}` directly interpolated in run block at step 'Confirm Deployment' in workflow javadoc.yml. Trusted committer input but should use env: block.
+- **apache/datasketches-memory16** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datasketches-memory16** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datasketches-memory17** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datasketches-memory17** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datasketches-pig** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datasketches-pig** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datasketches-postgresql** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datasketches-postgresql** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datasketches-python** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datasketches-python** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datasketches-rust** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datasketches-rust** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datasketches-spark** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datasketches-spark** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/datasketches-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/datasketches-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/db-jdo** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/db-jdo** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/db-jdo-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/db-jdo-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/db-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/db-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/deltaspike** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/deltaspike** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/directory-kerby** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/directory-ldap-api** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/directory-scimple** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/directory-scimple** (`maven.yml:58,65,71,74`): [run_block_injection] 4 instances of direct interpolation in run blocks. Expressions: `inputs.jobs_path`, `inputs.mvn`, `inputs.name`, `secrets.GITHUB_TOKEN`.
+- **apache/directory-server** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/directory-studio** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dolphinscheduler** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dolphinscheduler** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dolphinscheduler** (`publish-docker.yaml:50,51,56,57`): [run_block_injection] 4 instances of direct interpolation in run blocks. Expressions: `secrets.DOCKERHUB_TOKEN`, `secrets.DOCKERHUB_USER`.
+- **apache/dolphinscheduler** (`publish-helm-chart.yaml:44,45,50`): [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `secrets.DOCKERHUB_TOKEN`, `secrets.DOCKERHUB_USER`, `secrets.GITHUB_TOKEN`.
+- **apache/dolphinscheduler-operator** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dolphinscheduler-operator** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dolphinscheduler-sdk-python** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dolphinscheduler-sdk-python** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dolphinscheduler-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dolphinscheduler-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/doris** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/doris** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/doris** (`comment-to-trigger-teamcity.yml:47,48`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.GITHUB_TOKEN`.
+- **apache/doris** (`opencode-review-runner.yml:149`): [run_block_injection] Workflow input `${{ inputs.pr_number }}` directly interpolated in run block at step 'Comment PR on review failure' in workflow opencode-review-runner.yml. Trusted committer input but should use env: block.
+- **apache/doris** (`pr-approve-status.yml:41`): [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Run Python script' in workflow pr-approve-status.yml. Trusted value but risks log leakage.
+- **apache/doris-flink-connector** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/doris-flink-connector** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/doris-kafka-connector** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/doris-kafka-connector** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/doris-opentelemetry-demo** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/doris-opentelemetry-demo** (`component-build-images.yml:155`): [run_block_injection] Workflow input `${{ inputs.push }}` directly interpolated in run block at step 'Check for changes and set push options' in workflow component-build-images.yml. Trusted committer input but should use env: block.
+- **apache/doris-opentelemetry-demo** (`dependabot-auto-update-protobuf-diff.yml:8`): [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, contents, packages.
+- **apache/doris-operator** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/doris-operator** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/doris-sdk** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/doris-sdk** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/doris-shade** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/doris-shade** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/doris-spark-connector** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/doris-spark-connector** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/doris-streamloader** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/doris-streamloader** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/doris-thirdparty** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/doris-thirdparty** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/doris-thirdparty** (`manual-build.yml:57`): [run_block_injection] Workflow input `${{ inputs.doris_ref }}` directly interpolated in run block at step 'Update Release Note' in workflow manual-build.yml. Trusted committer input but should use env: block.
+- **apache/doris-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/doris-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/doris-website** (`approve-check.yml:41`): [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Run Python script' in workflow approve-check.yml. Trusted value but risks log leakage.
+- **apache/doris-website** (`manual-i18n-translate-workflow.yaml:48,49,56,64,138`): [run_block_injection] 5 instances of direct interpolation in run blocks. Expressions: `inputs.file_glob`, `inputs.source_dir`, `inputs.target_dir`.
+- **apache/drill** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/drill** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/druid** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/druid** (`worker.yml:85,86,90`): [run_block_injection] 4 instances of direct interpolation in run blocks. Expressions: `inputs.jdk`, `inputs.key`, `inputs.script`.
+- **apache/druid-operator** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/druid-operator** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-admin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-admin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-awesome** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-awesome** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-benchmark** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-benchmark** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-getty** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-getty** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-go** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-go-contrib** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-go-contrib** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-go-extensions** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-go-hessian2** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-go-hessian2** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-go-hessian2** (`github-actions.yml:107`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.DING_SIGN`, `secrets.DING_TOKEN`.
+- **apache/dubbo-go-pixiu** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-go-pixiu** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-go-pixiu** (`sync-to-upstream.yml`): [prt_checkout] pull_request_target trigger with checkout action using custom ref. Verify the ref does not resolve to untrusted PR code.
+- **apache/dubbo-go-pixiu-samples** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-go-pixiu-samples** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-go-pixiu-samples** (`sync-to-upstream.yml`): [prt_checkout] pull_request_target trigger with checkout action using custom ref. Verify the ref does not resolve to untrusted PR code.
+- **apache/dubbo-go-samples** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-hessian-lite** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-hessian-lite** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-initializer** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-initializer** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-integration-cases** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-integration-cases** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-js** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-js** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-kubernetes** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-kubernetes** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-python** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-python** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-rust** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-rust** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-samples** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-samples** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-spi-extensions** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-spi-samples** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-spi-samples** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-spring-boot-project** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-spring-boot-project** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-test-tools** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-test-tools** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/dubbo-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/dubbo-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/echarts** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/echarts** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/echarts** (`teardown-pr-preview.yml:30`): [run_block_injection] Secret `${{ secrets.SURGE_TOKEN }}` directly interpolated in run block at step 'Teardown closed PR preview' in workflow teardown-pr-preview.yml. Trusted value but risks log leakage.
+- **apache/echarts-bot** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/echarts-bot** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/echarts-doc** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/echarts-doc** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/echarts-examples** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/echarts-examples** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/echarts-handbook** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/echarts-handbook** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/echarts-theme-builder** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/echarts-theme-builder** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/echarts-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/echarts-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/eventmesh** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/eventmesh-catalog** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/eventmesh-catalog** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/eventmesh-dashboard** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/eventmesh-go** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/eventmesh-go** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/eventmesh-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/eventmesh-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/eventmesh-workflow** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/eventmesh-workflow** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/felix-atomos** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/felix-atomos** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/felix-dev** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/fesod** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/fineract** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/fineract** (`pr-title-check.yml:18`): [run_block_injection] Untrusted input `${{ github.event.pull_request.title }}` interpolated in run block at step 'Verify Title Format' in workflow pr-title-check.yml. Trigger is `pull_request` (not `pull_request_target`), so fork PRs do not have access to secrets. Same-repo PRs are from committers. Shell injection possible but low impact.
+- **apache/fineract** (`publish-dockerhub.yml:44,45`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.DOCKERHUB_TOKEN`, `secrets.DOCKERHUB_USER`.
+- **apache/fineract-backoffice-ui** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/fineract-chat-archive** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/fineract-chat-archive** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/fineract-credit-scorecard** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/fineract-credit-scorecard** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/fineract-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/fineract-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flagon** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flex-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flex-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink** (`.github/actions/job_init/action.yml:74,75,89,93,94,95,96`): [composite_action_injection] 7 instances of direct interpolation in run blocks. Expressions: `inputs.jdk_version`, `inputs.source_directory`, `inputs.target_directory`.
+- **apache/flink** (`.github/actions/run_mvn/action.yml:41,42`): [composite_action_injection] 2 instances of direct interpolation in run blocks. Expressions: `inputs.env`, `inputs.maven-parameters`.
+- **apache/flink** (`.github/actions/stringify/action.yml:41`): [composite_action_injection] Workflow input `${{ inputs.value }}` directly interpolated in run block at step 'Stringify '${{ inputs.value }}' in composite action .github/actions/stringify. Trusted committer input but should use env: block.
+- **apache/flink** (`docs-legacy.yml:56`): [run_block_injection] Workflow input `${{ inputs.branch }}` directly interpolated in run block at step 'Set branch environment variable' in workflow docs-legacy.yml. Trusted committer input but should use env: block.
+- **apache/flink** (`template.flink-ci.yml:164,259,400`): [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.environment`.
+- **apache/flink-agents** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-agents** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-benchmarks** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-benchmarks** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-cdc** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-cdc** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-cdc** (`flink_cdc_base.yml:109,111`): [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.custom-maven-parameter`, `inputs.parallelism`.
+- **apache/flink-connector-aws** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-aws** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-aws** (`common.yml:98,107,117,118,132,133`): [run_block_injection] 6 instances of direct interpolation in run blocks. Expressions: `inputs.flink_url`, `inputs.flink_version`.
+- **apache/flink-connector-cassandra** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-cassandra** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-elasticsearch** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-elasticsearch** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-gcp-pubsub** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-gcp-pubsub** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-hbase** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-hbase** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-hive** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-hive** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-http** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-http** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-jdbc** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-jdbc** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-kafka** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-kafka** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-kudu** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-kudu** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-mongodb** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-mongodb** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-opensearch** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-opensearch** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-prometheus** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-prometheus** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-prometheus** (`common.yml:95,104`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `inputs.flink_url`, `inputs.flink_version`.
+- **apache/flink-connector-pulsar** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-pulsar** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-rabbitmq** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-rabbitmq** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-connector-redis-streams** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-connector-redis-streams** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-docker** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-docker** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-jira-bot** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-jira-bot** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-kubernetes-operator** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-kubernetes-operator** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-kubernetes-operator** (`.github/actions/rsync-deployments/action.yml:38,41,44,45,48`): [composite_action_injection] 7 instances of direct interpolation in run blocks. Expressions: `inputs.path`, `inputs.remote_host`, `inputs.remote_key`, `inputs.remote_path`, `inputs.remote_port` +2 more.
+- **apache/flink-kubernetes-operator** (`docker_push.yml:61`): [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Log in to the Container registry' in workflow docker_push.yml. Trusted value but risks log leakage.
+- **apache/flink-kubernetes-operator** (`e2e.yaml:60,61,69,73,78,81,82,83,86,87,88,92,94,102,103,107,111`): [run_block_injection] 17 instances of direct interpolation in run blocks. Expressions: `inputs.append-java-version`, `inputs.flink-version`, `inputs.http-client`, `inputs.java-version`, `inputs.mode` +2 more.
+- **apache/flink-ml** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-ml** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-shaded** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-shaded** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-statefun** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-statefun** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/flink-training** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/flink-training** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/fluss** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/fluss** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/fluss** (`ci-template.yaml:55,62`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `inputs.maven-parameters`.
+- **apache/fluss** (`docs-deploy.yaml:39`): [run_block_injection] Secret `${{ secrets.GH_TOKEN }}` directly interpolated in run block at step 'Send Event to Trigger Deploy' in workflow docs-deploy.yaml. Trusted value but risks log leakage.
+- **apache/fluss-blog** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/fluss-blog** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/fluss-blog** (`blog-deploy.yaml:37`): [run_block_injection] Secret `${{ secrets.GH_TOKEN }}` directly interpolated in run block at step 'Send Event to Trigger Deploy' in workflow blog-deploy.yaml. Trusted value but risks log leakage.
+- **apache/fluss-rust** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/fluss-shaded** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/fluss-shaded** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/fluss-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/fluss-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/fory** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/fory** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/fory-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/fory-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/freemarker** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/freemarker** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/geaflow** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/geaflow** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/geaflow-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/geaflow-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/geode** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/geode** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/geode-benchmarks** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/geode-benchmarks** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/geode-examples** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/geode-examples** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/geode-kafka-connector** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/geode-kafka-connector** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/geode-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/geode-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/geronimo-arthur** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/geronimo-arthur** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/geronimo-batchee** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/geronimo-mail** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/geronimo-mail** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/geronimo-txmanager** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/geronimo-txmanager** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/gluten** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/gluten** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/gluten** (`build_bundle_package.yml:105`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.hadoop`, `github.event.inputs.spark`.
+- **apache/gobblin** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/gobblin** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/gora** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/gora** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/grails-core** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/grails-core** (`forge-deploy-next.yml:96,99,102,155`): [run_block_injection] 8 instances of direct interpolation in run blocks. Expressions: `secrets.GCLOUD_EMAIL`, `secrets.GCP_PROJECT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_SECRET`, `secrets.GH_REDIRECT_URL` +1 more.
+- **apache/grails-core** (`forge-deploy-prev-snapshot.yml:96,99,102,155`): [run_block_injection] 8 instances of direct interpolation in run blocks. Expressions: `secrets.GCLOUD_EMAIL`, `secrets.GCP_PROJECT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_SECRET`, `secrets.GH_REDIRECT_URL` +1 more.
+- **apache/grails-core** (`forge-deploy-prev.yml:96,99,102,155`): [run_block_injection] 8 instances of direct interpolation in run blocks. Expressions: `secrets.GCLOUD_EMAIL`, `secrets.GCP_PROJECT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_SECRET`, `secrets.GH_REDIRECT_URL` +1 more.
+- **apache/grails-core** (`forge-deploy-release.yml:104,106,163,165`): [run_block_injection] 16 instances of direct interpolation in run blocks. Expressions: `secrets.GCLOUD_EMAIL`, `secrets.GCP_PROJECT_ID`, `secrets.GH_OAUTH_LATEST_CLIENT_ID`, `secrets.GH_OAUTH_LATEST_CLIENT_SECRET`, `secrets.GH_REDIRECT_URL` +1 more.
+- **apache/grails-core** (`forge-deploy-snapshot.yml:94,97,100,151`): [run_block_injection] 8 instances of direct interpolation in run blocks. Expressions: `secrets.GCLOUD_EMAIL`, `secrets.GCP_PROJECT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_SECRET`, `secrets.GH_REDIRECT_URL` +1 more.
+- **apache/grails-core** (`release-abort.yml:43,55`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.release_tag`, `secrets.STAGING_PROFILE_ID`.
+- **apache/grails-core** (`release.yml:96,121,301`): [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `secrets.GPG_KEY_ID`.
+- **apache/grails-forge-ui** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/grails-github-actions** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/grails-github-actions** (`release.yml:89`): [run_block_injection] Secret `${{ secrets.GRAILS_GPG_KEY }}` directly interpolated in run block at step '🔐 Set up GPG' in workflow release.yml. Trusted value but risks log leakage.
+- **apache/grails-gradle-publish** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/grails-gradle-publish** (`release-abort.yml:43,55`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.release_tag`, `secrets.STAGING_PROFILE_ID`.
+- **apache/grails-gradle-publish** (`release.yaml:189`): [run_block_injection] Secret `${{ secrets.GPG_KEY_ID }}` directly interpolated in run block at step '🔏 Sign source distribution ZIP' in workflow release.yaml. Trusted value but risks log leakage.
+- **apache/grails-plugins-metadata** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/grails-plugins-metadata** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/grails-quartz** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/grails-quartz** (`release-abort.yml:43,55`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.release_tag`, `secrets.STAGING_PROFILE_ID`.
+- **apache/grails-quartz** (`release.yml:59,179`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.GRAILS_GPG_KEY`.
+- **apache/grails-redis** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/grails-redis** (`release-abort.yml:43,55`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.release_tag`, `secrets.STAGING_PROFILE_ID`.
+- **apache/grails-redis** (`release.yml:58,178`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.GRAILS_GPG_KEY`.
+- **apache/grails-spring-security** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/grails-spring-security** (`release-abort.yml:43,55`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.release_tag`, `secrets.STAGING_PROFILE_ID`.
+- **apache/grails-spring-security** (`release.yml:64,184`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.GRAILS_GPG_KEY`.
+- **apache/grails-static-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/grails-static-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/grails-static-website** (`release.yml:20`): [run_block_injection] Workflow input `${{ github.event.inputs.grails_version }}` directly interpolated in run block at step 'Run Release Script' in workflow release.yml. Trusted committer input but should use env: block.
+- **apache/gravitino** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/gravitino** (`backend-integration-test-action.yml:70,81`): [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.backend`, `inputs.changed-catalogs-contrib-modules`, `inputs.test-mode`.
+- **apache/gravitino** (`chart-release.yaml:52,57,69,70,76,77,83,84`): [run_block_injection] 9 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.charts`, `github.event.inputs.username`, `github.event.inputs.version`, `secrets.DOCKER_REPOSITORY_PASSWORD`.
+- **apache/gravitino** (`cherry-pick-branch.yml:64,67,68,72,83,131`): [run_block_injection] 7 instances of direct interpolation in run blocks. Expressions: `inputs.commit-sha`, `inputs.target-branch`.
+- **apache/gravitino** (`docker-image.yml:57,59,61,63,65,67,69,71,73,75,77,79,80,81,83,85,87,89,91,93,95,96,98,99,101,104,142,144`): [run_block_injection] 28 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.docker_repo_name`, `github.event.inputs.image`, `github.event.inputs.publish-latest-tag`, `github.event.inputs.version`.
+- **apache/gravitino** (`spark-integration-test-action.yml:59,60,62,63`): [run_block_injection] 7 instances of direct interpolation in run blocks. Expressions: `inputs.scala-version`, `inputs.test-mode`.
+- **apache/gravitino-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/gravitino-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/groovy** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/groovy-geb** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/guacamole-client** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/guacamole-client** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/guacamole-manual** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/guacamole-manual** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/guacamole-server** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/guacamole-server** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/guacamole-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/guacamole-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hadoop** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hadoop** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hadoop-api-shim** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hadoop-api-shim** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hadoop-thirdparty** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hadoop-thirdparty** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hamilton** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hamilton** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hbase** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hbase** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/helix** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/helix** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/helix** (`Helix-Manual-CI.yml:38`): [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.goals`, `github.event.inputs.mvnOpts`.
+- **apache/hertzbeat** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hertzbeat** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hertzbeat-collector-go** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hertzbeat-collector-go** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hertzbeat-helm-chart** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hertzbeat-helm-chart** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hive** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hive** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hive** (`docker-GA-images.yml:74,75,76`): [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.hadoopVersion`, `github.event.inputs.hiveVersion`, `github.event.inputs.tezVersion`.
+- **apache/hive** (`docker-images.yml:79,80,81`): [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.hadoopVersion`, `github.event.inputs.hiveVersion`, `github.event.inputs.tezVersion`.
+- **apache/hive-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hive-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hop** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hop** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/httpcomponents-client** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/httpcomponents-core** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/httpd** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/httpd** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/httpd-tests** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/httpd-tests** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hudi** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hudi** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hudi** (`pr_title_validation.yml:21`): [run_block_injection] Untrusted input `${{ github.event.pull_request.title }}` interpolated in run block at step 'Check for legacy PR title format using JIRA or MINOR' in workflow pr_title_validation.yml. Trigger is `pull_request` (not `pull_request_target`), so fork PRs do not have access to secrets. Same-repo PRs are from committers. Shell injection possible but low impact.
+- **apache/hudi-rs** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hugegraph** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hugegraph** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hugegraph-ai** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hugegraph-ai** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hugegraph-computer** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hugegraph-computer** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hugegraph-doc** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hugegraph-doc** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/hugegraph-doc** (`validate-release.yml:73,74,77,78,82,99,109,195,198,206,210,215,222,230,240,250,306,309,317,319,324,331,339,348`): [run_block_injection] 29 instances of direct interpolation in run blocks. Expressions: `inputs.release_version`.
+- **apache/hugegraph-toolchain** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/hugegraph-toolchain** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/incubator-baremaps** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/incubator-baremaps** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/incubator-baremaps** (`pre-release.yml:40,50,53`): [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `secrets.BAREMAPS_GPG_SECRET_KEY`, `secrets.GPG_KEY_ID`.
+- **apache/incubator-baremaps** (`release.yml:39,49,52,73`): [run_block_injection] 5 instances of direct interpolation in run blocks. Expressions: `secrets.BAREMAPS_GPG_SECRET_KEY`, `secrets.GPG_KEY_ID`, `secrets.INCUBATOR_SVN_DEV_PASSWORD`, `secrets.INCUBATOR_SVN_DEV_USERNAME`.
+- **apache/incubator-baremaps** (`snapshot.yml:31`): [run_block_injection] Secret `${{ secrets.BAREMAPS_GPG_SECRET_KEY }}` directly interpolated in run block at step 'Set up GPG' in workflow snapshot.yml. Trusted value but risks log leakage.
+- **apache/incubator-baremaps-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/incubator-baremaps-site** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/incubator-devlake-helm-chart** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/incubator-devlake-helm-chart** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/kafka** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/kafka-merge-queue-sandbox** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/kafka-merge-queue-sandbox** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/kafka-site** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/kafka-site** (`build-and-deploy.yml:54`): [run_block_injection] Workflow input `${{ inputs.deploy-to-asf-site && 'asf-site' || 'asf-staging' }}` directly interpolated in run block at step 'Configure' in workflow build-and-deploy.yml. Trusted committer input but should use env: block.
+- **apache/karaf** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/karaf-cellar** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/karaf-decanter** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/karaf-minho** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/karaf-minho** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/karaf-winegrower** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/karaf-winegrower** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/knox** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/knox** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/knox** (`docker-publish.yml:42,43,68,69`): [run_block_injection] 4 instances of direct interpolation in run blocks. Expressions: `secrets.DOCKERHUB_TOKEN`, `secrets.DOCKERHUB_USER`.
