Skip to content

SHA-Pin Audit: org-wide findings #47

Open
Open
SHA-Pin Audit: org-wide findings#47
Labels
area:ciCI/CD pipelines

Description

@github-actions
github-actions
bot
opened on Aug 15, 2026

SHA-Pin Audit Report

Date: 2026-08-15
Repos scanned: 34
Findings: 280 (12 HIGH, 268 MEDIUM)

HIGH — Internal actions not SHA-pinned

Repo File Action Current Ref
Cursor-Governance governance.yml Quantum-L9/.github/.github/workflows/governance-pr.yml @v1
Cursor-Governance governance.yml Quantum-L9/.github/.github/workflows/governance-issue.yml @v1
l9-dependency-template governance.yml Quantum-L9/.github/.github/workflows/governance-pr.yml @v1
l9-dependency-template governance.yml Quantum-L9/.github/.github/workflows/governance-issue.yml @v1
LLM-Router l9-governance.yml Quantum-L9/l9-ci-core/.github/workflows/trio-governance.yml @v1
LLM-Router l9-nightly.yml Quantum-L9/l9-ci-core/.github/workflows/nightly.yml @v1
LLM-Router l9-pre-commit.yml Quantum-L9/l9-ci-core/.github/workflows/pre-commit-ci.yml @v1
LLM-Router l9-sbom.yml Quantum-L9/l9-ci-core/.github/workflows/sbom.yml @v1
LLM-Router l9-scorecard.yml Quantum-L9/l9-ci-core/.github/workflows/scorecard.yml @v1
LLM-Router l9-security.yml Quantum-L9/l9-ci-core/.github/workflows/security.yml @v1
l9-repo-template governance.yml Quantum-L9/.github/.github/workflows/governance-pr.yml @v1
l9-repo-template governance.yml Quantum-L9/.github/.github/workflows/governance-issue.yml @v1