+- **apache/kvrocks** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/kvrocks** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/kvrocks-controller** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/kvrocks-controller** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/kvrocks-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/kvrocks-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/kyuubi** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/kyuubi** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/kyuubi-docker** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/kyuubi-docker** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/kyuubi-shaded** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/kyuubi-shaded** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **apache/kyuubi-website** (`(missing)`): [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **apache/kyuubi-website** (`(missing)`): [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+</details>
+
+## INFO Findings
+
+<details>
+<summary>Show 875 info findings</summary>
+
+- **apache/age** (`installcheck.yaml:20`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/airflow** (`(repo-wide)`): [third_party_actions] 2 third-party actions: astral-sh/setup-uv, slackapi/slack-github-action
+- **apache/answer** (`(repo-wide)`): [third_party_actions] 2 third-party actions: goreleaser/goreleaser-action, korandoru/hawkeye
+- **apache/answer-plugins** (`(repo-wide)`): [third_party_actions] 1 third-party actions: korandoru/hawkeye
+- **apache/answer-website** (`deploy.yml:19`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/apisix** (`build.yml:55`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/apisix** (`cli.yml:46`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/apisix** (`redhat-ci.yaml:39`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/apisix** (`semantic.yml:20`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/apisix** (`source-install.yml:56`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/apisix-control-plane** (`(repo-wide)`): [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+- **apache/apisix-ingress-controller** (`(repo-wide)`): [third_party_actions] 1 third-party actions: release-drafter/release-drafter
+- **apache/aries** (`(repo-wide)`): [third_party_actions] 1 third-party actions: jwgmeligmeyling/pmd-github-action
+- **apache/arrow** (`(repo-wide)`): [third_party_actions] 6 third-party actions: conda-incubator/setup-miniconda, eps1lon/actions-label-merge-conflict, matlab-actions/run-tests, matlab-actions/setup-matlab, msys2/setup-msys2, r-lib/actions
+- **apache/arrow** (`cpp.yml:123`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow** (`cpp_extra.yml:145`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow** (`cuda_extra.yml:91`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow** (`dev.yml:63`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow** (`docs.yml:60`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow** (`docs_light.yml:58`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow** (`integration.yml:114`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow** (`matlab.yml:74`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow** (`package_linux.yml:189`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow** (`python.yml:115`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow** (`r.yml:90`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow** (`r_extra.yml:172`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow** (`ruby.yml:90`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-adbc** (`(repo-wide)`): [third_party_actions] 3 third-party actions: astral-sh/setup-uv, conda-incubator/setup-miniconda, r-lib/actions
+- **apache/arrow-adbc** (`dev.yml:94`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-adbc** (`dev_adbc.yml:54`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-adbc** (`integration.yml:69`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-adbc** (`native-unix.yml:96`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-adbc** (`native-windows.yml:77`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-adbc** (`packaging.yml:424`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-cookbook** (`(repo-wide)`): [third_party_actions] 2 third-party actions: conda-incubator/setup-miniconda, r-lib/actions
+- **apache/arrow-cookbook** (`test_cpp_cookbook.yml:43`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-dotnet** (`test.yaml:48`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-go** (`(repo-wide)`): [third_party_actions] 1 third-party actions: msys2/setup-msys2
+- **apache/arrow-go** (`lint.yml:56`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-go** (`test.yml:392`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-java** (`dev.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-java** (`dev_pr.yml:46`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/arrow-java** (`rc.yml:136`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-java** (`test.yml:66`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-js** (`test.yaml:61`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-julia** (`(repo-wide)`): [third_party_actions] 6 third-party actions: JuliaRegistries/TagBot, julia-actions/julia-buildpkg, julia-actions/julia-docdeploy, julia-actions/julia-processcoverage, julia-actions/julia-runtest, julia-actions/setup-julia
+- **apache/arrow-julia** (`ci.yml:65`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-nanoarrow** (`(repo-wide)`): [third_party_actions] 2 third-party actions: ilammy/msvc-dev-cmd, r-lib/actions
+- **apache/arrow-nanoarrow** (`build-and-test-device.yaml:94`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-nanoarrow** (`build-and-test-ipc.yaml:72`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-nanoarrow** (`build-and-test.yaml:64`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-nanoarrow** (`clang-tidy.yaml:47`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-nanoarrow** (`dev.yaml:44`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-nanoarrow** (`verify.yaml:89`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-rs** (`dev_pr.yml:40`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/arrow-rs** (`integration.yml:206`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/arrow-rs-object-store** (`(repo-wide)`): [third_party_actions] 1 third-party actions: taiki-e/install-action
+- **apache/arrow-swift** (`(repo-wide)`): [third_party_actions] 1 third-party actions: swift-actions/setup-swift
+- **apache/arrow-swift** (`test.yaml:46`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/artemis** (`build.yml:44`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/artemis-examples** (`build.yml:41`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/artemis-native** (`build.yml:19`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/atlas** (`ci.yml:44`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/auron** (`(repo-wide)`): [third_party_actions] 2 third-party actions: Mattraks/delete-workflow-runs, arduino/setup-protoc
+- **apache/auron** (`build-amd64-releases.yml:94`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/avro** (`(repo-wide)`): [third_party_actions] 5 third-party actions: astral-sh/setup-uv, dtolnay/rust-toolchain, shivammathur/setup-php, shogo82148/actions-setup-perl, stCarolas/setup-maven
+- **apache/avro** (`maven4.yml:38`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/avro** (`rat.yml:35`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/avro** (`spotless.yml:38`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/avro** (`test-lang-c.yml:64`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/avro** (`test-lang-csharp.yml:58`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/avro** (`test-lang-java.yml:50`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/avro** (`test-lang-js.yml:54`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/avro** (`test-lang-perl.yml:109`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/avro** (`test-lang-php.yml:64`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/avro** (`test-lang-py.yml:123`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/avro** (`test-lang-ruby.yml:59`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/avro-rs** (`(repo-wide)`): [third_party_actions] 4 third-party actions: dtolnay/rust-toolchain, shogo82148/actions-setup-perl, stCarolas/setup-maven, taiki-e/install-action
+- **apache/avro-rs** (`test-lang-rust-ci.yml:78`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/axis-axis1-java** (`ci.yml:38`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/axis-axis2-java-core** (`ci.yml:39`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/axis-axis2-java-rampart** (`ci.yml:39`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/beam** (`(repo-wide)`): [third_party_actions] 9 third-party actions: cicirello/javadoc-cleanup, damccorm/tag-ur-it, dawidd6/action-send-mail, golangci/golangci-lint-action, jlumbroso/free-disk-space, jwgmeligmeyling/checkstyle-github-action, jwgmeligmeyling/spotbugs-github-action, nanasess/setup-chromedriver, subosito/flutter-action
+- **apache/beam** (`IO_Iceberg_Integration_Tests.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`IO_Iceberg_Integration_Tests_Dataflow.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`IO_Iceberg_Managed_Integration_Tests_Dataflow.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`IO_Iceberg_Performance_Tests.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`IO_Iceberg_Unit_Tests.yml:85`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_CancelStaleDataflowJobs.yml:54`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_CleanUpDataprocResources.yml:54`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_CleanUpGCPResources.yml:54`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_CleanUpPrebuiltSDKImages.yml:54`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_CloudML_Benchmarks_Dataflow.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_IODatastoresCredentialsRotation.yml:54`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Inference_Python_Benchmarks_Dataflow.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Infrastructure_PolicyEnforcer.yml:42`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Infrastructure_SecurityLogging.yml:44`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Infrastructure_ServiceAccountKeys.yml:48`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Java_JMH.yml:65`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_Java_LoadTests_Combine_Smoke.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Go_CoGBK_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Go_CoGBK_Flink_batch.yml:67`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Go_Combine_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Go_Combine_Flink_Batch.yml:67`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Go_GBK_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Go_GBK_Flink_Batch.yml:67`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Go_ParDo_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Go_ParDo_Flink_Batch.yml:67`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Go_SideInput_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Go_SideInput_Flink_Batch.yml:67`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_CoGBK_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_CoGBK_Dataflow_Streaming.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_CoGBK_Dataflow_V2_Batch_JavaVersions.yml:58`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_CoGBK_Dataflow_V2_Streaming_JavaVersions.yml:58`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_CoGBK_SparkStructuredStreaming_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_Combine_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_Combine_Dataflow_Streaming.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_Combine_SparkStructuredStreaming_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_GBK_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_GBK_Dataflow_Streaming.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_GBK_Dataflow_V2_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_GBK_Dataflow_V2_Batch_Java17.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_GBK_Dataflow_V2_Streaming.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_GBK_Dataflow_V2_Streaming_Java17.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_GBK_Smoke.yml:54`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_GBK_SparkStructuredStreaming_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_ParDo_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_ParDo_Dataflow_Streaming.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_ParDo_Dataflow_V2_Batch_JavaVersions.yml:58`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_ParDo_Dataflow_V2_Streaming_JavaVersions.yml:58`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_ParDo_SparkStructuredStreaming_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Java_PubsubIO.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_CoGBK_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_CoGBK_Dataflow_Streaming.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_CoGBK_Flink_Batch.yml:67`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_Combine_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_Combine_Dataflow_Streaming.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_Combine_Flink_Batch.yml:67`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_Combine_Flink_Streaming.yml:67`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_FnApiRunner_Microbenchmark.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_GBK_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_GBK_Dataflow_Streaming.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_GBK_Flink_Batch.yml:67`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_GBK_reiterate_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_GBK_reiterate_Dataflow_Streaming.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_ParDo_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_ParDo_Dataflow_Streaming.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_ParDo_Flink_Batch.yml:67`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_ParDo_Flink_Streaming.yml:67`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_SideInput_Dataflow_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_LoadTests_Python_Smoke.yml:54`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_MetricsCredentialsRotation.yml:54`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Metrics_Report.yml:55`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_AvroIOIT.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_AvroIOIT_HDFS.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_BigQueryIO_Batch_Java_Avro.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_BigQueryIO_Batch_Java_Json.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_BigQueryIO_Streaming_Java.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_BiqQueryIO_Read_Python.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_BiqQueryIO_Write_Python_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_Cdap.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_Compressed_TextIOIT.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_Compressed_TextIOIT_HDFS.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_HadoopFormat.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_JDBC.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_Kafka_IO.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_ManyFiles_TextIOIT.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_ManyFiles_TextIOIT_HDFS.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_MongoDBIO_IT.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_ParquetIOIT.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_ParquetIOIT_HDFS.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_PubsubIOIT_Python_Streaming.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_SQLBigQueryIO_Batch_Java.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_SingleStoreIO.yml:56`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_SpannerIO_Read_2GB_Python.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_SpannerIO_Write_2GB_Python_Batch.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_SparkReceiver_IO.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_TFRecordIOIT.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_TFRecordIOIT_HDFS.yml:59`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_TextIOIT.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_TextIOIT_HDFS.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_TextIOIT_Python.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_WordCountIT_PythonVersions.yml:58`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_XmlIOIT.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_XmlIOIT_HDFS.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PerformanceTests_xlang_KafkaIO_Python.yml:58`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Playground_CI_Nightly.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Playground_Precommit.yml:50`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Go.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Go_Dataflow_ARM.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Go_VR_Flink.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Go_VR_Samza.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Go_VR_Spark.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Avro_Versions.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_BigQueryEarlyRollout.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_DataflowV1.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_DataflowV2.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow_ARM.yml:73`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow_Java.yml:70`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow_V2.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Dataflow_V2_Java.yml:72`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Direct.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Flink.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Examples_Spark.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Hadoop_Versions.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_IO_Performance_Tests.yml:69`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_InfluxDbIO_IT.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Dataflow.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Dataflow_Versions.yml:67`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Direct.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Direct_Versions.yml:67`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Flink_Java11.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Jpms_Spark_Java11.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Dataflow.yml:96`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Dataflow_V2.yml:96`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Dataflow_V2_Java.yml:98`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Direct.yml:91`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Flink.yml:90`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Nexmark_Spark.yml:90`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Flink_Batch.yml:82`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Flink_Streaming.yml:70`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Samza.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Spark3_Streaming.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_PVR_Spark_Batch.yml:67`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_SingleStoreIO_IT.yml:70`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Tpcds_Dataflow.yml:93`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Tpcds_Flink.yml:90`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_Tpcds_Spark.yml:89`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_JavaVersions.yml:70`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_Engine.yml:67`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_TagEncodingV2.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_V2.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Dataflow_V2_Streaming.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Direct.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Direct_JavaVersions.yml:70`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Flink.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Flink_Java8.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Samza.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Spark.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_SparkStructuredStreaming.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Spark_Java8.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_Twister2.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Java_ValidatesRunner_ULR.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Javadoc.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_PortableJar_Flink.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_PortableJar_Spark.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python.yml:72`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_Arm.yml:69`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_Dependency.yml:70`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_Examples_Dataflow.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_Examples_Direct.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_Examples_Flink.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_Examples_Spark.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_MongoDBIO_IT.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_Nexmark_Direct.yml:111`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_Portable_Flink.yml:70`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesContainer_Dataflow.yml:70`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesContainer_Dataflow_With_RC.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesRunner_Dataflow.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesRunner_Flink.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesRunner_Samza.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_ValidatesRunner_Spark.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_Xlang_Gcp_Dataflow.yml:67`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_Xlang_Gcp_Direct.yml:67`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_Xlang_IO_Dataflow.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Python_Xlang_IO_Direct.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_SQL.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_TransformService_Direct.yml:67`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Website_Test.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_XVR_Direct.yml:67`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_XVR_Flink.yml:68`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_XVR_GoUsingJava_Dataflow.yml:69`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_XVR_JavaUsingPython_Dataflow.yml:67`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_XVR_PythonUsingJavaSQL_Dataflow.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_XVR_PythonUsingJava_Dataflow.yml:67`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_XVR_Samza.yml:67`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_XVR_Spark3.yml:67`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostCommit_Yaml_Xlang_Direct.yml:66`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PostRelease_NightlySnapshot.yml:55`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_PreCommit_CommunityMetrics.yml:74`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Flink_Container.yml:101`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_GHA.yml:74`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Go.yml:74`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_GoPortable.yml:76`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_GoPrism.yml:74`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_ItFramework.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java.yml:171`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Amazon-Web-Services2_IO_Direct.yml:97`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Amqp_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Azure_IO_Direct.yml:97`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Cassandra_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Cdap_IO_Direct.yml:83`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Clickhouse_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Csv_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Datadog_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Debezium_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_ElasticSearch_IO_Direct.yml:81`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Examples_Dataflow.yml:90`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Examples_Dataflow_Java21.yml:89`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_File-schema-transform_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Flink_Versions.yml:78`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_GCP_IO_Direct.yml:97`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Google-ads_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_HBase_IO_Direct.yml:81`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_HCatalog_IO_Direct.yml:81`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Hadoop_IO_Direct.yml:105`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_IOs_Direct.yml:82`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_InfluxDb_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_JDBC_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Jms_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Kafka_IO_Direct.yml:87`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Kudu_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_MongoDb_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Mqtt_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Neo4j_IO_Direct.yml:81`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_PVR_Flink_Batch.yml:85`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_PVR_Flink_Docker.yml:90`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_PVR_Prism_Loopback.yml:91`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Parquet_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Pulsar_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_RabbitMq_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Redis_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_RequestResponse_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_SingleStore_IO_Direct.yml:81`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Snowflake_IO_Direct.yml:83`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Solace_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Solr_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Spark3_Versions.yml:81`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Splunk_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Thrift_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Java_Tika_IO_Direct.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Kotlin_Examples.yml:91`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Portable_Python.yml:93`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Prism_Python.yml:87`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Python.yml:94`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_PythonDocker.yml:72`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_PythonDocs.yml:74`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_PythonFormatter.yml:73`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_PythonLint.yml:73`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Python_Coverage.yml:77`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Python_Dataframes.yml:75`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Python_Dill.yml:84`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Python_Examples.yml:76`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Python_Integration.yml:75`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Python_ML.yml:90`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Python_PVR_Flink.yml:93`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Python_Runners.yml:75`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Python_Transforms.yml:76`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_RAT.yml:72`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_SQL.yml:74`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_SQL_Java17.yml:74`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_SQL_Java8.yml:74`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Spotless.yml:79`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Typescript.yml:75`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Website.yml:74`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Website_Stage_GCS.yml:76`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Whitespace.yml:73`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Xlang_Generated_Transforms.yml:95`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_PreCommit_Yaml_Xlang_Direct.yml:80`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/beam** (`beam_Publish_BeamMetrics.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Publish_Beam_SDK_Snapshots.yml:124`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Publish_Docker_Snapshots.yml:56`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Publish_Website.yml:52`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Python_CostBenchmarks_Dataflow.yml:56`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Python_ValidatesContainer_Dataflow_ARM.yml:102`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Release_NightlySnapshot.yml:45`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_Release_Python_NightlySnapshot.yml:47`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_StressTests_Java_BigQueryIO.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_StressTests_Java_BigTableIO.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_StressTests_Java_KafkaIO.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_StressTests_Java_PubSubIO.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`beam_StressTests_Java_SpannerIO.yml:57`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`build_release_candidate.yml:61`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`deploy_release_candidate_pypi.yaml:25`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`finalize_release.yml:41`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`flaky_test_detection.yml:39`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`playground_frontend_test.yml:51`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/beam** (`refresh_looker_metrics.yml:32`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`run_rc_validation_go_wordcount.yml:27`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`run_rc_validation_java_mobile_gaming.yml:74`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`run_rc_validation_java_quickstart.yml:67`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`run_rc_validation_python_mobile_gaming.yml:68`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`run_rc_validation_python_yaml.yml:61`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam** (`tour_of_beam_frontend_test.yml:53`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/beam** (`update_python_dependencies.yml:39`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/beam-starter-java** (`(repo-wide)`): [third_party_actions] 1 third-party actions: sbt/setup-sbt
+- **apache/bigtop-manager** (`(repo-wide)`): [third_party_actions] 2 third-party actions: amannn/action-semantic-pull-request, crate-ci/typos
+- **apache/bigtop-manager** (`codeql.yaml:62`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/bookkeeper** (`(repo-wide)`): [third_party_actions] 1 third-party actions: crate-ci/typos
+- **apache/bookkeeper** (`bk-ci.yml:68`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/bookkeeper** (`bk-streamstorage-python.yml:62`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/bookkeeper** (`codeql.yml:67`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/brpc** (`(repo-wide)`): [third_party_actions] 1 third-party actions: google/oss-fuzz
+- **apache/burr** (`(repo-wide)`): [third_party_actions] 1 third-party actions: hasura/comment-progress
+- **apache/burr** (`python-package.yml:41`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/calcite** (`(repo-wide)`): [third_party_actions] 1 third-party actions: burrunan/gradle-cache-action
+- **apache/calcite-avatica** (`(repo-wide)`): [third_party_actions] 1 third-party actions: google/oss-fuzz
+- **apache/camel** (`(repo-wide)`): [third_party_actions] 1 third-party actions: actions-cool/check-user-permission
+- **apache/camel-jbang-examples** (`build.yml:37`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/camel-k-runtime** (`(repo-wide)`): [third_party_actions] 1 third-party actions: AdoptOpenJDK/install-jdk
+- **apache/camel-karavan** (`app.yml:31`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/camel-karavan** (`vscode.yml:31`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/camel-upgrade-recipes** (`(repo-wide)`): [third_party_actions] 1 third-party actions: googleapis/code-suggester
+- **apache/carbondata** (`build-test.yml:24`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/casbin** (`(repo-wide)`): [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+- **apache/casbin-3rd-party-casbin-pg-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: isbang/compose-action
+- **apache/casbin-Casbin.NET** (`(repo-wide)`): [third_party_actions] 2 third-party actions: amannn/action-semantic-pull-request, microsoft/infersharpaction
+- **apache/casbin-Casbin.NET-redis-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: amannn/action-semantic-pull-request
+- **apache/casbin-admission-webhook** (`ci.yml:28`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/casbin-confita** (`(repo-wide)`): [third_party_actions] 1 third-party actions: c-hive/gha-yarn-cache
+- **apache/casbin-core** (`(repo-wide)`): [third_party_actions] 1 third-party actions: coverallsapp/github-action
+- **apache/casbin-cpp** (`(repo-wide)`): [third_party_actions] 1 third-party actions: jwlawson/actions-setup-cmake
+- **apache/casbin-crd-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+- **apache/casbin-dart-casbin** (`(repo-wide)`): [third_party_actions] 1 third-party actions: dart-lang/setup-dart
+- **apache/casbin-docker_auth** (`(repo-wide)`): [third_party_actions] 1 third-party actions: haya14busa/action-cond
+- **apache/casbin-ent-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: shogo82148/actions-goveralls
+- **apache/casbin-ex** (`(repo-wide)`): [third_party_actions] 1 third-party actions: erlef/setup-beam
+- **apache/casbin-ex** (`ci.yml:33`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/casbin-fasthttp-auth** (`ci.yml:22`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/casbin-gateway** (`(repo-wide)`): [third_party_actions] 1 third-party actions: cycjimmy/semantic-release-action
+- **apache/casbin-go-cli** (`(repo-wide)`): [third_party_actions] 2 third-party actions: golangci/golangci-lint-action, goreleaser/goreleaser-action
+- **apache/casbin-go-client** (`(repo-wide)`): [third_party_actions] 1 third-party actions: docker-practice/actions-setup-docker
+- **apache/casbin-gorm-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: shogo82148/actions-goveralls
+- **apache/casbin-gorm-adapter-ex** (`(repo-wide)`): [third_party_actions] 1 third-party actions: shogo82148/actions-goveralls
+- **apache/casbin-govaluate** (`(repo-wide)`): [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+- **apache/casbin-jcasbin-lettuce-redis-watcher** (`(repo-wide)`): [third_party_actions] 1 third-party actions: getong/redis-action
+- **apache/casbin-jcasbin-mongo-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: supercharge/mongodb-github-action
+- **apache/casbin-jcasbin-redis-watcher** (`(repo-wide)`): [third_party_actions] 1 third-party actions: getong/redis-action
+- **apache/casbin-jcasbin-shiro-casbin** (`(repo-wide)`): [third_party_actions] 1 third-party actions: docker-practice/actions-setup-docker
+- **apache/casbin-laravel-rbac** (`(repo-wide)`): [third_party_actions] 2 third-party actions: coverallsapp/github-action, shivammathur/setup-php
+- **apache/casbin-lego** (`(repo-wide)`): [third_party_actions] 2 third-party actions: goreleaser/goreleaser-action, niden/actions-memcached
+- **apache/casbin-lego** (`go-cross.yml:33`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/casbin-lego** (`main.yml:39`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/casbin-lua-4daysorm-adapter** (`(repo-wide)`): [third_party_actions] 2 third-party actions: leafo/gh-actions-lua, leafo/gh-actions-luarocks
+- **apache/casbin-lua-casbin** (`(repo-wide)`): [third_party_actions] 2 third-party actions: leafo/gh-actions-lua, leafo/gh-actions-luarocks
+- **apache/casbin-lua-kong-authz** (`(repo-wide)`): [third_party_actions] 2 third-party actions: leafo/gh-actions-lua, leafo/gh-actions-luarocks
+- **apache/casbin-lua-luasql-adapter** (`(repo-wide)`): [third_party_actions] 2 third-party actions: leafo/gh-actions-lua, leafo/gh-actions-luarocks
+- **apache/casbin-mcp-gateway** (`ci.yml:28`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/casbin-mongodb-adapter** (`(repo-wide)`): [third_party_actions] 2 third-party actions: shogo82148/actions-goveralls, supercharge/mongodb-github-action
+- **apache/casbin-nest-authz** (`(repo-wide)`): [third_party_actions] 1 third-party actions: coverallsapp/github-action
+- **apache/casbin-node-casbin** (`(repo-wide)`): [third_party_actions] 1 third-party actions: coverallsapp/github-action
+- **apache/casbin-node-casbin-couchdb-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: coverallsapp/github-action
+- **apache/casbin-node-casbin-drizzle-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: coverallsapp/github-action
+- **apache/casbin-node-casbin-expression-eval** (`(repo-wide)`): [third_party_actions] 1 third-party actions: coverallsapp/github-action
+- **apache/casbin-node-casbin-file-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: coverallsapp/github-action
+- **apache/casbin-node-casbin-mongo-changestream-watcher** (`(repo-wide)`): [third_party_actions] 1 third-party actions: coverallsapp/github-action
+- **apache/casbin-node-casbin-mongoose-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: coverallsapp/github-action
+- **apache/casbin-node-casbin-node-redis-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: coverallsapp/github-action
+- **apache/casbin-node-casbin-prisma-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: coverallsapp/github-action
+- **apache/casbin-node-casbin-redis-watcher** (`(repo-wide)`): [third_party_actions] 1 third-party actions: coverallsapp/github-action
+- **apache/casbin-policyguard** (`(repo-wide)`): [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+- **apache/casbin-pycasbin** (`(repo-wide)`): [third_party_actions] 1 third-party actions: super-linter/super-linter
+- **apache/casbin-python-cli** (`(repo-wide)`): [third_party_actions] 1 third-party actions: semantic-release-action/next-release-version
+- **apache/casbin-python-fastapi-casbin-auth** (`(repo-wide)`): [third_party_actions] 1 third-party actions: coverallsapp/github-action
+- **apache/casbin-python-graphql-authz** (`(repo-wide)`): [third_party_actions] 1 third-party actions: wearerequired/lint-action
+- **apache/casbin-python-pymongo-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: supercharge/mongodb-github-action
+- **apache/casbin-python-rabbitmq-watcher** (`(repo-wide)`): [third_party_actions] 1 third-party actions: nijel/rabbitmq-action
+- **apache/casbin-python-redis-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: nnhy/redis-github-action
+- **apache/casbin-raft** (`(repo-wide)`): [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+- **apache/casbin-rs** (`(repo-wide)`): [third_party_actions] 6 third-party actions: actions-rs/cargo, actions-rs/toolchain, baptiste0928/cargo-install, casbin-rs/semantic-release-action-rust, smrpn/criterion-compare-action, stefanzweifel/git-auto-commit-action
+- **apache/casbin-rs** (`ci.yml:33`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/casbin-rs** (`pull_request.yml:21`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/casbin-rust-actix-file-adapter-rbac** (`(repo-wide)`): [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+- **apache/casbin-rust-actix-middleware-example** (`(repo-wide)`): [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+- **apache/casbin-rust-actix-postgresql-simple** (`(repo-wide)`): [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+- **apache/casbin-rust-axum-middleware-example** (`(repo-wide)`): [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+- **apache/casbin-rust-casbin-grpc** (`(repo-wide)`): [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+- **apache/casbin-rust-casbin-rust-cli** (`(repo-wide)`): [third_party_actions] 3 third-party actions: actions-rs/cargo, actions-rs/toolchain, casbin-rs/semantic-release-action-rust
+- **apache/casbin-rust-diesel-adapter** (`(repo-wide)`): [third_party_actions] 2 third-party actions: actions-rs/cargo, actions-rs/toolchain
+- **apache/casbin-rust-dufs-with-casbin** (`(repo-wide)`): [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+- **apache/casbin-rust-json-adapter** (`(repo-wide)`): [third_party_actions] 2 third-party actions: actions-rs/tarpaulin, actions-rs/toolchain
+- **apache/casbin-rust-ntex-file-adapter-acl** (`(repo-wide)`): [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+- **apache/casbin-rust-poem-casbin** (`(repo-wide)`): [third_party_actions] 2 third-party actions: actions-rs/cargo, actions-rs/toolchain
+- **apache/casbin-rust-poem-todo** (`(repo-wide)`): [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+- **apache/casbin-rust-postgres-adapter** (`(repo-wide)`): [third_party_actions] 3 third-party actions: actions-rs/cargo, actions-rs/tarpaulin, actions-rs/toolchain
+- **apache/casbin-rust-redis-watcher** (`(repo-wide)`): [third_party_actions] 3 third-party actions: Swatinem/rust-cache, casbin-rs/semantic-release-action-rust, dtolnay/rust-toolchain
+- **apache/casbin-rust-rocket-authz** (`(repo-wide)`): [third_party_actions] 3 third-party actions: actions-rs/cargo, actions-rs/tarpaulin, actions-rs/toolchain
+- **apache/casbin-rust-semantic-release-action-rust** (`(repo-wide)`): [third_party_actions] 8 third-party actions: DeterminateSystems/nix-installer-action, EricCrosson/install-github-release-binary, Swatinem/rust-cache, casbin-rs/semantic-release-action-rust, dtolnay/rust-toolchain, semantic-release-action/github-actions, semantic-release-action/next-release-version, taiki-e/install-action
+- **apache/casbin-rust-string-adapter** (`(repo-wide)`): [third_party_actions] 3 third-party actions: actions-rs/cargo, actions-rs/toolchain, baptiste0928/cargo-install
+- **apache/casbin-sequelize-adapter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: coverallsapp/github-action
+- **apache/casbin-server** (`(repo-wide)`): [third_party_actions] 1 third-party actions: actions-ecosystem/action-get-latest-tag
+- **apache/casbin-sqlx-adapter** (`(repo-wide)`): [third_party_actions] 2 third-party actions: baptiste0928/cargo-install, dtolnay/rust-toolchain
+- **apache/casbin-typeorm-adapter** (`(repo-wide)`): [third_party_actions] 2 third-party actions: coverallsapp/github-action, mirromutth/mysql-action
+- **apache/casbin-ucon** (`(repo-wide)`): [third_party_actions] 2 third-party actions: benchmark-action/github-action-benchmark, golangci/golangci-lint-action
+- **apache/casbin-vscode-plugin** (`(repo-wide)`): [third_party_actions] 1 third-party actions: HaaLeo/publish-vscode-extension
+- **apache/casbin-website** (`(repo-wide)`): [third_party_actions] 1 third-party actions: tcort/github-action-markdown-link-check
+- **apache/casbin-website-v1-deprecated** (`(repo-wide)`): [third_party_actions] 1 third-party actions: crowdin/github-action
+- **apache/casbin-zap-logger** (`(repo-wide)`): [third_party_actions] 1 third-party actions: actions-ecosystem/action-get-latest-tag
+- **apache/cassandra-analytics** (`test.yaml:64`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/cassandra-ccm** (`(repo-wide)`): [third_party_actions] 1 third-party actions: mikepenz/action-junit-report
+- **apache/cassandra-gocql-driver** (`main.yml:59`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/cassandra-sidecar** (`ci.yml:67`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/cassandra-spark-connector** (`(repo-wide)`): [third_party_actions] 1 third-party actions: mikepenz/action-junit-report
+- **apache/causeway** (`(repo-wide)`): [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+- **apache/causeway** (`ci-v4-verify.yml:76`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/celeborn** (`benchmark.yml:26`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/celeborn** (`benchmark_manual.yml:30`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/celeborn** (`regression.yml:26`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/celeborn** (`regression_manual.yml:31`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/celix** (`conan_create.yml:46`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/celix** (`containers.yml:15`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/celix** (`coverage.yml:39`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/celix** (`fuzzing.yml:27`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/celix** (`macos.yml:37`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/celix** (`ubuntu.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/cloudberry** (`(repo-wide)`): [third_party_actions] 1 third-party actions: SonarSource/sonarqube-scan-action
+- **apache/cloudberry-pxf** (`pxf-ci.yml:61`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/cloudstack** (`(repo-wide)`): [third_party_actions] 1 third-party actions: eps1lon/actions-label-merge-conflict
+- **apache/cloudstack** (`pre-commit.yml:42`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/cloudstack** (`sonar-check.yml:49`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/cloudstack-documentation** (`(repo-wide)`): [third_party_actions] 1 third-party actions: readthedocs/actions
+- **apache/cloudstack-kubernetes-provider** (`(repo-wide)`): [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+- **apache/cloudstack-terraform-provider** (`(repo-wide)`): [third_party_actions] 1 third-party actions: opentofu/setup-opentofu
+- **apache/cloudstack-www** (`pre-commit.yml:42`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-bcel** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-bcel** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-bcel** (`maven.yml:49`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-beanutils** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-beanutils** (`codeql-analysis.yml:48`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-beanutils** (`maven.yml:47`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-bsf** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-bsf** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-bsf** (`maven.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-build-plugin** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-build-plugin** (`maven.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-cli** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-cli** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-cli** (`maven.yml:47`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-codec** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-codec** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-codec** (`maven.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-collections** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-collections** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-collections** (`maven.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-compress** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-compress** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-compress** (`maven.yml:49`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-configuration** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-configuration** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-crypto** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-crypto** (`codeql-analysis.yml:62`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-crypto** (`maven.yml:94`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-csv** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-csv** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-csv** (`maven.yml:49`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-daemon** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-daemon** (`codeql-analysis.yml:56`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-daemon** (`maven.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-dbcp** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-dbcp** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-dbcp** (`maven.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-dbutils** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-dbutils** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-dbutils** (`maven.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-digester** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-digester** (`codeql-analysis.yml:50`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-digester** (`maven.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-email** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-email** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-email** (`maven.yml:47`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-exec** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-exec** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-exec** (`maven.yml:47`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-fileupload** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-fileupload** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-fileupload** (`maven.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-geometry** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-geometry** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-graph** (`maven.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-imaging** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-imaging** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-io** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-io** (`codeql-analysis.yml:57`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-io** (`maven.yml:67`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-jci** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-jci** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-jci** (`maven.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-jcs** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-jcs** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-jcs** (`maven.yml:44`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-jelly** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-jelly** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-jelly** (`maven.yml:41`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-jexl** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-jexl** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-jexl** (`maven.yml:48`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-jxpath** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-jxpath** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-jxpath** (`maven.yml:50`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-lang** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-lang** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-lang** (`maven.yml:47`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-logging** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-logging** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-math** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-math** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-net** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-net** (`codeql-analysis.yml:57`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-net** (`maven.yml:65`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-numbers** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-numbers** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-ognl** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-parent** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-parent** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-parent** (`maven.yml:41`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-pool** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-pool** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-pool** (`maven.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-rdf** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-rdf** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-rdf** (`maven.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-release-plugin** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-release-plugin** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-release-plugin** (`maven.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-rng** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-rng** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-scxml** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-scxml** (`maven.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-skin** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-skin** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-skin** (`maven.yml:54`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-statistics** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-statistics** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-text** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-text** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-validator** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-validator** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-validator** (`maven.yml:45`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-vfs** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-vfs** (`codeql-analysis.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-vfs** (`maven.yml:55`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-weaver** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/commons-weaver** (`codeql-analysis.yml:53`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/commons-weaver** (`maven.yml:54`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/cordova** (`(repo-wide)`): [third_party_actions] 1 third-party actions: gr2m/twitter-together
+- **apache/cordova-android** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-app-hello-world** (`(repo-wide)`): [third_party_actions] 1 third-party actions: erisu/apache-rat-action
+- **apache/cordova-browser** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-cli** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-common** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-create** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-electron** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-eslint** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-fetch** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-ios** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-js** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-lib** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-mobile-spec** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-node-xcode** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-paramedic** (`(repo-wide)`): [third_party_actions] 4 third-party actions: erisu/apache-rat-action, erisu/license-checker-action, maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-battery-status** (`(repo-wide)`): [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-camera** (`(repo-wide)`): [third_party_actions] 4 third-party actions: erisu/apache-rat-action, erisu/license-checker-action, maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-device** (`(repo-wide)`): [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-device-motion** (`(repo-wide)`): [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-device-orientation** (`(repo-wide)`): [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-dialogs** (`(repo-wide)`): [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-file** (`(repo-wide)`): [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-file-transfer** (`(repo-wide)`): [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-geolocation** (`(repo-wide)`): [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-inappbrowser** (`(repo-wide)`): [third_party_actions] 4 third-party actions: erisu/apache-rat-action, erisu/license-checker-action, maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-media** (`(repo-wide)`): [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-media-capture** (`(repo-wide)`): [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-network-information** (`(repo-wide)`): [third_party_actions] 4 third-party actions: erisu/apache-rat-action, erisu/license-checker-action, maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-screen-orientation** (`(repo-wide)`): [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-statusbar** (`(repo-wide)`): [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugin-test-framework** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-plugin-vibration** (`(repo-wide)`): [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+- **apache/cordova-plugman** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/cordova-serve** (`(repo-wide)`): [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+- **apache/couchdb-fast-pbkdf2** (`(repo-wide)`): [third_party_actions] 3 third-party actions: erlef/setup-beam, ilammy/msvc-dev-cmd, uraimo/run-on-arch-action
+- **apache/couchdb-fast-pbkdf2** (`ci.yml:59`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/couchdb-meck** (`(repo-wide)`): [third_party_actions] 1 third-party actions: erlef/setup-beam
+- **apache/couchdb-mochiweb** (`(repo-wide)`): [third_party_actions] 1 third-party actions: erlangpack/github-action
+- **apache/creadur-rat** (`maven.yml:48`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/creadur-rat** (`sonarcloud.yml:24`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/creadur-tentacles** (`maven.yml:46`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/creadur-whisker** (`maven.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/curator** (`ci.yml:38`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/cxf** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/cxf** (`codeql-analysis.yml:39`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/cxf-fediz** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/daffodil** (`(repo-wide)`): [third_party_actions] 3 third-party actions: SonarSource/sonarqube-scan-action, msys2/setup-msys2, scalacenter/sbt-dependency-submission
+- **apache/daffodil** (`main.yml:173`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/daffodil-sbt** (`(repo-wide)`): [third_party_actions] 1 third-party actions: msys2/setup-msys2
+- **apache/daffodil-site** (`(repo-wide)`): [third_party_actions] 1 third-party actions: docker:/
+- **apache/daffodil-vscode** (`(repo-wide)`): [third_party_actions] 1 third-party actions: sbt/setup-sbt
+- **apache/datafusion** (`(repo-wide)`): [third_party_actions] 6 third-party actions: Swatinem/rust-cache, astral-sh/setup-uv, eps1lon/actions-label-merge-conflict, jlumbroso/free-disk-space, runs-on/action, taiki-e/install-action
+- **apache/datafusion** (`rust.yml:633`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datafusion-ballista** (`(repo-wide)`): [third_party_actions] 4 third-party actions: arduino/setup-protoc, astral-sh/setup-uv, dtolnay/rust-toolchain, eps1lon/actions-label-merge-conflict
+- **apache/datafusion-ballista** (`rust.yml:306`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datafusion-ballista-python** (`(repo-wide)`): [third_party_actions] 4 third-party actions: actions-rs/toolchain, eps1lon/actions-label-merge-conflict, potiuk/cancel-workflow-runs, r-lib/actions
+- **apache/datafusion-ballista-python** (`dev_pr.yml:32`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/datafusion-ballista-python** (`python_test.yaml:40`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datafusion-ballista-python** (`rust.yml:43`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datafusion-comet** (`(repo-wide)`): [third_party_actions] 1 third-party actions: runs-on/action
+- **apache/datafusion-comet** (`iceberg_spark_test.yml:70`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datafusion-comet** (`pr_benchmark_check.yml:77`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datafusion-comet** (`pr_build_linux.yml:101`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datafusion-comet** (`pr_build_macos.yml:86`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datafusion-comet** (`spark_sql_test.yml:77`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datafusion-python** (`(repo-wide)`): [third_party_actions] 6 third-party actions: PyO3/maturin-action, Swatinem/rust-cache, arduino/setup-protoc, astral-sh/setup-uv, dtolnay/rust-toolchain, taiki-e/install-action
+- **apache/datafusion-ray** (`(repo-wide)`): [third_party_actions] 6 third-party actions: PyO3/maturin-action, arduino/setup-protoc, astral-sh/setup-uv, dtolnay/rust-toolchain, helm/kind-action, jlumbroso/free-disk-space
+- **apache/datafusion-ray** (`main.yml:73`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datafusion-sandbox** (`(repo-wide)`): [third_party_actions] 6 third-party actions: Swatinem/rust-cache, astral-sh/setup-uv, eps1lon/actions-label-merge-conflict, jlumbroso/free-disk-space, runs-on/action, taiki-e/install-action
+- **apache/datafusion-sandbox** (`rust.yml:634`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datafusion-site** (`(repo-wide)`): [third_party_actions] 1 third-party actions: crate-ci/typos
+- **apache/datafusion-sqlparser-rs** (`(repo-wide)`): [third_party_actions] 1 third-party actions: Swatinem/rust-cache
+- **apache/datasketches-hive** (`maven.yml:25`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datasketches-java** (`auto-jdk-matrix.yml:39`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datasketches-java** (`auto-os-matrix.yml:49`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datasketches-memory16** (`(repo-wide)`): [third_party_actions] 1 third-party actions: AdoptOpenJDK/install-jdk
+- **apache/datasketches-memory16** (`maven.yml:24`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datasketches-memory17** (`(repo-wide)`): [third_party_actions] 1 third-party actions: AdoptOpenJDK/install-jdk
+- **apache/datasketches-memory17** (`maven.yml:35`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datasketches-pig** (`maven.yml:24`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datasketches-rust** (`(repo-wide)`): [third_party_actions] 2 third-party actions: Swatinem/rust-cache, taiki-e/install-action
+- **apache/datasketches-spark** (`(repo-wide)`): [third_party_actions] 1 third-party actions: sbt/setup-sbt
+- **apache/datasketches-spark** (`ci.yaml:40`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/datasketches-spark** (`python_ci.yaml:38`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/deltaspike** (`ci.yml:63`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/directory-kerby** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/directory-ldap-api** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/directory-server** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/directory-studio** (`(repo-wide)`): [third_party_actions] 1 third-party actions: ossf/scorecard-action
+- **apache/dolphinscheduler** (`api-test.yml:71`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dolphinscheduler** (`backend.yml:73`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dolphinscheduler** (`e2e.yml:66`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dolphinscheduler** (`owasp-dependency-check.yaml:39`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/dolphinscheduler** (`pull-request-target-robot.yml:32`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/dolphinscheduler** (`unit-test.yml:121`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dolphinscheduler-sdk-python** (`ci.yaml:185`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/doris** (`(repo-wide)`): [third_party_actions] 1 third-party actions: mxschmitt/action-tmate
+- **apache/doris** (`auto-cherry-pick.yml:37`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/doris** (`lfs-warning.yml:29`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/doris-opentelemetry-demo** (`(repo-wide)`): [third_party_actions] 4 third-party actions: dyladan/component-owners, fossas/fossa-action, ossf/scorecard-action, umbrelladocs/action-linkspector
+- **apache/doris-opentelemetry-demo** (`label-pr.yml:18`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/doris-operator** (`(repo-wide)`): [third_party_actions] 1 third-party actions: manyuanrong/setup-ossutil
+- **apache/drill** (`ci.yml:86`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/druid** (`(repo-wide)`): [third_party_actions] 3 third-party actions: Kesin11/actions-timeline, amannn/action-semantic-pull-request, mikepenz/action-junit-report
+- **apache/druid** (`pr-merged.yml:36`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/dubbo** (`(repo-wide)`): [third_party_actions] 2 third-party actions: graalvm/setup-graalvm, msys2/setup-msys2
+- **apache/dubbo** (`build-and-test-pr.yml:119`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-admin** (`ci.yml:73`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-getty** (`(repo-wide)`): [third_party_actions] 1 third-party actions: zcong1993/actions-ding
+- **apache/dubbo-getty** (`github-actions.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-go** (`(repo-wide)`): [third_party_actions] 1 third-party actions: release-drafter/release-drafter
+- **apache/dubbo-go** (`github-actions.yml:51`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-go-contrib** (`(repo-wide)`): [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+- **apache/dubbo-go-contrib** (`license.yml:68`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-go-extensions** (`(repo-wide)`): [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+- **apache/dubbo-go-extensions** (`github-actions.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-go-hessian2** (`(repo-wide)`): [third_party_actions] 1 third-party actions: zcong1993/actions-ding
+- **apache/dubbo-go-hessian2** (`github-actions.yml:53`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-go-pixiu** (`(repo-wide)`): [third_party_actions] 2 third-party actions: golangci/golangci-lint-action, wangyoucao577/go-release-action
+- **apache/dubbo-go-pixiu** (`github-actions.yml:38`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-go-pixiu-samples** (`(repo-wide)`): [third_party_actions] 2 third-party actions: golangci/golangci-lint-action, wangyoucao577/go-release-action
+- **apache/dubbo-go-pixiu-samples** (`github-actions.yml:37`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-go-samples** (`(repo-wide)`): [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+- **apache/dubbo-go-samples** (`github-actions.yml:31`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-integration-cases** (`dubbo-3_2.yml:40`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-integration-cases** (`dubbo-3_3.yml:40`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-rust** (`(repo-wide)`): [third_party_actions] 1 third-party actions: actions-rs/toolchain
+- **apache/dubbo-rust** (`github-actions.yml:29`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-rust** (`licence-checker.yml:37`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/dubbo-samples** (`dubbo-3_2.yml:51`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-samples** (`dubbo-3_3.yml:49`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-spi-extensions** (`(repo-wide)`): [third_party_actions] 1 third-party actions: msys2/setup-msys2
+- **apache/dubbo-spi-extensions** (`build-and-test-pr.yml:38`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-spi-extensions** (`conformance.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-spi-samples** (`dubbo-3_2.yml:43`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-spring-boot-project** (`dubbo-2.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/dubbo-test-tools** (`unit-test.yml:29`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/echarts** (`ci.yml:39`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/eventmesh** (`(repo-wide)`): [third_party_actions] 1 third-party actions: dependabot/fetch-metadata
+- **apache/eventmesh-catalog** (`(repo-wide)`): [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+- **apache/eventmesh-dashboard** (`(repo-wide)`): [third_party_actions] 1 third-party actions: dependabot/fetch-metadata
+- **apache/eventmesh-go** (`(repo-wide)`): [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+- **apache/eventmesh-workflow** (`(repo-wide)`): [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+- **apache/felix-dev** (`(repo-wide)`): [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+- **apache/fesod** (`(repo-wide)`): [third_party_actions] 3 third-party actions: DavidAnson/markdownlint-cli2-action, korandoru/hawkeye, nwtgck/actions-netlify
+- **apache/fesod** (`ci.yml:50`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/fineract** (`(repo-wide)`): [third_party_actions] 1 third-party actions: onyxmueller/build-tag-number
+- **apache/fineract** (`build-cucumber.yml:42`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/fineract** (`build-mariadb.yml:59`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/fineract** (`build-mysql.yml:59`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/fineract** (`build-postgresql.yml:60`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/fineract** (`liquibase-only-postgresql.yml:41`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/flagon** (`(repo-wide)`): [third_party_actions] 1 third-party actions: snok/install-poetry
+- **apache/flink** (`(repo-wide)`): [third_party_actions] 1 third-party actions: burnett01/rsync-deployments
+- **apache/flink-agents** (`(repo-wide)`): [third_party_actions] 3 third-party actions: astral-sh/setup-uv, burnett01/rsync-deployments, jlumbroso/free-disk-space
+- **apache/flink-benchmarks** (`(repo-wide)`): [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+- **apache/flink-cdc** (`(repo-wide)`): [third_party_actions] 3 third-party actions: burnett01/rsync-deployments, stCarolas/setup-maven, tcort/github-action-markdown-link-check
+- **apache/flink-connector-aws** (`(repo-wide)`): [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+- **apache/flink-connector-jdbc** (`(repo-wide)`): [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+- **apache/flink-connector-prometheus** (`(repo-wide)`): [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+- **apache/flink-shaded** (`(repo-wide)`): [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+- **apache/fluss** (`ci-template.yaml:35`): [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **apache/fluss-rust** (`(repo-wide)`): [third_party_actions] 6 third-party actions: PyO3/maturin-action, Swatinem/rust-cache, arduino/setup-protoc, astral-sh/setup-uv, mozilla-actions/sccache-action, taiki-e/install-action
+- **apache/fluss-shaded** (`(repo-wide)`): [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+- **apache/fory** (`(repo-wide)`): [third_party_actions] 11 third-party actions: Swatinem/rust-cache, amannn/action-semantic-pull-request, bazel-contrib/setup-bazel, betahuhn/repo-file-sync-action, dart-lang/setup-dart, dtolnay/rust-toolchain, graalvm/setup-graalvm, korandoru/hawkeye, rust-lang/crates-io-auth-action, sbt/setup-sbt +1 more
+- **apache/fory** (`ci.yml:78`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/fory-site** (`(repo-wide)`): [third_party_actions] 1 third-party actions: gaurav-nelson/github-action-markdown-link-check
+- **apache/geaflow** (`(repo-wide)`): [third_party_actions] 1 third-party actions: arduino/setup-protoc
+- **apache/geronimo-arthur** (`maven.yml:40`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/geronimo-batchee** (`ci.yml:52`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/geronimo-mail** (`ci.yml:40`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/geronimo-txmanager** (`maven.yml:32`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/gluten** (`(repo-wide)`): [third_party_actions] 4 third-party actions: burnett01/rsync-deployments, dawidd6/action-download-artifact, jidicula/clang-format-action, scacap/action-surefire-report
+- **apache/gluten** (`clickhouse_be_trigger.yml:47`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/gluten** (`pr_bot.yml:44`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/gluten** (`velox_backend_arm.yml:60`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/gluten** (`velox_backend_enhanced.yml:60`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/gluten** (`velox_backend_x86.yml:62`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/gobblin** (`build_and_test.yaml:50`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/gora** (`(repo-wide)`): [third_party_actions] 1 third-party actions: scacap/action-surefire-report
+- **apache/gora** (`master-pr-build.yml:36`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/gora** (`master-pr-build.yml:39`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/grails-core** (`(repo-wide)`): [third_party_actions] 3 third-party actions: nick-fields/retry, release-drafter/release-drafter, testlens-app/setup-testlens
+- **apache/grails-core** (`groovy-joint-workflow.yml:44`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/grails-github-actions** (`(repo-wide)`): [third_party_actions] 1 third-party actions: release-drafter/release-drafter
+- **apache/grails-gradle-publish** (`(repo-wide)`): [third_party_actions] 1 third-party actions: release-drafter/release-drafter
+- **apache/grails-quartz** (`(repo-wide)`): [third_party_actions] 1 third-party actions: release-drafter/release-drafter
+- **apache/grails-redis** (`(repo-wide)`): [third_party_actions] 1 third-party actions: release-drafter/release-drafter
+- **apache/grails-spring-security** (`(repo-wide)`): [third_party_actions] 1 third-party actions: release-drafter/release-drafter
+- **apache/grails-static-website** (`(repo-wide)`): [third_party_actions] 1 third-party actions: scacap/action-surefire-report
+- **apache/gravitino** (`(repo-wide)`): [third_party_actions] 2 third-party actions: container-tools/kind-action, helm/chart-testing-action
+- **apache/gravitino-site** (`(repo-wide)`): [third_party_actions] 1 third-party actions: korandoru/hawkeye
+- **apache/hadoop** (`labeler.yml:31`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/hertzbeat** (`(repo-wide)`): [third_party_actions] 3 third-party actions: DavidAnson/markdownlint-cli2-action, dtolnay/rust-toolchain, graalvm/setup-graalvm
+- **apache/hertzbeat** (`mcp-bashserver-test.yml:53`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hertzbeat-collector-go** (`(repo-wide)`): [third_party_actions] 1 third-party actions: amannn/action-semantic-pull-request
+- **apache/hertzbeat-helm-chart** (`(repo-wide)`): [third_party_actions] 1 third-party actions: helm/chart-testing-action
+- **apache/hive** (`(repo-wide)`): [third_party_actions] 1 third-party actions: helm/kind-action
+- **apache/hop** (`(repo-wide)`): [third_party_actions] 1 third-party actions: damccorm/tag-ur-it
+- **apache/hop** (`pr_build_code.yml:42`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/httpcomponents-client** (`maven.yml:39`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/httpcomponents-core** (`maven.yml:39`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/httpd** (`linux.yml:359`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hudi** (`(repo-wide)`): [third_party_actions] 1 third-party actions: amannn/action-semantic-pull-request
+- **apache/hudi-rs** (`(repo-wide)`): [third_party_actions] 3 third-party actions: PyO3/maturin-action, Swatinem/rust-cache, astral-sh/setup-uv
+- **apache/hudi-rs** (`ci.yml:179`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph** (`cluster-test-ci.yml:25`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph** (`commons-ci.yml:31`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph** (`pd-store-ci.yml:25`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph** (`server-ci.yml:57`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph-ai** (`(repo-wide)`): [third_party_actions] 1 third-party actions: aormsby/Fork-Sync-With-Upstream-action
+- **apache/hugegraph-ai** (`hugegraph-llm.yml:56`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph-ai** (`hugegraph-python-client.yml:39`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph-ai** (`ruff.yml:32`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph-computer** (`computer-ci.yml:55`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph-doc** (`hugo.yml:36`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph-doc** (`validate-release.yml:42`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph-toolchain** (`client-ci.yml:44`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph-toolchain** (`client-go-ci.yml:47`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph-toolchain** (`hubble-ci.yml:61`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph-toolchain** (`loader-ci.yml:60`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph-toolchain** (`spark-connector-ci.yml:47`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/hugegraph-toolchain** (`tools-ci.yml:47`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/incubator-devlake-helm-chart** (`(repo-wide)`): [third_party_actions] 1 third-party actions: container-tools/kind-action
+- **apache/kafka** (`(repo-wide)`): [third_party_actions] 1 third-party actions: lhotari/sandboxed-trivy-action
+- **apache/kafka** (`pr-labeled.yml:38`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/kafka** (`pr-update.yml:40`): [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **apache/karaf** (`(repo-wide)`): [third_party_actions] 1 third-party actions: dawidd6/action-download-artifact
+- **apache/karaf-decanter** (`(repo-wide)`): [third_party_actions] 1 third-party actions: dawidd6/action-download-artifact
+- **apache/karaf-decanter** (`ci.yml:49`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/karaf-winegrower** (`maven.yml:39`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/kvrocks** (`(repo-wide)`): [third_party_actions] 3 third-party actions: SonarSource/sonarqube-scan-action, amannn/action-semantic-pull-request, crate-ci/typos
+- **apache/kvrocks** (`kvrocks.yaml:80`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/kvrocks-controller** (`ci.yaml:50`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/kyuubi** (`master.yml:114`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **apache/kyuubi** (`web-ui.yml:44`): [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+</details>
+
+## Detailed Results by Repository
+
+### apache/accumulo
+
+**4** findings | LOW: 4
+
+- **[LOW]** `maven-full-its.yaml:75` — [run_block_injection] Workflow input `${{ github.event.inputs.numITsPerTask }}` directly interpolated in run block at step 'Build with Maven (Fast Build)' in workflow maven-full-its.yaml. Trusted committer input but should use env: block.
+- **[LOW]** `maven-on-demand.yaml:90` — [run_block_injection] 5 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.addOpts`, `github.event.inputs.goals`, `github.event.inputs.itOpts`, `github.event.inputs.mvnOpts`, `github.event.inputs.utOpts`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-access
+
+**3** findings | LOW: 3
+
+- **[LOW]** `maven-on-demand.yaml:53` — [run_block_injection] Workflow input `${{ github.event.inputs.goals }}` directly interpolated in run block at step 'Build with Maven' in workflow maven-on-demand.yaml. Trusted committer input but should use env: block.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-classloaders
+
+**3** findings | LOW: 3
+
+- **[LOW]** `maven-on-demand.yaml:53` — [run_block_injection] Workflow input `${{ github.event.inputs.goals }}` directly interpolated in run block at step 'Build with Maven' in workflow maven-on-demand.yaml. Trusted committer input but should use env: block.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-examples
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-fluo
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-fluo-bytes
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-fluo-examples
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-fluo-muchos
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-fluo-recipes
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-fluo-uno
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-fluo-website
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `ruby/setup-ruby` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-fluo-yarn
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-instamo-archetype
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-maven-plugin
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-proxy
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-testing
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-website
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `ruby/setup-ruby` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/accumulo-wikisearch
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/activemq
+
+**2** findings | LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `EnricoMi/publish-unit-test-result-action` (3).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/activemq-nms-amqp
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/activemq-nms-openwire
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/age
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `installcheck.yaml:20` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/age-viewer
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/age-website
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/airavata
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/metadata-action` (1), `docker/build-push-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/airavata-django-portal
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/airavata-mft
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/airflow
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `release_single_dockerhub_image.yml:91,92,185,186` — [run_block_injection] 4 instances of direct interpolation in run blocks. Expressions: `secrets.DOCKERHUB_TOKEN`, `secrets.DOCKERHUB_USER`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: astral-sh/setup-uv, slackapi/slack-github-action
+
+### apache/airflow-client-go
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/airflow-client-python
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/airflow-publish
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pypa/gh-action-pypi-publish` (4).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/airflow-site
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/airflow-site-archive
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/allura
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/ambari-metrics
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/ambari-website
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/amoro
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 22 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (3), `docker/setup-qemu-action` (3), `docker/setup-buildx-action` (3), `docker/metadata-action` (3), `docker/login-action` (3).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/amoro-shade
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/answer
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 22 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/metadata-action` (4), `docker/setup-qemu-action` (4), `docker/setup-buildx-action` (4), `docker/login-action` (4), `docker/build-push-action` (4).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: goreleaser/goreleaser-action, korandoru/hawkeye
+
+### apache/answer-plugins
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `korandoru/hawkeye` (1), `peter-evans/create-pull-request` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: korandoru/hawkeye
+
+### apache/answer-website
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pnpm/action-setup` (1), `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `deploy.yml:19` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/apachecon-acasia
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/apachecon-eu
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/apisix
+
+**6** findings | INFO: 5, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `build.yml:55` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `cli.yml:46` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `redhat-ci.yaml:39` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `semantic.yml:20` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `source-install.yml:56` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/apisix-control-plane
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+
+### apache/apisix-dashboard
+
+**2** findings | LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pnpm/action-setup` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/apisix-docker
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/login-action` (2), `docker/setup-qemu-action` (2), `docker/setup-buildx-action` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/apisix-go-plugin-runner
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/apisix-helm-chart
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/apisix-ingress-controller
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/login-action` (1), `release-drafter/release-drafter` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: release-drafter/release-drafter
+
+### apache/apisix-java-plugin-runner
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/apisix-python-plugin-runner
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/apisix-website
+
+**2** findings | LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/apr
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/apr-util
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/aries
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: jwgmeligmeyling/pmd-github-action
+
+### apache/aries-cdi
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/aries-component-dsl
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/aries-jax-rs-whiteboard
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/aries-jpa
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/aries-rsa
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/arrow
+
+**24** findings | INFO: 14, LOW: 7, MEDIUM: 3
+
+- **[MEDIUM]** `cpp.yml:134` — [self_hosted_runner] Self-hosted runner with PR trigger, but permissions are limited to: read-only. Blast radius is reduced — no access to publishing secrets or contents:write.
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 9 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `r-lib/actions` (4), `msys2/setup-msys2` (2), `ruby/setup-ruby` (2), `eps1lon/actions-label-merge-conflict` (1).
+- **[MEDIUM]** `.github/actions/sync-nightlies/action.yml:85` — [composite_action_input_injection] Composite action `sync-nightlies` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[LOW]** `cpp_extra.yml:608,610` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.GITHUB_TOKEN`.
+- **[LOW]** `dev.yml:111` — [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Run Release Test' in workflow dev.yml. Trusted value but risks log leakage.
+- **[LOW]** `dev_pr.yml` — [prt_checkout] pull_request_target trigger with checkout action using custom ref. Verify the ref does not resolve to untrusted PR code.
+- **[LOW]** `pr_bot.yml` — [prt_checkout] pull_request_target trigger with checkout action using custom ref. Verify the ref does not resolve to untrusted PR code.
+- **[LOW]** `ruby.yml:427,429` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.GITHUB_TOKEN`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `.github/actions/sync-nightlies/action.yml:85` — [composite_action_injection] Workflow input `${{ inputs.upload }}` directly interpolated in run block at step 'Sync files' in composite action .github/actions/sync-nightlies. Trusted committer input but should use env: block.
+- **[INFO]** `cpp.yml:123` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `cpp_extra.yml:145` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `cuda_extra.yml:91` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `dev.yml:63` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `docs.yml:60` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `docs_light.yml:58` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `integration.yml:114` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `matlab.yml:74` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `package_linux.yml:189` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `python.yml:115` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `r.yml:90` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `r_extra.yml:172` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `ruby.yml:90` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 6 third-party actions: conda-incubator/setup-miniconda, eps1lon/actions-label-merge-conflict, matlab-actions/run-tests, matlab-actions/setup-matlab, msys2/setup-msys2, r-lib/actions
+
+### apache/arrow-adbc
+
+**11** findings | INFO: 7, LOW: 4
+
+- **[LOW]** `packaging.yml:170,225,334,526,592,665,785,968,1067` — [run_block_injection] 9 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.upload_artifacts`, `inputs.upload_artifacts`.
+- **[LOW]** `r-check.yml:77` — [run_block_injection] Workflow input `${{ inputs.pkg }}` directly interpolated in run block at step 'Bootstrap R Package' in workflow r-check.yml. Trusted committer input but should use env: block.
+- **[LOW]** `verify.yml:76,131,143` — [run_block_injection] 6 instances of direct interpolation in run blocks. Expressions: `inputs.rc`, `inputs.version`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `dev.yml:94` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `dev_adbc.yml:54` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `integration.yml:69` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `native-unix.yml:96` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `native-windows.yml:77` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `packaging.yml:424` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: astral-sh/setup-uv, conda-incubator/setup-miniconda, r-lib/actions
+
+### apache/arrow-cookbook
+
+**4** findings | INFO: 2, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 12 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `r-lib/actions` (8), `conda-incubator/setup-miniconda` (4).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `test_cpp_cookbook.yml:43` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: conda-incubator/setup-miniconda, r-lib/actions
+
+### apache/arrow-dotnet
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `test.yaml:48` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/arrow-flight-sql-postgresql
+
+**2** findings | LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 9 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `ruby/setup-ruby` (5), `docker/login-action` (1), `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/build-push-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/arrow-go
+
+**5** findings | INFO: 3, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `msys2/setup-msys2` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `lint.yml:56` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `test.yml:392` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: msys2/setup-msys2
+
+### apache/arrow-java
+
+**5** findings | INFO: 4, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `dev.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `dev_pr.yml:46` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `rc.yml:136` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `test.yml:66` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/arrow-js
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `test.yaml:61` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/arrow-julia
+
+**4** findings | INFO: 2, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 17 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `julia-actions/setup-julia` (6), `julia-actions/julia-buildpkg` (3), `julia-actions/julia-runtest` (2), `julia-actions/julia-processcoverage` (2), `codecov/codecov-action` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `ci.yml:65` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 6 third-party actions: JuliaRegistries/TagBot, julia-actions/julia-buildpkg, julia-actions/julia-docdeploy, julia-actions/julia-processcoverage, julia-actions/julia-runtest, julia-actions/setup-julia
+
+### apache/arrow-nanoarrow
+
+**11** findings | INFO: 7, LOW: 2, MEDIUM: 2
+
+- **[MEDIUM]** `build-and-test-device.yaml:78` — [self_hosted_runner] Self-hosted runner with PR trigger, but permissions are limited to: read-only. Blast radius is reduced — no access to publishing secrets or contents:write.
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 11 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `r-lib/actions` (8), `ilammy/msvc-dev-cmd` (2), `codecov/codecov-action` (1).
+- **[LOW]** `verify.yaml:117` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `inputs.rc`, `inputs.version`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `build-and-test-device.yaml:94` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `build-and-test-ipc.yaml:72` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `build-and-test.yaml:64` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `clang-tidy.yaml:47` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `dev.yaml:44` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `verify.yaml:89` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: ilammy/msvc-dev-cmd, r-lib/actions
+
+### apache/arrow-rs
+
+**4** findings | INFO: 2, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `dev_pr.yml:40` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `integration.yml:206` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/arrow-rs-object-store
+
+**3** findings | INFO: 1, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `taiki-e/install-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: taiki-e/install-action
+
+### apache/arrow-site
+
+**2** findings | LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `ruby/setup-ruby` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/arrow-swift
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `test.yaml:46` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: swift-actions/setup-swift
+
+### apache/artemis
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `build.yml:44` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/artemis-console
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/artemis-examples
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `build.yml:41` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/artemis-native
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `build.yml:19` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/atlas
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:44` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/attic
+
+**4** findings | LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `ruby/setup-ruby` (2).
+- **[LOW]** `retire.yml:48,74,88` — [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.comment`, `github.event.inputs.processId`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/auron
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `arduino/setup-protoc` (3), `Mattraks/delete-workflow-runs` (1).
+- **[LOW]** `tpcds-reusable.yml:124,127,128,132,133,137,138,141,145,178,201,205,206,211,212,229,230,232,237,238,262,263,265,315,349,350,354,355,356,363,372,384,405,406,407` — [run_block_injection] 51 instances of direct interpolation in run blocks. Expressions: `inputs.celebornver`, `inputs.extrasparkconf`, `inputs.hadoop-profile`, `inputs.hadoopver`, `inputs.scalaver` +3 more.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `build-amd64-releases.yml:94` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: Mattraks/delete-workflow-runs, arduino/setup-protoc
+
+### apache/auron-sites
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/avro
+
+**14** findings | INFO: 12, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `shogo82148/actions-setup-perl` (2), `shivammathur/setup-php` (2), `ruby/setup-ruby` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `maven4.yml:38` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `rat.yml:35` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `spotless.yml:38` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `test-lang-c.yml:64` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `test-lang-csharp.yml:58` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `test-lang-java.yml:50` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `test-lang-js.yml:54` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `test-lang-perl.yml:109` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `test-lang-php.yml:64` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `test-lang-py.yml:123` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `test-lang-ruby.yml:59` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 5 third-party actions: astral-sh/setup-uv, dtolnay/rust-toolchain, shivammathur/setup-php, shogo82148/actions-setup-perl, stCarolas/setup-maven
+
+### apache/avro-rs
+
+**4** findings | INFO: 2, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `taiki-e/install-action` (3), `shogo82148/actions-setup-perl` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `test-lang-rust-ci.yml:78` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 4 third-party actions: dtolnay/rust-toolchain, shogo82148/actions-setup-perl, stCarolas/setup-maven, taiki-e/install-action
+
+### apache/axis-axis1-java
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:38` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/axis-axis2-c-core
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/axis-axis2-java-core
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `ci.yml:39` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/axis-axis2-java-rampart
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:39` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/beam
+
+**702** findings | HIGH: 189, INFO: 307, LOW: 194, MEDIUM: 12
+
+- **[HIGH]** `IO_Iceberg_Integration_Tests.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `IO_Iceberg_Integration_Tests_Dataflow.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `IO_Iceberg_Managed_Integration_Tests_Dataflow.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `IO_Iceberg_Performance_Tests.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `IO_Iceberg_Unit_Tests.yml:83` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_CloudML_Benchmarks_Dataflow.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_Java_JMH.yml:61` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_Playground_Precommit.yml:39` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Go.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Go_Dataflow_ARM.yml:61` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Go_VR_Flink.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Go_VR_Samza.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Go_VR_Spark.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Avro_Versions.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_BigQueryEarlyRollout.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_DataflowV1.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_DataflowV2.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Examples_Dataflow.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Examples_Dataflow_ARM.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Examples_Dataflow_Java.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Examples_Dataflow_V2.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Examples_Dataflow_V2_Java.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Examples_Direct.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Examples_Flink.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Examples_Spark.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Hadoop_Versions.yml:54` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_IO_Performance_Tests.yml:61` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_InfluxDbIO_IT.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Jpms_Dataflow.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Jpms_Dataflow_Versions.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Jpms_Direct.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Jpms_Direct_Versions.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Jpms_Flink_Java11.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Jpms_Spark_Java11.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Nexmark_Dataflow.yml:81` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Nexmark_Dataflow_V2.yml:82` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Nexmark_Dataflow_V2_Java.yml:81` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Nexmark_Direct.yml:76` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Nexmark_Flink.yml:75` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Nexmark_Spark.yml:75` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_PVR_Flink_Batch.yml:74` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_PVR_Flink_Streaming.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_PVR_Samza.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_PVR_Spark3_Streaming.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_PVR_Spark_Batch.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_SingleStoreIO_IT.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Tpcds_Dataflow.yml:85` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Tpcds_Flink.yml:82` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_Tpcds_Spark.yml:80` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Dataflow.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_JavaVersions.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_Engine.yml:55` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_TagEncodingV2.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_V2.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_V2_Streaming.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Direct.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Direct_JavaVersions.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Flink.yml:54` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Flink_Java8.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Samza.yml:54` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Spark.yml:54` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_SparkStructuredStreaming.yml:54` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Spark_Java8.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_Twister2.yml:54` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Java_ValidatesRunner_ULR.yml:54` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Javadoc.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_PortableJar_Flink.yml:59` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_PortableJar_Spark.yml:59` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python.yml:65` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_Arm.yml:108` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_Dependency.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_Examples_Dataflow.yml:59` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_Examples_Direct.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_Examples_Flink.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_Examples_Spark.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_MongoDBIO_IT.yml:59` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_Nexmark_Direct.yml:93` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_Portable_Flink.yml:57` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_ValidatesContainer_Dataflow.yml:60` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_ValidatesContainer_Dataflow_With_RC.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_ValidatesRunner_Dataflow.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_ValidatesRunner_Flink.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_ValidatesRunner_Samza.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_ValidatesRunner_Spark.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_Xlang_Gcp_Dataflow.yml:59` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_Xlang_Gcp_Direct.yml:59` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_Xlang_IO_Dataflow.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Python_Xlang_IO_Direct.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_SQL.yml:56` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_TransformService_Direct.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Website_Test.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_XVR_Direct.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_XVR_Flink.yml:59` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_XVR_GoUsingJava_Dataflow.yml:61` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_XVR_JavaUsingPython_Dataflow.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_XVR_PythonUsingJavaSQL_Dataflow.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_XVR_PythonUsingJava_Dataflow.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_XVR_Samza.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_XVR_Spark3.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PostCommit_Yaml_Xlang_Direct.yml:57` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_CommunityMetrics.yml:62` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Flink_Container.yml:93` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_GHA.yml:61` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Go.yml:61` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_GoPortable.yml:63` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_GoPrism.yml:61` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_ItFramework.yml:67` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java.yml:157` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Amazon-Web-Services2_IO_Direct.yml:95` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Amqp_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Azure_IO_Direct.yml:95` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Cassandra_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Cdap_IO_Direct.yml:81` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Clickhouse_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Csv_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Datadog_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Debezium_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_ElasticSearch_IO_Direct.yml:79` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Examples_Dataflow.yml:78` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Examples_Dataflow_Java21.yml:87` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_File-schema-transform_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Flink_Versions.yml:69` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_GCP_IO_Direct.yml:95` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Google-ads_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_HBase_IO_Direct.yml:79` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_HCatalog_IO_Direct.yml:79` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Hadoop_IO_Direct.yml:103` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_IOs_Direct.yml:80` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_InfluxDb_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_JDBC_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Jms_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Kafka_IO_Direct.yml:85` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Kudu_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_MongoDb_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Mqtt_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Neo4j_IO_Direct.yml:79` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_PVR_Flink_Batch.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_PVR_Flink_Docker.yml:76` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_PVR_Prism_Loopback.yml:83` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Parquet_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Pulsar_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_RabbitMq_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Redis_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_RequestResponse_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_SingleStore_IO_Direct.yml:79` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Snowflake_IO_Direct.yml:81` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Solace_IO_Direct.yml:89` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Solr_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Spark3_Versions.yml:68` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Splunk_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Thrift_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Java_Tika_IO_Direct.yml:77` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Kotlin_Examples.yml:79` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Portable_Python.yml:79` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Prism_Python.yml:73` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Python.yml:79` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_PythonDocker.yml:58` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_PythonDocs.yml:61` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_PythonFormatter.yml:60` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_PythonLint.yml:60` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Python_Coverage.yml:62` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Python_Dataframes.yml:60` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Python_Dill.yml:70` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Python_Examples.yml:61` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Python_Integration.yml:60` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Python_ML.yml:69` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Python_PVR_Flink.yml:91` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Python_Runners.yml:60` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Python_Transforms.yml:61` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_RAT.yml:59` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_SQL.yml:61` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_SQL_Java17.yml:72` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_SQL_Java8.yml:61` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Spotless.yml:66` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Typescript.yml:63` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Website.yml:61` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Website_Stage_GCS.yml:63` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Whitespace.yml:60` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Xlang_Generated_Transforms.yml:81` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_PreCommit_Yaml_Xlang_Direct.yml:72` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `beam_Prober_CommunityMetrics.yml:57` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `build_runner_image.yml:24` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `build_wheels.yml:48` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `go_tests.yml:39` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `java_tests.yml:48` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `python_tests.yml:44` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[HIGH]** `typescript_tests.yml:54` — [self_hosted_runner] Self-hosted runner with PR trigger. External contributors can execute arbitrary code on self-hosted infrastructure with broad permissions.
+- **[MEDIUM]** `beam_Infrastructure_UsersPermissions.yml:50` — [prt_checkout] pull_request_target checks out PR head code, but permissions are limited to: pull-requests. Blast radius is reduced — no access to publishing secrets or contents:write.
+- **[MEDIUM]** `beam_Infrastructure_UsersPermissions.yml:44` — [self_hosted_runner] Self-hosted runner with PR trigger, but permissions are limited to: pull-requests. Blast radius is reduced — no access to publishing secrets or contents:write.
+- **[MEDIUM]** `run_perf_alert_tool.yml:33` — [self_hosted_runner] Self-hosted runner with PR trigger, but permissions are limited to: issues. Blast radius is reduced — no access to publishing secrets or contents:write.
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 208 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `EnricoMi/publish-unit-test-result-action` (140), `jwgmeligmeyling/spotbugs-github-action` (42), `jlumbroso/free-disk-space` (7), `codecov/codecov-action` (5), `dawidd6/action-send-mail` (4).
+- **[MEDIUM]** `.github/actions/build-push-docker-action/action.yml:37` — [composite_action_input_injection] Composite action `build-push-docker-action` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[MEDIUM]** `.github/actions/dind-up-action/action.yml:112` — [composite_action_input_injection] Composite action `dind-up-action` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[MEDIUM]** `.github/actions/gradle-command-self-hosted-action/action.yml:44` — [composite_action_input_injection] Composite action `gradle-command-self-hosted-action` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[MEDIUM]** `.github/actions/rerun-job-action/action.yml:49` — [composite_action_input_injection] Composite action `rerun-job-action` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[MEDIUM]** `.github/actions/setup-action/action.yml:39` — [composite_action_input_injection] Composite action `setup-action` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[MEDIUM]** `.github/actions/setup-k8s-access/action.yml:71` — [composite_action_unpinned] Composite action uses unpinned action `pyTooling/Actions/with-post-step@v4.2.2`. Supply chain risk.
+- **[MEDIUM]** `.github/actions/setup-k8s-access/action.yml:48` — [composite_action_input_injection] Composite action `setup-k8s-access` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[MEDIUM]** `.github/actions/test-arguments-action/action.yml:42` — [composite_action_input_injection] Composite action `test-arguments-action` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[LOW]** `IO_Iceberg_Integration_Tests.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `IO_Iceberg_Integration_Tests_Dataflow.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `IO_Iceberg_Managed_Integration_Tests_Dataflow.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `IO_Iceberg_Performance_Tests.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `IO_Iceberg_Unit_Tests.yml:44` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_LoadTests_Java_CoGBK_Dataflow_Streaming.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_LoadTests_Java_GBK_Dataflow_Batch.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_LoadTests_Java_GBK_Dataflow_Streaming.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_LoadTests_Java_GBK_Dataflow_V2_Batch.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_LoadTests_Java_GBK_Dataflow_V2_Batch_Java17.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_LoadTests_Java_GBK_Dataflow_V2_Streaming.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_LoadTests_Java_GBK_Dataflow_V2_Streaming_Java17.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_LoadTests_Java_GBK_SparkStructuredStreaming_Batch.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_AvroIOIT.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_AvroIOIT_HDFS.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_BigQueryIO_Batch_Java_Avro.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_BigQueryIO_Batch_Java_Json.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_BigQueryIO_Streaming_Java.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_BiqQueryIO_Read_Python.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_BiqQueryIO_Write_Python_Batch.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_Cdap.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_Compressed_TextIOIT.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_Compressed_TextIOIT_HDFS.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_HadoopFormat.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_JDBC.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_Kafka_IO.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_ManyFiles_TextIOIT.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_ManyFiles_TextIOIT_HDFS.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_MongoDBIO_IT.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_ParquetIOIT.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_ParquetIOIT_HDFS.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_PubsubIOIT_Python_Streaming.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_SQLBigQueryIO_Batch_Java.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_SpannerIO_Read_2GB_Python.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_SpannerIO_Write_2GB_Python_Batch.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_SparkReceiver_IO.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_TFRecordIOIT.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_TFRecordIOIT_HDFS.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_TextIOIT.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_TextIOIT_HDFS.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_TextIOIT_Python.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_WordCountIT_PythonVersions.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_XmlIOIT.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PerformanceTests_XmlIOIT_HDFS.yml:24` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Avro_Versions.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_DataflowV1.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_DataflowV2.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Examples_Dataflow.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Examples_Dataflow_ARM.yml:40` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Examples_Dataflow_Java.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Examples_Dataflow_V2.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Examples_Dataflow_V2_Java.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Examples_Direct.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Examples_Flink.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Examples_Spark.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Hadoop_Versions.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_IO_Performance_Tests.yml:28` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Jpms_Dataflow.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Jpms_Dataflow_Versions.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Jpms_Direct.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Jpms_Direct_Versions.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Jpms_Flink_Java11.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Jpms_Spark_Java11.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Nexmark_Dataflow.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Nexmark_Dataflow_V2.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Nexmark_Dataflow_V2_Java.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Nexmark_Direct.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Nexmark_Flink.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_Nexmark_Spark.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_PVR_Flink_Batch.yml:44` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_PVR_Flink_Streaming.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_PVR_Samza.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_PVR_Spark3_Streaming.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_PVR_Spark_Batch.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Dataflow.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_JavaVersions.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_Engine.yml:32` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_TagEncodingV2.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_V2.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_V2_Streaming.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Direct.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Direct_JavaVersions.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Flink.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Flink_Java8.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Samza.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Spark.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_SparkStructuredStreaming.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Spark_Java8.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_Twister2.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Java_ValidatesRunner_ULR.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_PortableJar_Flink.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_PortableJar_Spark.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_Arm.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_Dependency.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_Examples_Dataflow.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_Examples_Direct.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_Examples_Flink.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_Examples_Spark.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_MongoDBIO_IT.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_Portable_Flink.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_ValidatesContainer_Dataflow.yml:28` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_ValidatesContainer_Dataflow_With_RC.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_ValidatesRunner_Dataflow.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_ValidatesRunner_Flink.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_ValidatesRunner_Samza.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_ValidatesRunner_Spark.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_Xlang_Gcp_Dataflow.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_Xlang_Gcp_Direct.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_Xlang_IO_Dataflow.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Python_Xlang_IO_Direct.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_SQL.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_TransformService_Direct.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_XVR_GoUsingJava_Dataflow.yml:29` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_XVR_PythonUsingJavaSQL_Dataflow.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_XVR_PythonUsingJava_Dataflow.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PostCommit_Yaml_Xlang_Direct.yml:26` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_ItFramework.yml:50` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java.yml:134` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Amazon-Web-Services2_IO_Direct.yml:56` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Amqp_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Azure_IO_Direct.yml:56` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Cassandra_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Cdap_IO_Direct.yml:42` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Clickhouse_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Csv_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Datadog_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Debezium_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_ElasticSearch_IO_Direct.yml:40` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Examples_Dataflow.yml:60` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Examples_Dataflow_Java21.yml:48` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_File-schema-transform_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Flink_Versions.yml:41` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_GCP_IO_Direct.yml:56` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Google-ads_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_HBase_IO_Direct.yml:40` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_HCatalog_IO_Direct.yml:40` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Hadoop_IO_Direct.yml:64` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_IOs_Direct.yml:42` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_InfluxDb_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_JDBC_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Jms_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Kafka_IO_Direct.yml:46` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Kudu_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_MongoDb_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Mqtt_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Neo4j_IO_Direct.yml:40` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_PVR_Flink_Batch.yml:49` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_PVR_Flink_Docker.yml:48` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_PVR_Prism_Loopback.yml:55` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Parquet_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Pulsar_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_RabbitMq_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Redis_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_RequestResponse_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_SingleStore_IO_Direct.yml:40` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Snowflake_IO_Direct.yml:42` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Solace_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Solr_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Spark3_Versions.yml:45` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Splunk_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Thrift_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Java_Tika_IO_Direct.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Python.yml:32` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Python_Coverage.yml:32` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Python_Dataframes.yml:32` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Python_Dill.yml:34` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Python_Examples.yml:32` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Python_Integration.yml:32` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Python_ML.yml:32` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Python_PVR_Flink.yml:52` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Python_Runners.yml:32` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Python_Transforms.yml:32` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_SQL.yml:38` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_SQL_Java17.yml:33` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_SQL_Java8.yml:43` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_PreCommit_Yaml_Xlang_Direct.yml:40` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `beam_Release_NightlySnapshot.yml:75,76` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.NEXUS_PW`, `secrets.NEXUS_USER`.
+- **[LOW]** `build_release_candidate.yml:87,88,92,93,114,118,135,136,137,139,140,141,165,181,185,249,301,383,386,389,392,396,399,402,403,404,407,417,445,449,551,599,600,614` — [run_block_injection] 43 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.APACHE_ID`, `github.event.inputs.APACHE_PASSWORD`, `github.event.inputs.RC`, `github.event.inputs.RELEASE`, `secrets.NEXUS_PW` +3 more.
+- **[LOW]** `deploy_release_candidate_pypi.yaml:64,70,71,86` — [run_block_injection] 4 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.PYPI_API_TOKEN`, `github.event.inputs.RC`.
+- **[LOW]** `finalize_release.yml:128` — [run_block_injection] Workflow input `${{ github.event.inputs.PYPI_API_TOKEN }}` directly interpolated in run block at step 'Deploy to Pypi' in workflow finalize_release.yml. Trusted committer input but should use env: block.
+- **[LOW]** `git_tag_released_version.yml:47,48,51,52` — [run_block_injection] 6 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.RC_TAG`, `github.event.inputs.VERSION_TAG`.
+- **[LOW]** `pr-bot-pr-updates.yml` — [prt_checkout] pull_request_target trigger with checkout action using custom ref. Verify the ref does not resolve to untrusted PR code.
+- **[LOW]** `run_rc_validation_go_wordcount.yml:21` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, checks, issues.
+- **[LOW]** `run_rc_validation_java_mobile_gaming.yml:78` — [run_block_injection] Workflow input `${{ github.event.inputs.GCS_BUCKET }}` directly interpolated in run block at step 'Extract GCS Bucket Name' in workflow run_rc_validation_java_mobile_gaming.yml. Trusted committer input but should use env: block.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `.github/actions/build-push-docker-action/action.yml:37,41` — [composite_action_injection] 4 instances of direct interpolation in run blocks. Expressions: `inputs.build_context`, `inputs.dockerfile_path`, `inputs.image_name`, `inputs.image_tag`.
+- **[LOW]** `.github/actions/dind-up-action/action.yml:112,113,114,115,116,117,118,119,120,121,122,124,129,130,148,180,181,182,183,196,197,218` — [composite_action_injection] 22 instances of direct interpolation in run blocks. Expressions: `inputs.additional-dockerd-args`, `inputs.bind-address || '127.0.0.1'`, `inputs.container-name || 'dind-daemon'`, `inputs.dind-image || 'docker:27-dind'`, `inputs.ephemeral-volumes` +11 more.
+- **[LOW]** `.github/actions/gradle-command-self-hosted-action/action.yml:44,46` — [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.arguments`, `inputs.gradle-command`, `inputs.max-workers`.
+- **[LOW]** `.github/actions/rerun-job-action/action.yml:49,51,59,61,63,66,87,89,98,100,103,109,111,122,123` — [composite_action_injection] 15 instances of direct interpolation in run blocks. Expressions: `inputs.github_current_run_id`, `inputs.github_job`, `inputs.github_repository`, `inputs.github_token`, `inputs.pull_request_url`.
+- **[LOW]** `.github/actions/setup-action/action.yml:39` — [composite_action_injection] Workflow input `${{ inputs.comment_phrase }}` directly interpolated in run block at step 'Check if the phrase is correct' in composite action .github/actions/setup-action. Trusted committer input but should use env: block.
+- **[LOW]** `.github/actions/setup-k8s-access/action.yml:48,56,61` — [composite_action_injection] 4 instances of direct interpolation in run blocks. Expressions: `inputs.cluster_name`, `inputs.cluster_zone`, `inputs.k8s_namespace`.
+- **[LOW]** `.github/actions/test-arguments-action/action.yml:42,49,65,71,82,85,87` — [composite_action_injection] 7 instances of direct interpolation in run blocks. Expressions: `inputs.argument-file-paths`, `inputs.arguments`, `inputs.test-language`, `inputs.test-language == 'java'`, `inputs.test-language == 'python' || inputs.test-language == 'go'` +2 more.
+- **[INFO]** `IO_Iceberg_Integration_Tests.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `IO_Iceberg_Integration_Tests_Dataflow.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `IO_Iceberg_Managed_Integration_Tests_Dataflow.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `IO_Iceberg_Performance_Tests.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `IO_Iceberg_Unit_Tests.yml:85` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_CancelStaleDataflowJobs.yml:54` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_CleanUpDataprocResources.yml:54` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_CleanUpGCPResources.yml:54` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_CleanUpPrebuiltSDKImages.yml:54` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_CloudML_Benchmarks_Dataflow.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_IODatastoresCredentialsRotation.yml:54` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Inference_Python_Benchmarks_Dataflow.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Infrastructure_PolicyEnforcer.yml:42` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Infrastructure_SecurityLogging.yml:44` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Infrastructure_ServiceAccountKeys.yml:48` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Java_JMH.yml:65` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_Java_LoadTests_Combine_Smoke.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Go_CoGBK_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Go_CoGBK_Flink_batch.yml:67` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Go_Combine_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Go_Combine_Flink_Batch.yml:67` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Go_GBK_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Go_GBK_Flink_Batch.yml:67` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Go_ParDo_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Go_ParDo_Flink_Batch.yml:67` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Go_SideInput_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Go_SideInput_Flink_Batch.yml:67` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_CoGBK_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_CoGBK_Dataflow_Streaming.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_CoGBK_Dataflow_V2_Batch_JavaVersions.yml:58` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_CoGBK_Dataflow_V2_Streaming_JavaVersions.yml:58` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_CoGBK_SparkStructuredStreaming_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_Combine_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_Combine_Dataflow_Streaming.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_Combine_SparkStructuredStreaming_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_GBK_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_GBK_Dataflow_Streaming.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_GBK_Dataflow_V2_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_GBK_Dataflow_V2_Batch_Java17.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_GBK_Dataflow_V2_Streaming.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_GBK_Dataflow_V2_Streaming_Java17.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_GBK_Smoke.yml:54` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_GBK_SparkStructuredStreaming_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_ParDo_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_ParDo_Dataflow_Streaming.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_ParDo_Dataflow_V2_Batch_JavaVersions.yml:58` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_ParDo_Dataflow_V2_Streaming_JavaVersions.yml:58` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_ParDo_SparkStructuredStreaming_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Java_PubsubIO.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_CoGBK_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_CoGBK_Dataflow_Streaming.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_CoGBK_Flink_Batch.yml:67` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_Combine_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_Combine_Dataflow_Streaming.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_Combine_Flink_Batch.yml:67` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_Combine_Flink_Streaming.yml:67` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_FnApiRunner_Microbenchmark.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_GBK_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_GBK_Dataflow_Streaming.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_GBK_Flink_Batch.yml:67` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_GBK_reiterate_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_GBK_reiterate_Dataflow_Streaming.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_ParDo_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_ParDo_Dataflow_Streaming.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_ParDo_Flink_Batch.yml:67` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_ParDo_Flink_Streaming.yml:67` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_SideInput_Dataflow_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_LoadTests_Python_Smoke.yml:54` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_MetricsCredentialsRotation.yml:54` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Metrics_Report.yml:55` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_AvroIOIT.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_AvroIOIT_HDFS.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_BigQueryIO_Batch_Java_Avro.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_BigQueryIO_Batch_Java_Json.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_BigQueryIO_Streaming_Java.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_BiqQueryIO_Read_Python.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_BiqQueryIO_Write_Python_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_Cdap.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_Compressed_TextIOIT.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_Compressed_TextIOIT_HDFS.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_HadoopFormat.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_JDBC.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_Kafka_IO.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_ManyFiles_TextIOIT.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_ManyFiles_TextIOIT_HDFS.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_MongoDBIO_IT.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_ParquetIOIT.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_ParquetIOIT_HDFS.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_PubsubIOIT_Python_Streaming.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_SQLBigQueryIO_Batch_Java.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_SingleStoreIO.yml:56` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_SpannerIO_Read_2GB_Python.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_SpannerIO_Write_2GB_Python_Batch.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_SparkReceiver_IO.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_TFRecordIOIT.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_TFRecordIOIT_HDFS.yml:59` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_TextIOIT.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_TextIOIT_HDFS.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_TextIOIT_Python.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_WordCountIT_PythonVersions.yml:58` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_XmlIOIT.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_XmlIOIT_HDFS.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PerformanceTests_xlang_KafkaIO_Python.yml:58` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Playground_CI_Nightly.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Playground_Precommit.yml:50` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Go.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Go_Dataflow_ARM.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Go_VR_Flink.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Go_VR_Samza.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Go_VR_Spark.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Avro_Versions.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_BigQueryEarlyRollout.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_DataflowV1.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_DataflowV2.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Examples_Dataflow.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Examples_Dataflow_ARM.yml:73` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Examples_Dataflow_Java.yml:70` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Examples_Dataflow_V2.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Examples_Dataflow_V2_Java.yml:72` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Examples_Direct.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Examples_Flink.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Examples_Spark.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Hadoop_Versions.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_IO_Performance_Tests.yml:69` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_InfluxDbIO_IT.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Jpms_Dataflow.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Jpms_Dataflow_Versions.yml:67` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Jpms_Direct.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Jpms_Direct_Versions.yml:67` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Jpms_Flink_Java11.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Jpms_Spark_Java11.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Nexmark_Dataflow.yml:96` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Nexmark_Dataflow_V2.yml:96` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Nexmark_Dataflow_V2_Java.yml:98` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Nexmark_Direct.yml:91` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Nexmark_Flink.yml:90` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Nexmark_Spark.yml:90` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_PVR_Flink_Batch.yml:82` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_PVR_Flink_Streaming.yml:70` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_PVR_Samza.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_PVR_Spark3_Streaming.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_PVR_Spark_Batch.yml:67` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_SingleStoreIO_IT.yml:70` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Tpcds_Dataflow.yml:93` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Tpcds_Flink.yml:90` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_Tpcds_Spark.yml:89` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Dataflow.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_JavaVersions.yml:70` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_Engine.yml:67` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_Streaming_TagEncodingV2.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_V2.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Dataflow_V2_Streaming.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Direct.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Direct_JavaVersions.yml:70` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Flink.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Flink_Java8.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Samza.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Spark.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_SparkStructuredStreaming.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Spark_Java8.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_Twister2.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Java_ValidatesRunner_ULR.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Javadoc.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_PortableJar_Flink.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_PortableJar_Spark.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python.yml:72` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_Arm.yml:69` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_Dependency.yml:70` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_Examples_Dataflow.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_Examples_Direct.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_Examples_Flink.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_Examples_Spark.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_MongoDBIO_IT.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_Nexmark_Direct.yml:111` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_Portable_Flink.yml:70` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_ValidatesContainer_Dataflow.yml:70` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_ValidatesContainer_Dataflow_With_RC.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_ValidatesRunner_Dataflow.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_ValidatesRunner_Flink.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_ValidatesRunner_Samza.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_ValidatesRunner_Spark.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_Xlang_Gcp_Dataflow.yml:67` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_Xlang_Gcp_Direct.yml:67` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_Xlang_IO_Dataflow.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Python_Xlang_IO_Direct.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_SQL.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_TransformService_Direct.yml:67` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Website_Test.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_XVR_Direct.yml:67` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_XVR_Flink.yml:68` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_XVR_GoUsingJava_Dataflow.yml:69` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_XVR_JavaUsingPython_Dataflow.yml:67` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_XVR_PythonUsingJavaSQL_Dataflow.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_XVR_PythonUsingJava_Dataflow.yml:67` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_XVR_Samza.yml:67` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_XVR_Spark3.yml:67` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostCommit_Yaml_Xlang_Direct.yml:66` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PostRelease_NightlySnapshot.yml:55` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_PreCommit_CommunityMetrics.yml:74` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Flink_Container.yml:101` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_GHA.yml:74` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Go.yml:74` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_GoPortable.yml:76` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_GoPrism.yml:74` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_ItFramework.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java.yml:171` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Amazon-Web-Services2_IO_Direct.yml:97` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Amqp_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Azure_IO_Direct.yml:97` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Cassandra_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Cdap_IO_Direct.yml:83` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Clickhouse_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Csv_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Datadog_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Debezium_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_ElasticSearch_IO_Direct.yml:81` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Examples_Dataflow.yml:90` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Examples_Dataflow_Java21.yml:89` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_File-schema-transform_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Flink_Versions.yml:78` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_GCP_IO_Direct.yml:97` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Google-ads_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_HBase_IO_Direct.yml:81` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_HCatalog_IO_Direct.yml:81` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Hadoop_IO_Direct.yml:105` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_IOs_Direct.yml:82` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_InfluxDb_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_JDBC_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Jms_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Kafka_IO_Direct.yml:87` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Kudu_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_MongoDb_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Mqtt_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Neo4j_IO_Direct.yml:81` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_PVR_Flink_Batch.yml:85` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_PVR_Flink_Docker.yml:90` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_PVR_Prism_Loopback.yml:91` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Parquet_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Pulsar_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_RabbitMq_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Redis_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_RequestResponse_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_SingleStore_IO_Direct.yml:81` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Snowflake_IO_Direct.yml:83` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Solace_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Solr_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Spark3_Versions.yml:81` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Splunk_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Thrift_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Java_Tika_IO_Direct.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Kotlin_Examples.yml:91` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Portable_Python.yml:93` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Prism_Python.yml:87` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Python.yml:94` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_PythonDocker.yml:72` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_PythonDocs.yml:74` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_PythonFormatter.yml:73` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_PythonLint.yml:73` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Python_Coverage.yml:77` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Python_Dataframes.yml:75` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Python_Dill.yml:84` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Python_Examples.yml:76` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Python_Integration.yml:75` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Python_ML.yml:90` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Python_PVR_Flink.yml:93` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Python_Runners.yml:75` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Python_Transforms.yml:76` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_RAT.yml:72` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_SQL.yml:74` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_SQL_Java17.yml:74` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_SQL_Java8.yml:74` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Spotless.yml:79` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Typescript.yml:75` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Website.yml:74` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Website_Stage_GCS.yml:76` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Whitespace.yml:73` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Xlang_Generated_Transforms.yml:95` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_PreCommit_Yaml_Xlang_Direct.yml:80` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `beam_Publish_BeamMetrics.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Publish_Beam_SDK_Snapshots.yml:124` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Publish_Docker_Snapshots.yml:56` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Publish_Website.yml:52` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Python_CostBenchmarks_Dataflow.yml:56` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Python_ValidatesContainer_Dataflow_ARM.yml:102` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Release_NightlySnapshot.yml:45` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_Release_Python_NightlySnapshot.yml:47` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_StressTests_Java_BigQueryIO.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_StressTests_Java_BigTableIO.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_StressTests_Java_KafkaIO.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_StressTests_Java_PubSubIO.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `beam_StressTests_Java_SpannerIO.yml:57` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `build_release_candidate.yml:61` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `deploy_release_candidate_pypi.yaml:25` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `finalize_release.yml:41` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `flaky_test_detection.yml:39` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `playground_frontend_test.yml:51` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `refresh_looker_metrics.yml:32` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `run_rc_validation_go_wordcount.yml:27` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `run_rc_validation_java_mobile_gaming.yml:74` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `run_rc_validation_java_quickstart.yml:67` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `run_rc_validation_python_mobile_gaming.yml:68` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `run_rc_validation_python_yaml.yml:61` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `tour_of_beam_frontend_test.yml:53` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `update_python_dependencies.yml:39` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 9 third-party actions: cicirello/javadoc-cleanup, damccorm/tag-ur-it, dawidd6/action-send-mail, golangci/golangci-lint-action, jlumbroso/free-disk-space, jwgmeligmeyling/checkstyle-github-action, jwgmeligmeyling/spotbugs-github-action, nanasess/setup-chromedriver, subosito/flutter-action
+
+### apache/beam-starter-go
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/beam-starter-java
+
+**3** findings | INFO: 1, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `sbt/setup-sbt` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: sbt/setup-sbt
+
+### apache/beam-starter-java-provider
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/beam-starter-kotlin
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/beam-starter-python
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/beam-starter-typescript
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/bifromq
+
+**4** findings | LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/login-action` (1).
+- **[LOW]** `docker-publish.yml:35,37,39,40,42,51,52,56,57` — [run_block_injection] 10 instances of direct interpolation in run blocks. Expressions: `inputs.artifact_url`, `inputs.version`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/bifromq-sites
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pnpm/action-setup` (1), `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/bigtop-manager
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `crate-ci/typos` (1), `amannn/action-semantic-pull-request` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `codeql.yaml:62` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: amannn/action-semantic-pull-request, crate-ci/typos
+
+### apache/bookkeeper
+
+**7** findings | INFO: 4, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `crate-ci/typos` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `bk-ci.yml:68` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `bk-streamstorage-python.yml:62` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `codeql.yml:67` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: crate-ci/typos
+
+### apache/brpc
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `google/oss-fuzz` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: google/oss-fuzz
+
+### apache/brpc-website
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-hugo` (1), `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/buildstream
+
+**3** findings | LOW: 3
+
+- **[LOW]** `release.yml:149` — [run_block_injection] Secret `${{ secrets.PYPI_TOKEN }}` directly interpolated in run block at step 'Upload to PyPI' in workflow release.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/buildstream-plugins
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/burr
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `hasura/comment-progress` (2), `peaceiris/actions-gh-pages` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `python-package.yml:41` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: hasura/comment-progress
+
+### apache/bval
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/calcite
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 18 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `burrunan/gradle-cache-action` (17), `gradle/actions` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: burrunan/gradle-cache-action
+
+### apache/calcite-avatica
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `google/oss-fuzz` (2), `gradle/wrapper-validation-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: google/oss-fuzz
+
+### apache/calcite-avatica-go
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/camel
+
+**5** findings | INFO: 1, LOW: 4
+
+- **[LOW]** `check-container-versions.yml:63,66` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.check_prereleases`, `github.event.inputs.scan_path || 'test-infra'`.
+- **[LOW]** `pr-build-main.yml:142` — [run_block_injection] Workflow input `${{ github.event.number || inputs.pr_number }}` directly interpolated in run block at step 'Save PR number and test comment for commenter workflow' in workflow pr-build-main.yml. Trusted committer input but should use env: block.
+- **[LOW]** `security-scan.yml:45` — [run_block_injection] Secret `${{ secrets.NVD_API_KEY }}` directly interpolated in run block at step 'OWASP Dependency Check' in workflow security-scan.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: actions-cool/check-user-permission
+
+### apache/camel-examples
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/camel-jbang-examples
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `build.yml:37` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/camel-k
+
+**8** findings | LOW: 4, MEDIUM: 4
+
+- **[MEDIUM]** `.github/actions/automatic-updates/action.yml:101` — [composite_action_input_injection] Composite action `automatic-updates` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[MEDIUM]** `.github/actions/build/action.yml:55` — [composite_action_input_injection] Composite action `build` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[MEDIUM]** `.github/actions/infra-setting/action.yml:42` — [composite_action_unpinned] Composite action uses unpinned action `medyagh/setup-minikube@v0.0.18`. Supply chain risk.
+- **[MEDIUM]** `.github/actions/install-otlp-collector/action.yml:89` — [composite_action_input_injection] Composite action `install-otlp-collector` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `.github/actions/automatic-updates/action.yml:101` — [composite_action_injection] Workflow input `${{ inputs.branch-ref }}` directly interpolated in run block at step 'Push changes' in composite action .github/actions/automatic-updates. Trusted committer input but should use env: block.
+- **[LOW]** `.github/actions/build/action.yml:55,61,62,83` — [composite_action_injection] 4 instances of direct interpolation in run blocks. Expressions: `inputs.artifact-name`.
+- **[LOW]** `.github/actions/install-otlp-collector/action.yml:89` — [composite_action_injection] 2 instances of direct interpolation in run blocks. Expressions: `inputs.otlp-collector-image-name`, `inputs.otlp-collector-image-version`.
+
+### apache/camel-k-runtime
+
+**5** findings | INFO: 1, LOW: 2, MEDIUM: 2
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `AdoptOpenJDK/install-jdk` (3).
+- **[MEDIUM]** `.github/actions/automatic-updates/action.yml:88` — [composite_action_input_injection] Composite action `automatic-updates` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `.github/actions/automatic-updates/action.yml:88` — [composite_action_injection] Workflow input `${{ inputs.branch-ref }}` directly interpolated in run block at step 'Push changes' in composite action .github/actions/automatic-updates. Trusted committer input but should use env: block.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: AdoptOpenJDK/install-jdk
+
+### apache/camel-kafka-connector
+
+**2** findings | LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peter-evans/create-pull-request` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/camel-kameleon
+
+**3** findings | LOW: 3
+
+- **[LOW]** `main.yml:45` — [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Build application' in workflow main.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/camel-kamelets
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/camel-karaf
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `EnricoMi/publish-unit-test-result-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/camel-karavan
+
+**6** findings | INFO: 2, LOW: 4
+
+- **[LOW]** `app.yml:58` — [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Build application' in workflow app.yml. Trusted value but risks log leakage.
+- **[LOW]** `docker-devmode.yml:34` — [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Log in to the Container registry' in workflow docker-devmode.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `app.yml:31` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `vscode.yml:31` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/camel-performance-tests
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/camel-quarkus
+
+**5** findings | LOW: 5
+
+- **[LOW]** `camel-master-cron.yaml:137,226,324,379,490,579,616` — [run_block_injection] 7 instances of direct interpolation in run blocks. Expressions: `secrets.GITHUB_TOKEN`.
+- **[LOW]** `check-dependency-convergence.yml:182` — [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Report Build Status' in workflow check-dependency-convergence.yml. Trusted value but risks log leakage.
+- **[LOW]** `quarkus-lts-ci-build.yaml:62,74,120,140,220,315,363,418,480` — [run_block_injection] 9 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.branch`.
+- **[LOW]** `quarkus-master-cron.yaml:138,227,325,380,491,580,617` — [run_block_injection] 7 instances of direct interpolation in run blocks. Expressions: `secrets.GITHUB_TOKEN`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/camel-quarkus-examples
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/camel-spring-boot
+
+**2** findings | LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peter-evans/create-pull-request` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/camel-spring-boot-examples
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/camel-upgrade-recipes
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `googleapis/code-suggester` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: googleapis/code-suggester
+
+### apache/camel-website
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peter-evans/create-pull-request` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/carbondata
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `build-test.yml:24` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/casbin
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+
+### apache/casbin-3rd-party-casbin-pg-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `isbang/compose-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: isbang/compose-action
+
+### apache/casbin-Casbin.NET
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `microsoft/infersharpaction` (5), `amannn/action-semantic-pull-request` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: amannn/action-semantic-pull-request, microsoft/infersharpaction
+
+### apache/casbin-Casbin.NET-dotnet-cli
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-Casbin.NET-ef-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-Casbin.NET-redis-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `amannn/action-semantic-pull-request` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: amannn/action-semantic-pull-request
+
+### apache/casbin-Casbin.NET-redis-watcher
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-SwiftCasbin
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-actix-casbin-auth
+
+**4** findings | LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `release.yml:25` — [run_block_injection] Secret `${{ secrets.CARGO_TOKEN }}` directly interpolated in run block at step 'Cargo Login' in workflow release.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-admission-webhook
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/build-push-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:28` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/casbin-aspnetcore
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-axum-casbin
+
+**4** findings | LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `release.yml:25` — [run_block_injection] Secret `${{ secrets.CARGO_TOKEN }}` directly interpolated in run block at step 'Cargo Login' in workflow release.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-beego-orm-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-casbin.js
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-confita
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `c-hive/gha-yarn-cache` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: c-hive/gha-yarn-cache
+
+### apache/casbin-core
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: coverallsapp/github-action
+
+### apache/casbin-cpp
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `jwlawson/actions-setup-cmake` (5).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: jwlawson/actions-setup-cmake
+
+### apache/casbin-cpp-Cvaluate
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-cpp-casbin-CMake-setup
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-cpp-sqlpp11-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-crd-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1), `golangci/golangci-lint-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+
+### apache/casbin-dart-casbin
+
+**5** findings | INFO: 1, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dart-lang/setup-dart` (3).
+- **[LOW]** `dart.yml:68` — [run_block_injection] Secret `${{ secrets.PUB_CREDENTIALS }}` directly interpolated in run block at step 'Setup Pub Credentials' in workflow dart.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: dart-lang/setup-dart
+
+### apache/casbin-docker-plugin
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-docker_auth
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `haya14busa/action-cond` (1), `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/build-push-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: haya14busa/action-cond
+
+### apache/casbin-editor
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-efcore-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-ent-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `shogo82148/actions-goveralls` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: shogo82148/actions-goveralls
+
+### apache/casbin-etcd-watcher
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-ex
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `erlef/setup-beam` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:33` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: erlef/setup-beam
+
+### apache/casbin-express-authz
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-fasthttp-auth
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:22` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/casbin-gateway
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `cycjimmy/semantic-release-action` (1), `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/build-push-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: cycjimmy/semantic-release-action
+
+### apache/casbin-go-cli
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `goreleaser/goreleaser-action` (1), `golangci/golangci-lint-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: golangci/golangci-lint-action, goreleaser/goreleaser-action
+
+### apache/casbin-go-client
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker-practice/actions-setup-docker` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: docker-practice/actions-setup-docker
+
+### apache/casbin-gorm-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `shogo82148/actions-goveralls` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: shogo82148/actions-goveralls
+
+### apache/casbin-gorm-adapter-ex
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `shogo82148/actions-goveralls` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: shogo82148/actions-goveralls
+
+### apache/casbin-govaluate
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+
+### apache/casbin-hraft-dispatcher
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-informer-watcher
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-dynamodb-adapter
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-hibernate-adapter
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-java-cli
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-jdbc-adapter
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-jfinal-authz
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-kafka-casbin
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-kafka-watcher
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-lettuce-redis-watcher
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `getong/redis-action` (1), `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: getong/redis-action
+
+### apache/casbin-jcasbin-menu-permission
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-mongo-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `supercharge/mongodb-github-action` (1), `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: supercharge/mongodb-github-action
+
+### apache/casbin-jcasbin-mybatis-adapter
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-mybatisplus-adapter
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-nutz-authz
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-play-authz
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-postgres-watcher
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-pulsar-authz
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-rabbitmq-watcher
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-redis-adapter
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-redis-watcher
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `getong/redis-action` (1), `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: getong/redis-action
+
+### apache/casbin-jcasbin-redis-watcher-ex
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-shiro-casbin
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker-practice/actions-setup-docker` (1), `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: docker-practice/actions-setup-docker
+
+### apache/casbin-jcasbin-spring-security-starter
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-string-adapter
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-vertx-authz
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-jcasbin-zookeeper-watcher
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-js-vue-authz
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-json-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-k8s-gatekeeper
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-kubesphere-authz
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-laravel-rbac
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `shivammathur/setup-php` (1), `coverallsapp/github-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: coverallsapp/github-action, shivammathur/setup-php
+
+### apache/casbin-ldap-role-manager
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-lego
+
+**6** findings | INFO: 3, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `niden/actions-memcached` (1), `crazy-max/ghaction-github-pages` (1), `goreleaser/goreleaser-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `go-cross.yml:33` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `main.yml:39` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: goreleaser/goreleaser-action, niden/actions-memcached
+
+### apache/casbin-lua-4daysorm-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `leafo/gh-actions-lua` (1), `leafo/gh-actions-luarocks` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: leafo/gh-actions-lua, leafo/gh-actions-luarocks
+
+### apache/casbin-lua-apisix-authz
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-lua-casbin
+
+**5** findings | INFO: 1, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `leafo/gh-actions-lua` (3), `leafo/gh-actions-luarocks` (3).
+- **[LOW]** `release.yml:48` — [run_block_injection] Secret `${{ secrets.LUAROCKS_API_KEY }}` directly interpolated in run block at step 'Upload' in workflow release.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: leafo/gh-actions-lua, leafo/gh-actions-luarocks
+
+### apache/casbin-lua-kong-authz
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `leafo/gh-actions-lua` (1), `leafo/gh-actions-luarocks` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: leafo/gh-actions-lua, leafo/gh-actions-luarocks
+
+### apache/casbin-lua-luasql-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `leafo/gh-actions-lua` (1), `leafo/gh-actions-luarocks` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: leafo/gh-actions-lua, leafo/gh-actions-luarocks
+
+### apache/casbin-mcp-gateway
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:28` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/casbin-mesh
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/metadata-action` (1), `docker/build-push-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-mongodb-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `supercharge/mongodb-github-action` (1), `shogo82148/actions-goveralls` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: shogo82148/actions-goveralls, supercharge/mongodb-github-action
+
+### apache/casbin-nest-authz
+
+**3** findings | INFO: 1, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: coverallsapp/github-action
+
+### apache/casbin-node-casbin
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: coverallsapp/github-action
+
+### apache/casbin-node-casbin-basic-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-node-casbin-couchdb-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: coverallsapp/github-action
+
+### apache/casbin-node-casbin-drizzle-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: coverallsapp/github-action
+
+### apache/casbin-node-casbin-etcd-watcher
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-node-casbin-examples
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-node-casbin-expression-eval
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: coverallsapp/github-action
+
+### apache/casbin-node-casbin-file-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: coverallsapp/github-action
+
+### apache/casbin-node-casbin-graphql-authz
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-node-casbin-mongo-changestream-watcher
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: coverallsapp/github-action
+
+### apache/casbin-node-casbin-mongoose-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: coverallsapp/github-action
+
+### apache/casbin-node-casbin-node-pubsub-watcher
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-node-casbin-node-redis-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: coverallsapp/github-action
+
+### apache/casbin-node-casbin-prisma-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: coverallsapp/github-action
+
+### apache/casbin-node-casbin-redis-watcher
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: coverallsapp/github-action
+
+### apache/casbin-node-casbin-session-role-manager
+
+**3** findings | LOW: 3
+
+- **[LOW]** `release.yml:8` — [broad_permissions] Requests write access to 4 scopes: contents, issues, pull-requests, id-token.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-okta-role-manager
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-opentelemetry-logger
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-pg-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-policyguard
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+
+### apache/casbin-prometheus-logger
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-pycasbin
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `super-linter/super-linter` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: super-linter/super-linter
+
+### apache/casbin-python-async-django-orm-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-python-async-postgres-watcher
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-python-async-sqlalchemy-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-python-casbin-databases-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-python-cli
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `semantic-release-action/next-release-version` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: semantic-release-action/next-release-version
+
+### apache/casbin-python-django-casbin
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-python-django-casbin-auth
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-python-django-orm-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-python-etcd-watcher
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-python-fastapi-casbin-auth
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: coverallsapp/github-action
+
+### apache/casbin-python-flask-authz
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-python-graphql-authz
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `wearerequired/lint-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: wearerequired/lint-action
+
+### apache/casbin-python-postgresql-watcher
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-python-pymongo-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `supercharge/mongodb-github-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: supercharge/mongodb-github-action
+
+### apache/casbin-python-rabbitmq-watcher
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `nijel/rabbitmq-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: nijel/rabbitmq-action
+
+### apache/casbin-python-redis-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `nnhy/redis-github-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: nnhy/redis-github-action
+
+### apache/casbin-python-redis-watcher
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-python-sanic-authz
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-python-sqlalchemy-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-python-sqlobject-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-raft
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+
+### apache/casbin-redis-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-redis-watcher
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-rs
+
+**7** findings | INFO: 3, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 17 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (7), `actions-rs/toolchain` (4), `ruby/setup-ruby` (1), `stefanzweifel/git-auto-commit-action` (1), `baptiste0928/cargo-install` (1).
+- **[LOW]** `changelog.yml:23` — [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Gen changelog' in workflow changelog.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:33` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `pull_request.yml:21` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 6 third-party actions: actions-rs/cargo, actions-rs/toolchain, baptiste0928/cargo-install, casbin-rs/semantic-release-action-rust, smrpn/criterion-compare-action, stefanzweifel/git-auto-commit-action
+
+### apache/casbin-rust-actix-casbin
+
+**4** findings | LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `release.yml:25` — [run_block_injection] Secret `${{ secrets.CARGO_TOKEN }}` directly interpolated in run block at step 'Cargo Login' in workflow release.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-rust-actix-file-adapter-rbac
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (2), `actions-rs/toolchain` (1), `Swatinem/rust-cache` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+
+### apache/casbin-rust-actix-middleware-example
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (2), `actions-rs/toolchain` (1), `Swatinem/rust-cache` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+
+### apache/casbin-rust-actix-postgresql-simple
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (2), `actions-rs/toolchain` (1), `Swatinem/rust-cache` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+
+### apache/casbin-rust-axum-middleware-example
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (2), `actions-rs/toolchain` (1), `Swatinem/rust-cache` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+
+### apache/casbin-rust-casbin-grpc
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (2), `actions-rs/toolchain` (1), `Swatinem/rust-cache` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+
+### apache/casbin-rust-casbin-rust-cli
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (3), `actions-rs/toolchain` (1), `casbin-rs/semantic-release-action-rust` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: actions-rs/cargo, actions-rs/toolchain, casbin-rs/semantic-release-action-rust
+
+### apache/casbin-rust-diesel-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 12 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (9), `actions-rs/toolchain` (2), `codecov/codecov-action` (1).
+- **[LOW]** `release.yml:27` — [run_block_injection] Secret `${{ secrets.CARGO_TOKEN }}` directly interpolated in run block at step 'Cargo Login' in workflow release.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: actions-rs/cargo, actions-rs/toolchain
+
+### apache/casbin-rust-dufs-with-casbin
+
+**3** findings | INFO: 1, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 10 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/toolchain` (3), `Swatinem/rust-cache` (1), `actions-rs/cargo` (1), `softprops/action-gh-release` (1), `docker/setup-qemu-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+
+### apache/casbin-rust-json-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/toolchain` (1), `actions-rs/tarpaulin` (1), `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: actions-rs/tarpaulin, actions-rs/toolchain
+
+### apache/casbin-rust-ntex-file-adapter-acl
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (2), `actions-rs/toolchain` (1), `Swatinem/rust-cache` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+
+### apache/casbin-rust-poem-casbin
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (5), `actions-rs/toolchain` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: actions-rs/cargo, actions-rs/toolchain
+
+### apache/casbin-rust-poem-todo
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (2), `actions-rs/toolchain` (1), `Swatinem/rust-cache` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: Swatinem/rust-cache, actions-rs/cargo, actions-rs/toolchain
+
+### apache/casbin-rust-postgres-adapter
+
+**3** findings | INFO: 1, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 11 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (6), `actions-rs/toolchain` (3), `actions-rs/tarpaulin` (1), `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: actions-rs/cargo, actions-rs/tarpaulin, actions-rs/toolchain
+
+### apache/casbin-rust-redis-watcher
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dtolnay/rust-toolchain` (3), `Swatinem/rust-cache` (3), `codecov/codecov-action` (1), `casbin-rs/semantic-release-action-rust` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: Swatinem/rust-cache, casbin-rs/semantic-release-action-rust, dtolnay/rust-toolchain
+
+### apache/casbin-rust-rocket-authz
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 11 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (6), `actions-rs/toolchain` (3), `actions-rs/tarpaulin` (1), `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: actions-rs/cargo, actions-rs/tarpaulin, actions-rs/toolchain
+
+### apache/casbin-rust-salvo-casbin
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-rust-semantic-release-action-rust
+
+**3** findings | INFO: 1, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 14 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dtolnay/rust-toolchain` (3), `Swatinem/rust-cache` (3), `taiki-e/install-action` (2), `casbin-rs/semantic-release-action-rust` (2), `DeterminateSystems/nix-installer-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 8 third-party actions: DeterminateSystems/nix-installer-action, EricCrosson/install-github-release-binary, Swatinem/rust-cache, casbin-rs/semantic-release-action-rust, dtolnay/rust-toolchain, semantic-release-action/github-actions, semantic-release-action/next-release-version, taiki-e/install-action
+
+### apache/casbin-rust-string-adapter
+
+**5** findings | INFO: 1, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/cargo` (4), `actions-rs/toolchain` (2), `baptiste0928/cargo-install` (1), `codecov/codecov-action` (1).
+- **[LOW]** `release.yml:25` — [run_block_injection] Secret `${{ secrets.CARGO_TOKEN }}` directly interpolated in run block at step 'Cargo Login' in workflow release.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: actions-rs/cargo, actions-rs/toolchain, baptiste0928/cargo-install
+
+### apache/casbin-rust-yaml-adapter
+
+**3** findings | LOW: 3
+
+- **[LOW]** `release.yml:25` — [run_block_injection] Secret `${{ secrets.CARGO_TOKEN }}` directly interpolated in run block at step 'Cargo Login' in workflow release.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-sequelize-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `coverallsapp/github-action` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: coverallsapp/github-action
+
+### apache/casbin-server
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-ecosystem/action-get-latest-tag` (2), `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/build-push-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: actions-ecosystem/action-get-latest-tag
+
+### apache/casbin-spring-boot-starter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-sqlx-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dtolnay/rust-toolchain` (2), `baptiste0928/cargo-install` (1), `codecov/codecov-action` (1).
+- **[LOW]** `release.yml:25` — [run_block_injection] Secret `${{ secrets.CARGO_TOKEN }}` directly interpolated in run block at step 'Cargo Login' in workflow release.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: baptiste0928/cargo-install, dtolnay/rust-toolchain
+
+### apache/casbin-tikv-watcher
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-typeorm-adapter
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `mirromutth/mysql-action` (2), `coverallsapp/github-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: coverallsapp/github-action, mirromutth/mysql-action
+
+### apache/casbin-ucon
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `benchmark-action/github-action-benchmark` (1), `golangci/golangci-lint-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: benchmark-action/github-action-benchmark, golangci/golangci-lint-action
+
+### apache/casbin-vscode-plugin
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `HaaLeo/publish-vscode-extension` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: HaaLeo/publish-vscode-extension
+
+### apache/casbin-website
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `tcort/github-action-markdown-link-check` (3), `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: tcort/github-action-markdown-link-check
+
+### apache/casbin-website-v1-deprecated
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `crowdin/github-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: crowdin/github-action
+
+### apache/casbin-website-v3
+
+**3** findings | LOW: 3
+
+- **[LOW]** `release.yml:13` — [broad_permissions] Requests write access to 4 scopes: contents, issues, pull-requests, id-token.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-xorm-adapter
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/casbin-zap-logger
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-ecosystem/action-get-latest-tag` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: actions-ecosystem/action-get-latest-tag
+
+### apache/cassandra
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/cassandra-analytics
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `test.yaml:64` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/cassandra-builds
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/cassandra-ccm
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `mikepenz/action-junit-report` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: mikepenz/action-junit-report
+
+### apache/cassandra-diff
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/cassandra-easy-stress
+
+**2** findings | LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (6), `docker/login-action` (1), `softprops/action-gh-release` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/cassandra-gocql-driver
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `main.yml:59` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/cassandra-sidecar
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 11 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (10), `softprops/action-gh-release` (1).
+- **[LOW]** `publish-test-artifacts.yml:91` — [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Build and push Docker image (latest tag)' in workflow publish-test-artifacts.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `ci.yml:67` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/cassandra-spark-connector
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `mikepenz/action-junit-report` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: mikepenz/action-junit-report
+
+### apache/cassandra-website
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/causeway
+
+**4** findings | INFO: 2, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `stCarolas/setup-maven` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `ci-v4-verify.yml:76` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+
+### apache/cayenne
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/celeborn
+
+**8** findings | INFO: 4, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pnpm/action-setup` (2), `docker/login-action` (1), `codecov/codecov-action` (1).
+- **[LOW]** `docker-build.yml:25` — [run_block_injection] Workflow input `${{ github.event.inputs.celeborn_version }}` directly interpolated in run block at step 'Set Celeborn Version' in workflow docker-build.yml. Trusted committer input but should use env: block.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `benchmark.yml:26` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `benchmark_manual.yml:30` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `regression.yml:26` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+- **[INFO]** `regression_manual.yml:31` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+
+### apache/celeborn-website
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/celix
+
+**8** findings | INFO: 6, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `conan_create.yml:46` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `containers.yml:15` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `coverage.yml:39` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `fuzzing.yml:27` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `macos.yml:37` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `ubuntu.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/cloudberry
+
+**9** findings | INFO: 1, LOW: 7, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 10 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (2), `docker/login-action` (2), `docker/setup-buildx-action` (2), `docker/build-push-action` (2), `SonarSource/sonarqube-scan-action` (2).
+- **[LOW]** `build-cloudberry-rocky8.yml:226,376` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.test_selection`.
+- **[LOW]** `build-cloudberry.yml:219,371` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.test_selection`.
+- **[LOW]** `build-dbg-cloudberry.yml:214,250` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.test_selection`.
+- **[LOW]** `build-deb-cloudberry.yml:187,287` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.test_selection`.
+- **[LOW]** `coverity.yml:77,123` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.COVERITY_SCAN_TOKEN`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: SonarSource/sonarqube-scan-action
+
+### apache/cloudberry-backup
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/cloudberry-go-libs
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/cloudberry-pxf
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `pxf-ci.yml:61` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/cloudberry-site
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/cloudstack
+
+**6** findings | INFO: 3, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (3), `docker/login-action` (1), `eps1lon/actions-label-merge-conflict` (1).
+- **[LOW]** `docker-cloudstack-simulator.yml:59` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.DOCKER_REGISTRY`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `pre-commit.yml:42` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `sonar-check.yml:49` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: eps1lon/actions-label-merge-conflict
+
+### apache/cloudstack-cloudmonkey
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/cloudstack-csbench
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/cloudstack-documentation
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `readthedocs/actions` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: readthedocs/actions
+
+### apache/cloudstack-go
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/cloudstack-kubernetes-provider
+
+**5** findings | INFO: 1, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/build-push-action` (1), `codecov/codecov-action` (1), `golangci/golangci-lint-action` (1).
+- **[LOW]** `build-docker-image.yml:51` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.DOCKER_REGISTRY`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+
+### apache/cloudstack-terraform-provider
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: opentofu/setup-opentofu
+
+### apache/cloudstack-www
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `pre-commit.yml:42` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/comdev-events-site
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/commons-bcel
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:49` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-beanutils
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:48` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:47` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-bsf
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-build-plugin
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `maven.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-chain
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/commons-cli
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:47` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-codec
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-collections
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-compress
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:49` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-configuration
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-crypto
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:62` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:94` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-csv
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:49` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-daemon
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:56` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-dbcp
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-dbutils
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-digester
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:50` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-email
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:47` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-exec
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:47` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-fileupload
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-geometry
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-graph
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `maven.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/commons-imaging
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-io
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:57` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:67` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-jci
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-jcs
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:44` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-jelly
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:41` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-jexl
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:48` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-jxpath
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:50` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-lang
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:47` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-logging
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-math
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-net
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:57` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:65` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-numbers
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-ognl
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-parent
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:41` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-pool
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-rdf
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-release-plugin
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-rng
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-scxml
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `maven.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-skin
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:54` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-statistics
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-text
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-validator
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:45` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-vfs
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:55` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/commons-weaver
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:53` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `maven.yml:54` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/cordova
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gr2m/twitter-together` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: gr2m/twitter-together
+
+### apache/cordova-android
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-app-hello-world
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: erisu/apache-rat-action
+
+### apache/cordova-browser
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-cli
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-coho
+
+**3** findings | LOW: 3
+
+- **[LOW]** `nightly.yml:56,57,79` — [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.dispatchReason`, `github.event.inputs.verbose`, `github.event.inputs.verbose == 'true'`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/cordova-common
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-create
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-docs
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/cordova-electron
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-eslint
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-fetch
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-ios
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-js
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-lib
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-mobile-spec
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-node-xcode
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-paramedic
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 4 third-party actions: erisu/apache-rat-action, erisu/license-checker-action, maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-battery-status
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-camera
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 4 third-party actions: erisu/apache-rat-action, erisu/license-checker-action, maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-device
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-device-motion
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-device-orientation
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-dialogs
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-file
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-file-transfer
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-geolocation
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-inappbrowser
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 4 third-party actions: erisu/apache-rat-action, erisu/license-checker-action, maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-media
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-media-capture
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-network-information
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 4 third-party actions: erisu/apache-rat-action, erisu/license-checker-action, maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-screen-orientation
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-splashscreen
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/cordova-plugin-statusbar
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `reactivecircus/android-emulator-runner` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugin-test-framework
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-plugin-vibration
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: maxim-lobanov/setup-xcode, reactivecircus/android-emulator-runner
+
+### apache/cordova-plugman
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/cordova-serve
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: erisu/apache-rat-action, erisu/license-checker-action
+
+### apache/couchdb-ci
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/login-action` (1), `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1), `docker/build-push-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/couchdb-erlfdb
+
+**3** findings | LOW: 3
+
+- **[LOW]** `ci.yml:185` — [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Finalize Coveralls report' in workflow ci.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/couchdb-fast-pbkdf2
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `erlef/setup-beam` (1), `ilammy/msvc-dev-cmd` (1), `uraimo/run-on-arch-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:59` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: erlef/setup-beam, ilammy/msvc-dev-cmd, uraimo/run-on-arch-action
+
+### apache/couchdb-fauxton
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/couchdb-helm
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/couchdb-jiffy
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/couchdb-meck
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `erlef/setup-beam` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: erlef/setup-beam
+
+### apache/couchdb-mochiweb
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `erlangpack/github-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: erlangpack/github-action
+
+### apache/couchdb-nano
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/couchdb-recon
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/creadur-rat
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `maven.yml:48` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `sonarcloud.yml:24` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/creadur-tentacles
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `maven.yml:46` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/creadur-whisker
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `maven.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/ctakes-website
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/curator
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:38` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/curator-site
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/cxf
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `codeql-analysis.yml:39` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/cxf-build-utils
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/cxf-fediz
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/cxf-xjc-utils
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/daffodil
+
+**3** findings | INFO: 2, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `main.yml:173` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: SonarSource/sonarqube-scan-action, msys2/setup-msys2, scalacenter/sbt-dependency-submission
+
+### apache/daffodil-infrastructure
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/daffodil-sbt
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `msys2/setup-msys2` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: msys2/setup-msys2
+
+### apache/daffodil-schema.g8
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/daffodil-site
+
+**5** findings | INFO: 1, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker:/` (1).
+- **[LOW]** `update-docs.yml:74,139` — [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.project`, `inputs.version`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: docker:/
+
+### apache/daffodil-vscode
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: sbt/setup-sbt
+
+### apache/datafu
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/datafusion
+
+**6** findings | INFO: 2, LOW: 2, MEDIUM: 2
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `eps1lon/actions-label-merge-conflict` (1).
+- **[MEDIUM]** `.github/actions/setup-builder/action.yml:39` — [composite_action_input_injection] Composite action `setup-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `.github/actions/setup-builder/action.yml:39,40,41` — [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.rust-version`.
+- **[INFO]** `rust.yml:633` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 6 third-party actions: Swatinem/rust-cache, astral-sh/setup-uv, eps1lon/actions-label-merge-conflict, jlumbroso/free-disk-space, runs-on/action, taiki-e/install-action
+
+### apache/datafusion-ballista
+
+**6** findings | INFO: 2, LOW: 2, MEDIUM: 2
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 13 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dtolnay/rust-toolchain` (6), `astral-sh/setup-uv` (5), `pypa/gh-action-pypi-publish` (1), `eps1lon/actions-label-merge-conflict` (1).
+- **[MEDIUM]** `.github/actions/setup-builder/action.yml:36` — [composite_action_input_injection] Composite action `setup-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `.github/actions/setup-builder/action.yml:36,37,38` — [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.rust-version`.
+- **[INFO]** `rust.yml:306` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 4 third-party actions: arduino/setup-protoc, astral-sh/setup-uv, dtolnay/rust-toolchain, eps1lon/actions-label-merge-conflict
+
+### apache/datafusion-ballista-python
+
+**8** findings | INFO: 4, LOW: 2, MEDIUM: 2
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 7 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `potiuk/cancel-workflow-runs` (2), `r-lib/actions` (2), `eps1lon/actions-label-merge-conflict` (1), `actions-rs/toolchain` (1), `pypa/gh-action-pypi-publish` (1).
+- **[MEDIUM]** `.github/actions/setup-builder/action.yml:36` — [composite_action_input_injection] Composite action `setup-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `.github/actions/setup-builder/action.yml:36,37,38` — [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.rust-version`.
+- **[INFO]** `dev_pr.yml:32` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `python_test.yaml:40` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `rust.yml:43` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 4 third-party actions: actions-rs/toolchain, eps1lon/actions-label-merge-conflict, potiuk/cancel-workflow-runs, r-lib/actions
+
+### apache/datafusion-benchmarks
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/datafusion-comet
+
+**19** findings | INFO: 6, LOW: 7, MEDIUM: 6
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/build-push-action` (1).
+- **[MEDIUM]** `.github/actions/java-test/action.yml:79` — [composite_action_input_injection] Composite action `java-test` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[MEDIUM]** `.github/actions/setup-builder/action.yml:55` — [composite_action_input_injection] Composite action `setup-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[MEDIUM]** `.github/actions/setup-iceberg-builder/action.yml:39` — [composite_action_input_injection] Composite action `setup-iceberg-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[MEDIUM]** `.github/actions/setup-macos-builder/action.yml:47` — [composite_action_input_injection] Composite action `setup-macos-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[MEDIUM]** `.github/actions/setup-spark-builder/action.yml:46` — [composite_action_input_injection] Composite action `setup-spark-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[LOW]** `spark_sql_test.yml:161,163` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.collect-fallback-logs`, `github.event.inputs.collect-fallback-logs || 'false'`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `.github/actions/java-test/action.yml:79,88,90` — [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.maven_opts`, `inputs.suites`.
+- **[LOW]** `.github/actions/setup-builder/action.yml:55,56,57` — [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.rust-version`.
+- **[LOW]** `.github/actions/setup-iceberg-builder/action.yml:39` — [composite_action_injection] Workflow input `${{ inputs.iceberg-version }}` directly interpolated in run block at step 'Setup Iceberg for Comet' in composite action .github/actions/setup-iceberg-builder. Trusted committer input but should use env: block.
+- **[LOW]** `.github/actions/setup-macos-builder/action.yml:47,77,78,79` — [composite_action_injection] 4 instances of direct interpolation in run blocks. Expressions: `inputs.protoc-architecture`, `inputs.rust-version`.
+- **[LOW]** `.github/actions/setup-spark-builder/action.yml:46,62,69` — [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.spark-short-version`, `inputs.spark-version`.
+- **[INFO]** `iceberg_spark_test.yml:70` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `pr_benchmark_check.yml:77` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `pr_build_linux.yml:101` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `pr_build_macos.yml:86` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `spark_sql_test.yml:77` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: runs-on/action
+
+### apache/datafusion-python
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 16 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `PyO3/maturin-action` (6), `Swatinem/rust-cache` (5), `arduino/setup-protoc` (3), `taiki-e/install-action` (2).
+- **[LOW]** `verify-release-candidate.yml:83` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `inputs.rc_number`, `inputs.version`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 6 third-party actions: PyO3/maturin-action, Swatinem/rust-cache, arduino/setup-protoc, astral-sh/setup-uv, dtolnay/rust-toolchain, taiki-e/install-action
+
+### apache/datafusion-ray
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 21 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `astral-sh/setup-uv` (5), `dtolnay/rust-toolchain` (3), `arduino/setup-protoc` (3), `PyO3/maturin-action` (3), `docker/metadata-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `main.yml:73` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 6 third-party actions: PyO3/maturin-action, arduino/setup-protoc, astral-sh/setup-uv, dtolnay/rust-toolchain, helm/kind-action, jlumbroso/free-disk-space
+
+### apache/datafusion-sandbox
+
+**6** findings | INFO: 2, LOW: 2, MEDIUM: 2
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `eps1lon/actions-label-merge-conflict` (1).
+- **[MEDIUM]** `.github/actions/setup-builder/action.yml:39` — [composite_action_input_injection] Composite action `setup-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `.github/actions/setup-builder/action.yml:39,40,41` — [composite_action_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.rust-version`.
+- **[INFO]** `rust.yml:634` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 6 third-party actions: Swatinem/rust-cache, astral-sh/setup-uv, eps1lon/actions-label-merge-conflict, jlumbroso/free-disk-space, runs-on/action, taiki-e/install-action
+
+### apache/datafusion-site
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: crate-ci/typos
+
+### apache/datafusion-sqlparser-rs
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `.github/actions/setup-builder/action.yml:35` — [composite_action_input_injection] Composite action `setup-builder` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `.github/actions/setup-builder/action.yml:35,36,37,39,41` — [composite_action_injection] 6 instances of direct interpolation in run blocks. Expressions: `inputs.rust-version`, `inputs.targets`.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: Swatinem/rust-cache
+
+### apache/datafusion-testing
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/datasketches-cpp
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/datasketches-go
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/datasketches-hive
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `maven.yml:25` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/datasketches-java
+
+**5** findings | INFO: 2, LOW: 3
+
+- **[LOW]** `javadoc.yml:100` — [run_block_injection] Workflow input `${{ github.event.inputs.tag_ref }}` directly interpolated in run block at step 'Confirm Deployment' in workflow javadoc.yml. Trusted committer input but should use env: block.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `auto-jdk-matrix.yml:39` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `auto-os-matrix.yml:49` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/datasketches-memory
+
+**3** findings | LOW: 3
+
+- **[LOW]** `javadoc.yml:100` — [run_block_injection] Workflow input `${{ github.event.inputs.tag_ref }}` directly interpolated in run block at step 'Confirm Deployment' in workflow javadoc.yml. Trusted committer input but should use env: block.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/datasketches-memory16
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `AdoptOpenJDK/install-jdk` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `maven.yml:24` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: AdoptOpenJDK/install-jdk
+
+### apache/datasketches-memory17
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `AdoptOpenJDK/install-jdk` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `maven.yml:35` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: AdoptOpenJDK/install-jdk
+
+### apache/datasketches-pig
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `maven.yml:24` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/datasketches-postgresql
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/datasketches-python
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (1), `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/datasketches-rust
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `Swatinem/rust-cache` (2), `taiki-e/install-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: Swatinem/rust-cache, taiki-e/install-action
+
+### apache/datasketches-spark
+
+**5** findings | INFO: 3, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yaml:40` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `python_ci.yaml:38` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: sbt/setup-sbt
+
+### apache/datasketches-website
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/db-jdo
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/db-jdo-site
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/db-site
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/deltaspike
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:63` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/directory-kerby
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/directory-ldap-api
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/directory-scimple
+
+**2** findings | LOW: 2
+
+- **[LOW]** `maven.yml:58,65,71,74` — [run_block_injection] 4 instances of direct interpolation in run blocks. Expressions: `inputs.jobs_path`, `inputs.mvn`, `inputs.name`, `secrets.GITHUB_TOKEN`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/directory-server
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/directory-studio
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: ossf/scorecard-action
+
+### apache/dolphinscheduler
+
+**11** findings | INFO: 6, LOW: 4, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `EnricoMi/publish-unit-test-result-action` (1).
+- **[LOW]** `publish-docker.yaml:50,51,56,57` — [run_block_injection] 4 instances of direct interpolation in run blocks. Expressions: `secrets.DOCKERHUB_TOKEN`, `secrets.DOCKERHUB_USER`.
+- **[LOW]** `publish-helm-chart.yaml:44,45,50` — [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `secrets.DOCKERHUB_TOKEN`, `secrets.DOCKERHUB_USER`, `secrets.GITHUB_TOKEN`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `api-test.yml:71` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `backend.yml:73` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `e2e.yml:66` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `owasp-dependency-check.yaml:39` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `pull-request-target-robot.yml:32` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `unit-test.yml:121` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/dolphinscheduler-operator
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/login-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/dolphinscheduler-sdk-python
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yaml:185` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/dolphinscheduler-website
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/doris
+
+**10** findings | INFO: 3, LOW: 5, MEDIUM: 2
+
+- **[MEDIUM]** `code-checks.yml:35` — [prt_checkout] pull_request_target checks out PR head code, but permissions are limited to: read-only. Blast radius is reduced — no access to publishing secrets or contents:write.
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `mxschmitt/action-tmate` (1).
+- **[LOW]** `comment-to-trigger-teamcity.yml:47,48` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.GITHUB_TOKEN`.
+- **[LOW]** `opencode-review-runner.yml:149` — [run_block_injection] Workflow input `${{ inputs.pr_number }}` directly interpolated in run block at step 'Comment PR on review failure' in workflow opencode-review-runner.yml. Trusted committer input but should use env: block.
+- **[LOW]** `pr-approve-status.yml:41` — [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Run Python script' in workflow pr-approve-status.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `auto-cherry-pick.yml:37` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `lfs-warning.yml:29` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: mxschmitt/action-tmate
+
+### apache/doris-flink-connector
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/doris-kafka-connector
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/doris-opentelemetry-demo
+
+**6** findings | INFO: 2, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 9 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/login-action` (2), `dyladan/component-owners` (1), `umbrelladocs/action-linkspector` (1), `docker/setup-qemu-action` (1), `docker/setup-buildx-action` (1).
+- **[LOW]** `component-build-images.yml:155` — [run_block_injection] Workflow input `${{ inputs.push }}` directly interpolated in run block at step 'Check for changes and set push options' in workflow component-build-images.yml. Trusted committer input but should use env: block.
+- **[LOW]** `dependabot-auto-update-protobuf-diff.yml:8` — [broad_permissions] Requests write access to 4 scopes: actions, pull-requests, contents, packages.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `label-pr.yml:18` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 4 third-party actions: dyladan/component-owners, fossas/fossa-action, ossf/scorecard-action, umbrelladocs/action-linkspector
+
+### apache/doris-operator
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/metadata-action` (2), `docker/build-push-action` (2), `docker/setup-buildx-action` (1), `docker/login-action` (1), `azure/setup-helm` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: manyuanrong/setup-ossutil
+
+### apache/doris-sdk
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/doris-shade
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/doris-spark-connector
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/doris-streamloader
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/doris-thirdparty
+
+**4** findings | LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/build-push-action` (2), `docker/setup-buildx-action` (1), `docker/login-action` (1).
+- **[LOW]** `manual-build.yml:57` — [run_block_injection] Workflow input `${{ inputs.doris_ref }}` directly interpolated in run block at step 'Update Release Note' in workflow manual-build.yml. Trusted committer input but should use env: block.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/doris-website
+
+**6** findings | HIGH: 1, LOW: 4, MEDIUM: 1
+
+- **[HIGH]** `cron-deploy-website.yml:6` — [broad_permissions] Workflow uses `permissions: write-all`. Follow least-privilege principle.
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (4), `peter-evans/create-pull-request` (1).
+- **[LOW]** `approve-check.yml:41` — [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Run Python script' in workflow approve-check.yml. Trusted value but risks log leakage.
+- **[LOW]** `manual-i18n-translate-workflow.yaml:48,49,56,64,138` — [run_block_injection] 5 instances of direct interpolation in run blocks. Expressions: `inputs.file_glob`, `inputs.source_dir`, `inputs.target_dir`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/drill
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:86` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/druid
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `amannn/action-semantic-pull-request` (1), `mikepenz/action-junit-report` (1).
+- **[LOW]** `worker.yml:85,86,90` — [run_block_injection] 4 instances of direct interpolation in run blocks. Expressions: `inputs.jdk`, `inputs.key`, `inputs.script`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `pr-merged.yml:36` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: Kesin11/actions-timeline, amannn/action-semantic-pull-request, mikepenz/action-junit-report
+
+### apache/druid-operator
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/dubbo
+
+**4** findings | INFO: 2, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 11 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `msys2/setup-msys2` (5), `codecov/codecov-action` (3), `graalvm/setup-graalvm` (3).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `build-and-test-pr.yml:119` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: graalvm/setup-graalvm, msys2/setup-msys2
+
+### apache/dubbo-admin
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:73` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/dubbo-awesome
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/dubbo-benchmark
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/dubbo-getty
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `zcong1993/actions-ding` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `github-actions.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: zcong1993/actions-ding
+
+### apache/dubbo-go
+
+**4** findings | INFO: 2, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1), `release-drafter/release-drafter` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `github-actions.yml:51` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: release-drafter/release-drafter
+
+### apache/dubbo-go-contrib
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `license.yml:68` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+
+### apache/dubbo-go-extensions
+
+**4** findings | INFO: 2, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1), `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `github-actions.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+
+### apache/dubbo-go-hessian2
+
+**6** findings | INFO: 2, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `zcong1993/actions-ding` (2).
+- **[LOW]** `github-actions.yml:107` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.DING_SIGN`, `secrets.DING_TOKEN`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `github-actions.yml:53` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: zcong1993/actions-ding
+
+### apache/dubbo-go-pixiu
+
+**6** findings | INFO: 2, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1), `codecov/codecov-action` (1), `wangyoucao577/go-release-action` (1).
+- **[LOW]** `sync-to-upstream.yml` — [prt_checkout] pull_request_target trigger with checkout action using custom ref. Verify the ref does not resolve to untrusted PR code.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `github-actions.yml:38` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: golangci/golangci-lint-action, wangyoucao577/go-release-action
+
+### apache/dubbo-go-pixiu-samples
+
+**6** findings | INFO: 2, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1), `wangyoucao577/go-release-action` (1).
+- **[LOW]** `sync-to-upstream.yml` — [prt_checkout] pull_request_target trigger with checkout action using custom ref. Verify the ref does not resolve to untrusted PR code.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `github-actions.yml:37` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: golangci/golangci-lint-action, wangyoucao577/go-release-action
+
+### apache/dubbo-go-samples
+
+**4** findings | INFO: 2, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `github-actions.yml:31` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+
+### apache/dubbo-hessian-lite
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/dubbo-initializer
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 7 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (2), `docker/setup-buildx-action` (2), `docker/build-push-action` (2), `docker/login-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/dubbo-integration-cases
+
+**4** findings | INFO: 2, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `dubbo-3_2.yml:40` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `dubbo-3_3.yml:40` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/dubbo-js
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/dubbo-kubernetes
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1), `azure/setup-helm` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/dubbo-python
+
+**3** findings | HIGH: 1, LOW: 2
+
+- **[HIGH]** `license-check.yaml:9` — [broad_permissions] Workflow uses `permissions: write-all`. Follow least-privilege principle.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/dubbo-rust
+
+**6** findings | INFO: 3, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `actions-rs/toolchain` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `github-actions.yml:29` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `licence-checker.yml:37` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: actions-rs/toolchain
+
+### apache/dubbo-samples
+
+**4** findings | INFO: 2, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `dubbo-3_2.yml:51` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `dubbo-3_3.yml:49` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/dubbo-spi-extensions
+
+**5** findings | INFO: 3, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `msys2/setup-msys2` (2), `codecov/codecov-action` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `build-and-test-pr.yml:38` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `conformance.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: msys2/setup-msys2
+
+### apache/dubbo-spi-samples
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `dubbo-3_2.yml:43` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/dubbo-spring-boot-project
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `dubbo-2.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/dubbo-test-tools
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `unit-test.yml:29` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/dubbo-website
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-hugo` (4), `peaceiris/actions-gh-pages` (4).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/echarts
+
+**4** findings | INFO: 1, LOW: 3
+
+- **[LOW]** `teardown-pr-preview.yml:30` — [run_block_injection] Secret `${{ secrets.SURGE_TOKEN }}` directly interpolated in run block at step 'Teardown closed PR preview' in workflow teardown-pr-preview.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:39` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/echarts-bot
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/echarts-doc
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/echarts-examples
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/echarts-handbook
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/echarts-theme-builder
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/echarts-website
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/eventmesh
+
+**3** findings | INFO: 1, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 7 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (3), `dependabot/fetch-metadata` (1), `docker/login-action` (1), `docker/metadata-action` (1), `docker/build-push-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: dependabot/fetch-metadata
+
+### apache/eventmesh-catalog
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+
+### apache/eventmesh-dashboard
+
+**3** findings | INFO: 1, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dependabot/fetch-metadata` (1), `gradle/actions` (1), `docker/login-action` (1), `docker/metadata-action` (1), `docker/build-push-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: dependabot/fetch-metadata
+
+### apache/eventmesh-go
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+
+### apache/eventmesh-site
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/eventmesh-workflow
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `golangci/golangci-lint-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: golangci/golangci-lint-action
+
+### apache/felix-atomos
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/felix-dev
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+
+### apache/fesod
+
+**4** findings | INFO: 2, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 7 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pnpm/action-setup` (3), `EnricoMi/publish-unit-test-result-action` (2), `peaceiris/actions-gh-pages` (1), `korandoru/hawkeye` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `ci.yml:50` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: DavidAnson/markdownlint-cli2-action, korandoru/hawkeye, nwtgck/actions-netlify
+
+### apache/fineract
+
+**9** findings | INFO: 6, LOW: 3
+
+- **[LOW]** `pr-title-check.yml:18` — [run_block_injection] Untrusted input `${{ github.event.pull_request.title }}` interpolated in run block at step 'Verify Title Format' in workflow pr-title-check.yml. Trigger is `pull_request` (not `pull_request_target`), so fork PRs do not have access to secrets. Same-repo PRs are from committers. Shell injection possible but low impact.
+- **[LOW]** `publish-dockerhub.yml:44,45` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.DOCKERHUB_TOKEN`, `secrets.DOCKERHUB_USER`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `build-cucumber.yml:42` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `build-mariadb.yml:59` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `build-mysql.yml:59` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `build-postgresql.yml:60` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `liquibase-only-postgresql.yml:41` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: onyxmueller/build-tag-number
+
+### apache/fineract-backoffice-ui
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/fineract-chat-archive
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/fineract-credit-scorecard
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/fineract-site
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flagon
+
+**3** findings | INFO: 1, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pnpm/action-setup` (2), `snok/install-poetry` (1), `ruby/setup-ruby` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: snok/install-poetry
+
+### apache/flex-site
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink
+
+**11** findings | INFO: 1, LOW: 7, MEDIUM: 3
+
+- **[MEDIUM]** `.github/actions/job_init/action.yml:74` — [composite_action_input_injection] Composite action `job_init` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[MEDIUM]** `.github/actions/run_mvn/action.yml:41` — [composite_action_input_injection] Composite action `run_mvn` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[MEDIUM]** `.github/actions/stringify/action.yml:41` — [composite_action_input_injection] Composite action `stringify` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[LOW]** `docs-legacy.yml:56` — [run_block_injection] Workflow input `${{ inputs.branch }}` directly interpolated in run block at step 'Set branch environment variable' in workflow docs-legacy.yml. Trusted committer input but should use env: block.
+- **[LOW]** `template.flink-ci.yml:164,259,400` — [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.environment`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[LOW]** `.github/actions/job_init/action.yml:74,75,89,93,94,95,96` — [composite_action_injection] 7 instances of direct interpolation in run blocks. Expressions: `inputs.jdk_version`, `inputs.source_directory`, `inputs.target_directory`.
+- **[LOW]** `.github/actions/run_mvn/action.yml:41,42` — [composite_action_injection] 2 instances of direct interpolation in run blocks. Expressions: `inputs.env`, `inputs.maven-parameters`.
+- **[LOW]** `.github/actions/stringify/action.yml:41` — [composite_action_injection] Workflow input `${{ inputs.value }}` directly interpolated in run block at step 'Stringify '${{ inputs.value }}' in composite action .github/actions/stringify. Trusted committer input but should use env: block.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: burnett01/rsync-deployments
+
+### apache/flink-agents
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `astral-sh/setup-uv` (4).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: astral-sh/setup-uv, burnett01/rsync-deployments, jlumbroso/free-disk-space
+
+### apache/flink-benchmarks
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `stCarolas/setup-maven` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+
+### apache/flink-cdc
+
+**5** findings | INFO: 1, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `ruby/setup-ruby` (2), `stCarolas/setup-maven` (1).
+- **[LOW]** `flink_cdc_base.yml:109,111` — [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.custom-maven-parameter`, `inputs.parallelism`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: burnett01/rsync-deployments, stCarolas/setup-maven, tcort/github-action-markdown-link-check
+
+### apache/flink-connector-aws
+
+**5** findings | INFO: 1, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `stCarolas/setup-maven` (1).
+- **[LOW]** `common.yml:98,107,117,118,132,133` — [run_block_injection] 6 instances of direct interpolation in run blocks. Expressions: `inputs.flink_url`, `inputs.flink_version`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+
+### apache/flink-connector-cassandra
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-connector-elasticsearch
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-connector-gcp-pubsub
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-connector-hbase
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-connector-hive
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-connector-http
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-connector-jdbc
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `stCarolas/setup-maven` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+
+### apache/flink-connector-kafka
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-connector-kudu
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-connector-mongodb
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-connector-opensearch
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-connector-prometheus
+
+**5** findings | INFO: 1, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `stCarolas/setup-maven` (1).
+- **[LOW]** `common.yml:95,104` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `inputs.flink_url`, `inputs.flink_version`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+
+### apache/flink-connector-pulsar
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-connector-rabbitmq
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-connector-redis-streams
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-docker
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-qemu-action` (2), `docker/setup-buildx-action` (2), `docker/login-action` (2), `docker/build-push-action` (1), `docker/bake-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-jira-bot
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-kubernetes-operator
+
+**6** findings | LOW: 5, MEDIUM: 1
+
+- **[MEDIUM]** `.github/actions/rsync-deployments/action.yml:38` — [composite_action_input_injection] Composite action `rsync-deployments` directly interpolates `inputs.*` in run block. Not exploitable unless a calling workflow passes attacker-controlled values (PR title, branch name, comment body). Currently a latent injection surface — verify callers only pass trusted input.
+- **[LOW]** `docker_push.yml:61` — [run_block_injection] Secret `${{ secrets.GITHUB_TOKEN }}` directly interpolated in run block at step 'Log in to the Container registry' in workflow docker_push.yml. Trusted value but risks log leakage.
+- **[LOW]** `e2e.yaml:60,61,69,73,78,81,82,83,86,87,88,92,94,102,103,107,111` — [run_block_injection] 17 instances of direct interpolation in run blocks. Expressions: `inputs.append-java-version`, `inputs.flink-version`, `inputs.http-client`, `inputs.java-version`, `inputs.mode` +2 more.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[LOW]** `.github/actions/rsync-deployments/action.yml:38,41,44,45,48` — [composite_action_injection] 7 instances of direct interpolation in run blocks. Expressions: `inputs.path`, `inputs.remote_host`, `inputs.remote_key`, `inputs.remote_path`, `inputs.remote_port` +2 more.
+
+### apache/flink-ml
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-shaded
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `stCarolas/setup-maven` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+
+### apache/flink-statefun
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/flink-training
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/fluss
+
+**5** findings | INFO: 1, LOW: 4
+
+- **[LOW]** `ci-template.yaml:55,62` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `inputs.maven-parameters`.
+- **[LOW]** `docs-deploy.yaml:39` — [run_block_injection] Secret `${{ secrets.GH_TOKEN }}` directly interpolated in run block at step 'Send Event to Trigger Deploy' in workflow docs-deploy.yaml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci-template.yaml:35` — [self_hosted_runner] Uses self-hosted runners. Ensure runners are ephemeral.
+
+### apache/fluss-blog
+
+**3** findings | LOW: 3
+
+- **[LOW]** `blog-deploy.yaml:37` — [run_block_injection] Secret `${{ secrets.GH_TOKEN }}` directly interpolated in run block at step 'Send Event to Trigger Deploy' in workflow blog-deploy.yaml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/fluss-rust
+
+**3** findings | INFO: 1, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `PyO3/maturin-action` (5), `taiki-e/install-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 6 third-party actions: PyO3/maturin-action, Swatinem/rust-cache, arduino/setup-protoc, astral-sh/setup-uv, mozilla-actions/sccache-action, taiki-e/install-action
+
+### apache/fluss-shaded
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `stCarolas/setup-maven` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: stCarolas/setup-maven
+
+### apache/fluss-website
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/fory
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `Swatinem/rust-cache` (2), `subosito/flutter-action` (1), `korandoru/hawkeye` (1), `amannn/action-semantic-pull-request` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:78` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 11 third-party actions: Swatinem/rust-cache, amannn/action-semantic-pull-request, bazel-contrib/setup-bazel, betahuhn/repo-file-sync-action, dart-lang/setup-dart, dtolnay/rust-toolchain, graalvm/setup-graalvm, korandoru/hawkeye, rust-lang/crates-io-auth-action, sbt/setup-sbt +1 more
+
+### apache/fory-site
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1), `gaurav-nelson/github-action-markdown-link-check` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: gaurav-nelson/github-action-markdown-link-check
+
+### apache/freemarker
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/geaflow
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `arduino/setup-protoc` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: arduino/setup-protoc
+
+### apache/geaflow-website
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/geode
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 9 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (9).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/geode-benchmarks
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/gradle-build-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/geode-examples
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/gradle-build-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/geode-kafka-connector
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/geode-site
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/gradle-build-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/geronimo-arthur
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `maven.yml:40` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/geronimo-batchee
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `ci.yml:52` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/geronimo-mail
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yml:40` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/geronimo-txmanager
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `maven.yml:32` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/gluten
+
+**11** findings | HIGH: 1, INFO: 6, LOW: 3, MEDIUM: 1
+
+- **[HIGH]** `clickhouse_be_trigger.yml:44` — [broad_permissions] Workflow uses `permissions: write-all`. Follow least-privilege principle.
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dawidd6/action-download-artifact` (2), `jidicula/clang-format-action` (1).
+- **[LOW]** `build_bundle_package.yml:105` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.hadoop`, `github.event.inputs.spark`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `clickhouse_be_trigger.yml:47` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `pr_bot.yml:44` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `velox_backend_arm.yml:60` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `velox_backend_enhanced.yml:60` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `velox_backend_x86.yml:62` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 4 third-party actions: burnett01/rsync-deployments, dawidd6/action-download-artifact, jidicula/clang-format-action, scacap/action-surefire-report
+
+### apache/gobblin
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 5 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/login-action` (2), `codecov/codecov-action` (1), `docker/setup-buildx-action` (1), `docker/build-push-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `build_and_test.yaml:50` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/gora
+
+**6** findings | INFO: 3, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `scacap/action-surefire-report` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `master-pr-build.yml:36` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `master-pr-build.yml:39` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: scacap/action-surefire-report
+
+### apache/grails-core
+
+**11** findings | INFO: 2, LOW: 8, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 32 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `testlens-app/setup-testlens` (26), `softprops/action-gh-release` (5), `release-drafter/release-drafter` (1).
+- **[LOW]** `forge-deploy-next.yml:96,99,102,155` — [run_block_injection] 8 instances of direct interpolation in run blocks. Expressions: `secrets.GCLOUD_EMAIL`, `secrets.GCP_PROJECT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_SECRET`, `secrets.GH_REDIRECT_URL` +1 more.
+- **[LOW]** `forge-deploy-prev-snapshot.yml:96,99,102,155` — [run_block_injection] 8 instances of direct interpolation in run blocks. Expressions: `secrets.GCLOUD_EMAIL`, `secrets.GCP_PROJECT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_SECRET`, `secrets.GH_REDIRECT_URL` +1 more.
+- **[LOW]** `forge-deploy-prev.yml:96,99,102,155` — [run_block_injection] 8 instances of direct interpolation in run blocks. Expressions: `secrets.GCLOUD_EMAIL`, `secrets.GCP_PROJECT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_SECRET`, `secrets.GH_REDIRECT_URL` +1 more.
+- **[LOW]** `forge-deploy-release.yml:104,106,163,165` — [run_block_injection] 16 instances of direct interpolation in run blocks. Expressions: `secrets.GCLOUD_EMAIL`, `secrets.GCP_PROJECT_ID`, `secrets.GH_OAUTH_LATEST_CLIENT_ID`, `secrets.GH_OAUTH_LATEST_CLIENT_SECRET`, `secrets.GH_REDIRECT_URL` +1 more.
+- **[LOW]** `forge-deploy-snapshot.yml:94,97,100,151` — [run_block_injection] 8 instances of direct interpolation in run blocks. Expressions: `secrets.GCLOUD_EMAIL`, `secrets.GCP_PROJECT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_ID`, `secrets.GH_OAUTH_SNAPSHOT_CLIENT_SECRET`, `secrets.GH_REDIRECT_URL` +1 more.
+- **[LOW]** `release-abort.yml:43,55` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.release_tag`, `secrets.STAGING_PROFILE_ID`.
+- **[LOW]** `release.yml:96,121,301` — [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `secrets.GPG_KEY_ID`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `groovy-joint-workflow.yml:44` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: nick-fields/retry, release-drafter/release-drafter, testlens-app/setup-testlens
+
+### apache/grails-forge-ui
+
+**2** findings | LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/grails-github-actions
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `release.yml:89` — [run_block_injection] Secret `${{ secrets.GRAILS_GPG_KEY }}` directly interpolated in run block at step '🔐 Set up GPG' in workflow release.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: release-drafter/release-drafter
+
+### apache/grails-gradle-publish
+
+**5** findings | INFO: 1, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 9 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (5), `softprops/action-gh-release` (3), `release-drafter/release-drafter` (1).
+- **[LOW]** `release-abort.yml:43,55` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.release_tag`, `secrets.STAGING_PROFILE_ID`.
+- **[LOW]** `release.yaml:189` — [run_block_injection] Secret `${{ secrets.GPG_KEY_ID }}` directly interpolated in run block at step '🔏 Sign source distribution ZIP' in workflow release.yaml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: release-drafter/release-drafter
+
+### apache/grails-plugins-metadata
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peter-evans/create-pull-request` (2).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/grails-quartz
+
+**4** findings | INFO: 1, LOW: 3
+
+- **[LOW]** `release-abort.yml:43,55` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.release_tag`, `secrets.STAGING_PROFILE_ID`.
+- **[LOW]** `release.yml:59,179` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.GRAILS_GPG_KEY`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: release-drafter/release-drafter
+
+### apache/grails-redis
+
+**4** findings | INFO: 1, LOW: 3
+
+- **[LOW]** `release-abort.yml:43,55` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.release_tag`, `secrets.STAGING_PROFILE_ID`.
+- **[LOW]** `release.yml:58,178` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.GRAILS_GPG_KEY`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: release-drafter/release-drafter
+
+### apache/grails-spring-security
+
+**4** findings | INFO: 1, LOW: 3
+
+- **[LOW]** `release-abort.yml:43,55` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.release_tag`, `secrets.STAGING_PROFILE_ID`.
+- **[LOW]** `release.yml:64,184` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `secrets.GRAILS_GPG_KEY`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: release-drafter/release-drafter
+
+### apache/grails-static-website
+
+**4** findings | INFO: 1, LOW: 3
+
+- **[LOW]** `release.yml:20` — [run_block_injection] Workflow input `${{ github.event.inputs.grails_version }}` directly interpolated in run block at step 'Run Release Script' in workflow release.yml. Trusted committer input but should use env: block.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: scacap/action-surefire-report
+
+### apache/gravitino
+
+**8** findings | INFO: 1, LOW: 6, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `azure/setup-helm` (1), `container-tools/kind-action` (1), `docker/setup-qemu-action` (1), `pnpm/action-setup` (1).
+- **[LOW]** `backend-integration-test-action.yml:70,81` — [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `inputs.backend`, `inputs.changed-catalogs-contrib-modules`, `inputs.test-mode`.
+- **[LOW]** `chart-release.yaml:52,57,69,70,76,77,83,84` — [run_block_injection] 9 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.charts`, `github.event.inputs.username`, `github.event.inputs.version`, `secrets.DOCKER_REPOSITORY_PASSWORD`.
+- **[LOW]** `cherry-pick-branch.yml:64,67,68,72,83,131` — [run_block_injection] 7 instances of direct interpolation in run blocks. Expressions: `inputs.commit-sha`, `inputs.target-branch`.
+- **[LOW]** `docker-image.yml:57,59,61,63,65,67,69,71,73,75,77,79,80,81,83,85,87,89,91,93,95,96,98,99,101,104,142,144` — [run_block_injection] 28 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.docker_repo_name`, `github.event.inputs.image`, `github.event.inputs.publish-latest-tag`, `github.event.inputs.version`.
+- **[LOW]** `spark-integration-test-action.yml:59,60,62,63` — [run_block_injection] 7 instances of direct interpolation in run blocks. Expressions: `inputs.scala-version`, `inputs.test-mode`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 2 third-party actions: container-tools/kind-action, helm/chart-testing-action
+
+### apache/gravitino-site
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `korandoru/hawkeye` (1), `pnpm/action-setup` (1), `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: korandoru/hawkeye
+
+### apache/groovy
+
+**2** findings | LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/groovy-geb
+
+**2** findings | LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `gradle/actions` (5), `gradle/wrapper-validation-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/guacamole-client
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/guacamole-manual
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/guacamole-server
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/guacamole-website
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/hadoop
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `labeler.yml:31` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+
+### apache/hadoop-api-shim
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/hadoop-thirdparty
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/hamilton
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pypa/gh-action-pypi-publish` (1), `docker/login-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/hbase
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/helix
+
+**6** findings | HIGH: 2, LOW: 3, MEDIUM: 1
+
+- **[HIGH]** `Helix-CI.yml:8` — [broad_permissions] Workflow uses `permissions: write-all`. Follow least-privilege principle.
+- **[HIGH]** `Helix-Manual-CI.yml:18` — [broad_permissions] Workflow uses `permissions: write-all`. Follow least-privilege principle.
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dorny/test-reporter` (2).
+- **[LOW]** `Helix-Manual-CI.yml:38` — [run_block_injection] 2 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.goals`, `github.event.inputs.mvnOpts`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/hertzbeat
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `pnpm/action-setup` (4), `codecov/codecov-action` (2), `peaceiris/actions-gh-pages` (1), `dtolnay/rust-toolchain` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `mcp-bashserver-test.yml:53` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: DavidAnson/markdownlint-cli2-action, dtolnay/rust-toolchain, graalvm/setup-graalvm
+
+### apache/hertzbeat-collector-go
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `amannn/action-semantic-pull-request` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: amannn/action-semantic-pull-request
+
+### apache/hertzbeat-helm-chart
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `azure/setup-helm` (1), `helm/chart-testing-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: helm/chart-testing-action
+
+### apache/hive
+
+**6** findings | INFO: 1, LOW: 4, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 8 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/build-push-action` (4), `docker/login-action` (1), `docker/setup-buildx-action` (1), `helm/kind-action` (1), `azure/setup-helm` (1).
+- **[LOW]** `docker-GA-images.yml:74,75,76` — [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.hadoopVersion`, `github.event.inputs.hiveVersion`, `github.event.inputs.tezVersion`.
+- **[LOW]** `docker-images.yml:79,80,81` — [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `github.event.inputs.hadoopVersion`, `github.event.inputs.hiveVersion`, `github.event.inputs.tezVersion`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: helm/kind-action
+
+### apache/hive-site
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-hugo` (1), `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/hop
+
+**4** findings | INFO: 2, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `pr_build_code.yml:42` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: damccorm/tag-ur-it
+
+### apache/httpcomponents-client
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `maven.yml:39` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/httpcomponents-core
+
+**2** findings | INFO: 1, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `maven.yml:39` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/httpd
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `linux.yml:359` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/httpd-tests
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/hudi
+
+**5** findings | INFO: 1, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 15 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (14), `amannn/action-semantic-pull-request` (1).
+- **[LOW]** `pr_title_validation.yml:21` — [run_block_injection] Untrusted input `${{ github.event.pull_request.title }}` interpolated in run block at step 'Check for legacy PR title format using JIRA or MINOR' in workflow pr_title_validation.yml. Trigger is `pull_request` (not `pull_request_target`), so fork PRs do not have access to secrets. Same-repo PRs are from committers. Shell injection possible but low impact.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: amannn/action-semantic-pull-request
+
+### apache/hudi-rs
+
+**4** findings | INFO: 2, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 7 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `PyO3/maturin-action` (4), `Swatinem/rust-cache` (2), `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `ci.yml:179` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: PyO3/maturin-action, Swatinem/rust-cache, astral-sh/setup-uv
+
+### apache/hugegraph
+
+**7** findings | INFO: 4, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 6 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (5), `peter-evans/create-or-update-comment` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `cluster-test-ci.yml:25` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `commons-ci.yml:31` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `pd-store-ci.yml:25` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `server-ci.yml:57` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/hugegraph-ai
+
+**7** findings | INFO: 4, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peter-evans/create-or-update-comment` (1), `aormsby/Fork-Sync-With-Upstream-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `hugegraph-llm.yml:56` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `hugegraph-python-client.yml:39` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `ruff.yml:32` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: aormsby/Fork-Sync-With-Upstream-action
+
+### apache/hugegraph-computer
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `computer-ci.yml:55` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/hugegraph-doc
+
+**6** findings | INFO: 2, LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peter-evans/create-or-update-comment` (1), `peaceiris/actions-hugo` (1), `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `validate-release.yml:73,74,77,78,82,99,109,195,198,206,210,215,222,230,240,250,306,309,317,319,324,331,339,348` — [run_block_injection] 29 instances of direct interpolation in run blocks. Expressions: `inputs.release_version`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `hugo.yml:36` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `validate-release.yml:42` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/hugegraph-toolchain
+
+**9** findings | INFO: 6, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (4).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `client-ci.yml:44` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `client-go-ci.yml:47` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `hubble-ci.yml:61` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `loader-ci.yml:60` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `spark-connector-ci.yml:47` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `tools-ci.yml:47` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/incubator-baremaps
+
+**5** findings | LOW: 5
+
+- **[LOW]** `pre-release.yml:40,50,53` — [run_block_injection] 3 instances of direct interpolation in run blocks. Expressions: `secrets.BAREMAPS_GPG_SECRET_KEY`, `secrets.GPG_KEY_ID`.
+- **[LOW]** `release.yml:39,49,52,73` — [run_block_injection] 5 instances of direct interpolation in run blocks. Expressions: `secrets.BAREMAPS_GPG_SECRET_KEY`, `secrets.GPG_KEY_ID`, `secrets.INCUBATOR_SVN_DEV_PASSWORD`, `secrets.INCUBATOR_SVN_DEV_USERNAME`.
+- **[LOW]** `snapshot.yml:31` — [run_block_injection] Secret `${{ secrets.BAREMAPS_GPG_SECRET_KEY }}` directly interpolated in run block at step 'Set up GPG' in workflow snapshot.yml. Trusted value but risks log leakage.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/incubator-baremaps-site
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/incubator-devlake-helm-chart
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `container-tools/kind-action` (1), `docker/login-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: container-tools/kind-action
+
+### apache/kafka
+
+**4** findings | INFO: 3, LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `pr-labeled.yml:38` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `pr-update.yml:40` — [prt_checkout] pull_request_target trigger with checkout action (default ref). Default behavior checks out base branch — safe unless ref: is added later.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: lhotari/sandboxed-trivy-action
+
+### apache/kafka-merge-queue-sandbox
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/kafka-site
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 4 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/setup-buildx-action` (1), `docker/login-action` (1), `docker/metadata-action` (1), `docker/build-push-action` (1).
+- **[LOW]** `build-and-deploy.yml:54` — [run_block_injection] Workflow input `${{ inputs.deploy-to-asf-site && 'asf-site' || 'asf-staging' }}` directly interpolated in run block at step 'Configure' in workflow build-and-deploy.yml. Trusted committer input but should use env: block.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/karaf
+
+**3** findings | INFO: 1, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dawidd6/action-download-artifact` (2), `EnricoMi/publish-unit-test-result-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: dawidd6/action-download-artifact
+
+### apache/karaf-cellar
+
+**1** findings | LOW: 1
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+
+### apache/karaf-decanter
+
+**4** findings | INFO: 2, LOW: 1, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 3 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `dawidd6/action-download-artifact` (2), `EnricoMi/publish-unit-test-result-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[INFO]** `ci.yml:49` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 1 third-party actions: dawidd6/action-download-artifact
+
+### apache/karaf-minho
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/karaf-winegrower
+
+**3** findings | INFO: 1, LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `maven.yml:39` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/knox
+
+**4** findings | LOW: 3, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `EnricoMi/publish-unit-test-result-action` (1).
+- **[LOW]** `docker-publish.yml:42,43,68,69` — [run_block_injection] 4 instances of direct interpolation in run blocks. Expressions: `secrets.DOCKERHUB_TOKEN`, `secrets.DOCKERHUB_USER`.
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/kvrocks
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `crate-ci/typos` (1), `amannn/action-semantic-pull-request` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `kvrocks.yaml:80` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `(repo-wide)` — [third_party_actions] 3 third-party actions: SonarSource/sonarqube-scan-action, amannn/action-semantic-pull-request, crate-ci/typos
+
+### apache/kvrocks-controller
+
+**4** findings | INFO: 1, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `ci.yaml:50` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/kvrocks-website
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/kyuubi
+
+**5** findings | INFO: 2, LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `codecov/codecov-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+- **[INFO]** `master.yml:114` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+- **[INFO]** `web-ui.yml:44` — [cache_poisoning] Uses actions/cache with PR trigger. Verify cache keys are not PR-controlled.
+
+### apache/kyuubi-docker
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 1 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `docker/login-action` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/kyuubi-shaded
+
+**2** findings | LOW: 2
+
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+### apache/kyuubi-website
+
+**3** findings | LOW: 2, MEDIUM: 1
+
+- **[MEDIUM]** `(repo-wide)` — [unpinned_actions] 2 unpinned third-party action refs (mutable tags, outside actions/*/github/*/apache/*). Top: `peaceiris/actions-hugo` (1), `peaceiris/actions-gh-pages` (1).
+- **[LOW]** `(missing)` — [missing_codeowners] No CODEOWNERS file. Workflow changes have no mandatory review.
+- **[LOW]** `(missing)` — [missing_dependency_updates] No dependabot.yml or renovate.json found. ASF policy requires automated dependency management.
+
+---
+
+*Findings cached in `ci-security:apache`.*
\ No newline at end of file
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org