MEDIUM — External actions not SHA-pinned

Repo File Action Current Ref
Cursor-Governance codeql-reusable.yml actions/checkout @v7
Cursor-Governance codeql-reusable.yml github/codeql-action/init @v3
Cursor-Governance codeql-reusable.yml github/codeql-action/analyze @v3
Cursor-Governance governance-self-check.yml actions/setup-python @v5
Cursor-Governance repo-hygiene.yml actions/setup-python @v5
Cursor-Governance validate-org-policy.yml actions/checkout @v7
Cursor-Governance validate-org-policy.yml actions/setup-python @v7
Cognitive.Engine.Graphs audit.yml actions/upload-artifact @v7
Cognitive.Engine.Graphs audit.yml actions/github-script @v8
Cognitive.Engine.Graphs ci-quality.yml actions/checkout @v6
Cognitive.Engine.Graphs ci-quality.yml actions/setup-python @v7
Cognitive.Engine.Graphs ci-quality.yml actions/checkout @v6
Cognitive.Engine.Graphs ci-quality.yml actions/checkout @v6
Cognitive.Engine.Graphs ci-quality.yml actions/checkout @v6
Cognitive.Engine.Graphs ci-quality.yml actions/setup-python @v7
Cognitive.Engine.Graphs ci-quality.yml actions/checkout @v6
Cognitive.Engine.Graphs ci.yml actions/checkout @v6
Cognitive.Engine.Graphs ci.yml actions/setup-python @v7
Cognitive.Engine.Graphs ci.yml actions/checkout @v6
Cognitive.Engine.Graphs ci.yml actions/setup-python @v7
Cognitive.Engine.Graphs ci.yml actions/checkout @v6
Cognitive.Engine.Graphs ci.yml actions/setup-python @v7
Cognitive.Engine.Graphs ci.yml actions/checkout @v6
Cognitive.Engine.Graphs ci.yml actions/setup-python @v7
Cognitive.Engine.Graphs ci.yml actions/checkout @v6
Cognitive.Engine.Graphs ci.yml actions/setup-python @v7
Cognitive.Engine.Graphs ci.yml actions/checkout @v6
Cognitive.Engine.Graphs ci.yml actions/checkout @v6
Cognitive.Engine.Graphs ci.yml github/codeql-action/upload-sarif @v4
Cognitive.Engine.Graphs codeql.yml actions/checkout @v6
Cognitive.Engine.Graphs codeql.yml github/codeql-action/init @v4
Cognitive.Engine.Graphs codeql.yml github/codeql-action/analyze @v4
Cognitive.Engine.Graphs compliance.yml actions/setup-python @v5
Cognitive.Engine.Graphs dev-layer-gmp.yml actions/checkout @v6
Cognitive.Engine.Graphs dev-layer-gmp.yml actions/setup-python @v7
Cognitive.Engine.Graphs docker-build.yml actions/checkout @v6
Cognitive.Engine.Graphs docker-build.yml github/codeql-action/upload-sarif @v4
Cognitive.Engine.Graphs docs-code-sync.yml actions/checkout @v6
Cognitive.Engine.Graphs docs-code-sync.yml actions/setup-python @v7
Cognitive.Engine.Graphs k8s-deploy.yml actions/checkout @v6
Cognitive.Engine.Graphs lint-autofix.yml actions/checkout @v6
Cognitive.Engine.Graphs lint-autofix.yml actions/setup-python @v7
Cognitive.Engine.Graphs pr-review-enforcement.yml actions/checkout @v6
Cognitive.Engine.Graphs pr-review-enforcement.yml actions/github-script @v8
Cognitive.Engine.Graphs refactoring-validation.yml actions/checkout @v6
Cognitive.Engine.Graphs refactoring-validation.yml actions/setup-python @v7
Cognitive.Engine.Graphs supply-chain.yml actions/checkout @v6
Cognitive.Engine.Graphs supply-chain.yml github/codeql-action/upload-sarif @v4
Cognitive.Engine.Graphs supply-chain.yml actions/upload-artifact @v7
Cognitive.Engine.Graphs supply-chain.yml actions/checkout @v6
Cognitive.Engine.Graphs supply-chain.yml actions/checkout @v6
Cognitive.Engine.Graphs supply-chain.yml actions/checkout @v6
Cognitive.Engine.Graphs supply-chain.yml actions/setup-python @v7
Cognitive.Engine.Graphs supply-chain.yml actions/upload-artifact @v7
Cognitive.Engine.Graphs terminology-guard.yml actions/checkout @v6
Cognitive.Engine.Graphs terminology-guard.yml actions/setup-python @v7
Enrichment.Inference.Engine audit-pr-review.yml actions/checkout @v7
Enrichment.Inference.Engine audit-pr-review.yml actions/setup-python @v7
Enrichment.Inference.Engine audit-pr-review.yml actions/github-script @v9
Enrichment.Inference.Engine audit-pr-review.yml actions/github-script @v9
Enrichment.Inference.Engine ci.yml actions/checkout @v7
Enrichment.Inference.Engine ci.yml actions/setup-python @v7
Enrichment.Inference.Engine ci.yml actions/checkout @v7
Enrichment.Inference.Engine ci.yml actions/setup-python @v7
Enrichment.Inference.Engine ci.yml actions/checkout @v7
Enrichment.Inference.Engine ci.yml actions/checkout @v7
Enrichment.Inference.Engine ci.yml actions/setup-python @v7
Enrichment.Inference.Engine ci.yml codecov/codecov-action @v7
Enrichment.Inference.Engine ci.yml actions/checkout @v7
Enrichment.Inference.Engine ci.yml actions/setup-python @v7
Enrichment.Inference.Engine ci.yml actions/dependency-review-action @v5
Enrichment.Inference.Engine ci.yml actions/checkout @v7
Enrichment.Inference.Engine ci.yml anchore/sbom-action @v0
Enrichment.Inference.Engine ci.yml actions/checkout @v7
Enrichment.Inference.Engine ci.yml github/codeql-action/upload-sarif @v4
Enrichment.Inference.Engine codeql.yml actions/checkout @v7
Enrichment.Inference.Engine codeql.yml github/codeql-action/init @v4
Enrichment.Inference.Engine codeql.yml github/codeql-action/autobuild @v4
Enrichment.Inference.Engine codeql.yml github/codeql-action/analyze @v4
Enrichment.Inference.Engine compliance.yml actions/checkout @v7
Enrichment.Inference.Engine compliance.yml actions/setup-python @v7
Enrichment.Inference.Engine docker-build.yml actions/checkout @v7
Enrichment.Inference.Engine docker-build.yml docker/setup-buildx-action @v4
Enrichment.Inference.Engine docker-build.yml docker/login-action @v4
Enrichment.Inference.Engine docker-build.yml docker/metadata-action @v6
Enrichment.Inference.Engine docker-build.yml docker/build-push-action @v7
Enrichment.Inference.Engine docker-build.yml actions/checkout @v7
Enrichment.Inference.Engine docker-build.yml docker/login-action @v4
Enrichment.Inference.Engine docker-build.yml aquasecurity/trivy-action @v0.36.0
Enrichment.Inference.Engine docker-build.yml github/codeql-action/upload-sarif @v4
Enrichment.Inference.Engine docker-build.yml docker/login-action @v4
Enrichment.Inference.Engine docker-build.yml anchore/sbom-action @v0.17.0
Enrichment.Inference.Engine docs-sync.yml actions/checkout @v7
Enrichment.Inference.Engine gitguardian.yml actions/checkout @v7
Enrichment.Inference.Engine gitguardian.yml GitGuardian/ggshield-action @v1
Enrichment.Inference.Engine gitleaks.yml actions/checkout @v7
Enrichment.Inference.Engine k8s-deploy.yml actions/checkout @v7
Enrichment.Inference.Engine k8s-deploy.yml azure/setup-helm @v5
Enrichment.Inference.Engine k8s-deploy.yml azure/k8s-set-context @v5
Enrichment.Inference.Engine perplexity-code-review.yml actions/checkout @v7
Enrichment.Inference.Engine perplexity-code-review.yml actions/setup-python @v7
Enrichment.Inference.Engine perplexity-code-review.yml actions/github-script @v9
Enrichment.Inference.Engine perplexity-code-review.yml actions/upload-artifact @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/checkout @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/setup-python @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/checkout @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/setup-python @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/checkout @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/checkout @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/setup-python @v7
Enrichment.Inference.Engine pr-pipeline.yml codecov/codecov-action @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/checkout @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/setup-python @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/dependency-review-action @v5
Enrichment.Inference.Engine pr-pipeline.yml actions/checkout @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/setup-python @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/checkout @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/setup-python @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/checkout @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/setup-python @v7
Enrichment.Inference.Engine pr-pipeline.yml actions/github-script @v9
Enrichment.Inference.Engine pr-review-enforcement.yml actions/checkout @v7
Enrichment.Inference.Engine pr-review-enforcement.yml actions/github-script @v9
Enrichment.Inference.Engine refactoring-validation.yml actions/checkout @v7
Enrichment.Inference.Engine refactoring-validation.yml actions/setup-python @v7
Enrichment.Inference.Engine release.yml actions/checkout @v7
Enrichment.Inference.Engine release.yml actions/setup-python @v7
Enrichment.Inference.Engine release.yml softprops/action-gh-release @v3
Enrichment.Inference.Engine sonarcloud.yml actions/checkout @v7
Enrichment.Inference.Engine sonarcloud.yml actions/setup-python @v7
Enrichment.Inference.Engine sonarcloud.yml SonarSource/sonarqube-scan-action @v8
Enrichment.Inference.Engine supply-chain.yml actions/checkout @v7
Enrichment.Inference.Engine supply-chain.yml actions/setup-python @v7
Enrichment.Inference.Engine supply-chain.yml actions/upload-artifact @v7
Enrichment.Inference.Engine supply-chain.yml actions/checkout @v7
Enrichment.Inference.Engine supply-chain.yml actions/dependency-review-action @v5
Enrichment.Inference.Engine supply-chain.yml actions/checkout @v7
Enrichment.Inference.Engine supply-chain.yml actions/setup-python @v7
Enrichment.Inference.Engine supply-chain.yml actions/upload-artifact @v7
l9-codegraph 2_sbom_ci_workflow.yml actions/checkout @v6
l9-codegraph 2_sbom_ci_workflow.yml actions/setup-python @v6
l9-codegraph 2_sbom_ci_workflow.yml actions/upload-artifact @v7
l9-codegraph 2_sbom_ci_workflow.yml actions/upload-release-asset @v1
l9-codegraph 8_secret_rotation_workflow.yml actions/github-script @v8
l9-codegraph P2_8_secret_rotation.yml actions/github-script @v8
l9-codegraph P3_3_slsa_build_l3.yml docker/login-action @v3
l9-codegraph P3_3_slsa_build_l3.yml docker/setup-buildx-action @v3
l9-codegraph P3_3_slsa_build_l3.yml docker/metadata-action @v5
l9-codegraph P3_3_slsa_build_l3.yml docker/build-push-action @v6
l9-codegraph P3_3_slsa_build_l3.yml actions/attest-build-provenance @v2
l9-codegraph P3_3_slsa_build_l3.yml anchore/sbom-action @v0
l9-codegraph P3_3_slsa_build_l3.yml actions/attest-sbom @v4
l9-codegraph P3_3_slsa_build_l3.yml actions/upload-artifact @v7
l9-codegraph P3_7_dependency_review.yml actions/checkout @v6
l9-codegraph P3_7_dependency_review.yml actions/dependency-review-action @v4
l9-codegraph ci-quality.yml actions/checkout @v6
l9-codegraph ci-quality.yml actions/setup-python @v6
l9-codegraph ci-quality.yml actions/checkout @v6
l9-codegraph ci-quality.yml returntocorp/semgrep-action @v1
l9-codegraph ci-quality.yml actions/checkout @v6
l9-codegraph ci-quality.yml actions/setup-python @v6
l9-codegraph ci-quality.yml SonarSource/sonarcloud-github-action @master
l9-codegraph ci-quality.yml actions/checkout @v6
l9-codegraph ci-quality.yml GitGuardian/ggshield-action @v1
l9-codegraph ci-quality.yml actions/checkout @v6
l9-codegraph ci-quality.yml actions/setup-python @v6
l9-codegraph ci-quality.yml codecov/codecov-action @v4
l9-codegraph ci-quality.yml actions/checkout @v6
l9-codegraph ci-quality.yml actions/cache @v5
l9-codegraph ci-quality.yml pre-commit/action @v3.0.1
l9-codegraph dependency-review.yml actions/checkout @v6
l9-codegraph dependency-review.yml actions/dependency-review-action @v4
l9-codegraph perplexity-audit.yml actions/setup-python @v6
l9-codegraph perplexity-audit.yml actions/upload-artifact @v7
l9-codegraph perplexity-audit.yml actions/github-script @v8
l9-codegraph perplexity-audit.yml actions/setup-python @v6
l9-codegraph perplexity-audit.yml actions/upload-artifact @v7
l9-codegraph perplexity-audit.yml actions/github-script @v8
l9-codegraph sbom.yml actions/checkout @v6
l9-codegraph sbom.yml actions/setup-python @v6
l9-codegraph sbom.yml actions/upload-artifact @v7
l9-codegraph sbom.yml actions/upload-release-asset @v1
l9-codegraph secret-rotation-reminder.yml actions/github-script @v8
l9-codegraph slsa-build.yml docker/login-action @v3
l9-codegraph slsa-build.yml docker/setup-buildx-action @v3
l9-codegraph slsa-build.yml docker/metadata-action @v5
l9-codegraph slsa-build.yml docker/build-push-action @v6
l9-codegraph slsa-build.yml actions/attest-build-provenance @v2
l9-codegraph slsa-build.yml anchore/sbom-action @v0
l9-codegraph slsa-build.yml actions/attest-sbom @v4
l9-codegraph slsa-build.yml actions/upload-artifact @v7
PR_Repair pr-checks.yml astral-sh/setup-uv @v5
PR_Repair pr-checks.yml actions/upload-artifact @v4
PR_Repair pr-checks.yml GitGuardian/ggshield-action @v1
PR_Repair pr-checks.yml actions/download-artifact @v4
PR_Repair pr-checks.yml SonarSource/sonarqube-scan-action @v4
PR_Repair pr-repair.yml actions/upload-artifact @v4
SEO-Bot autonomy-ops.yml actions/cache @v4
SEO-Bot autonomy-ops.yml actions/upload-artifact @v4
Website-Bot agent-pipeline.yml actions/cache @v6
Website-Bot agent-pipeline.yml actions/upload-artifact @v4
Website-Bot build-site.yml actions/upload-artifact @v7
Website-Bot deploy-to-vercel.yml actions/upload-artifact @v7
Website-Bot emit-handoff.yml actions/upload-artifact @v7
l9-node-template audit.yml actions/upload-artifact @v4
l9-node-template auto-merge-dependabot.yml dependabot/fetch-metadata @v2
l9-node-template ci.yml actions/checkout @v7
l9-node-template ci.yml actions/setup-python @v6
l9-node-template ci.yml astral-sh/setup-uv @v7
l9-node-template ci.yml codecov/codecov-action @v7
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/checkout @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/setup-python @v5
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/cache @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/upload-artifact @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/checkout @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/setup-python @v5
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/upload-artifact @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/checkout @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/setup-python @v5
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/checkout @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/checkout @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/setup-python @v5
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml codecov/codecov-action @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/checkout @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/setup-python @v5
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/checkout @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/setup-python @v5
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/upload-artifact @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/checkout @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/setup-python @v5
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/checkout @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/setup-python @v5
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/checkout @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/setup-python @v5
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/checkout @v4
L9-Ops-MCP 08-L11-CI-WORKFLOW-v3.3.yaml actions/setup-python @v5
l9-ci-debt-intelligence phase-6-publication.yml actions/checkout @v4
l9-ci-debt-intelligence phase-7-effectiveness.yml actions/checkout @v4
l9-ci-debt-intelligence publish-defense-pack.yml actions/checkout @v4
l9-ci-debt-intelligence publish-defense-pack.yml actions/download-artifact @v4
l9-ci-debt-resolver phase-0-foundation.yml actions/checkout @v4
l9-ci-debt-resolver phase-0-foundation.yml actions/setup-python @v5
l9-ci-debt-resolver phase-1-log-acquisition.yml actions/checkout @v4
l9-ci-debt-resolver phase-1-log-acquisition.yml actions/setup-python @v5
l9-ci-debt-resolver phase-2-repository-correlation.yml actions/checkout @v4
l9-ci-debt-resolver phase-2-repository-correlation.yml actions/setup-python @v5
l9-ci-debt-resolver phase-3-bounded-remediation.yml actions/checkout @v4
l9-ci-debt-resolver phase-3-bounded-remediation.yml actions/setup-python @v5
l9-ci-debt-resolver phase-4-remote-resolution.yml actions/checkout @v4
l9-ci-debt-resolver phase-4-remote-resolution.yml actions/setup-python @v5
l9-ci-debt-resolver phase-5-intelligence-feedback.yml actions/checkout @v4
l9-ci-debt-resolver phase-5-intelligence-feedback.yml actions/setup-python @v5
l9-ci-debt-resolver phase-6-pr-repair-delegation.yml actions/checkout @v4
l9-ci-debt-resolver phase-6-pr-repair-delegation.yml actions/setup-python @v5
l9-ci-debt-lsp phase-1-boundary.yml actions/checkout @v4
l9-ci-debt-lsp phase-1-boundary.yml actions/setup-python @v5
l9-ci-debt-lsp phase-1-boundary.yml actions/checkout @v4
l9-ci-debt-lsp phase-1-boundary.yml actions/setup-node @v4
l9-ci-debt-lsp phase-2-pack-protocol.yml actions/checkout @v7
l9-ci-debt-lsp phase-2-pack-protocol.yml actions/setup-python @v7
l9-ci-debt-lsp phase-3-incremental-analysis.yml actions/checkout @v4
l9-ci-debt-lsp phase-3-incremental-analysis.yml actions/setup-python @v5
l9-ci-debt-lsp phase-4-diagnostics.yml actions/checkout @v4
l9-ci-debt-lsp phase-4-diagnostics.yml actions/setup-python @v5
l9-ci-debt-lsp phase-5-code-actions.yml actions/checkout @v4
l9-ci-debt-lsp phase-5-code-actions.yml actions/setup-python @v5
l9-ci-debt-lsp phase-6-final-telemetry.yml actions/checkout @v4
l9-ci-debt-lsp phase-6-final-telemetry.yml actions/setup-python @v5

Generated by audit-pins-org.yml. Run ops/pin-actions-sha.sh to fix.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:ciCI/CD pipelines

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions