[Scan]: actions/checkout live smoke test

[devUmut35]

Public GitHub repository URL

https://github.com/actions/checkout

Public report

• I understand that the scan result will be posted publicly on this issue.

[github-actions]

WorkflowPromptGuard scan

Target: actions/checkout@f548e57e544e
Workflows scanned: 7

critical 0 · high 0 · medium 21 · low 0 · info 0

Deterministic findings

Severity	Rule	Location	Finding
MEDIUM	GA003	.github/workflows/check-dist.yml:25:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/check-dist.yml:28:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/check-dist.yml:47:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/codeql-analysis.yml:42:13	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/codeql-analysis.yml:45:13	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/codeql-analysis.yml:58:13	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/licensed.yml:12:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/publish-immutable-actions.yml:17:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/publish-immutable-actions.yml:20:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/test.yml:19:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/test.yml:22:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/test.yml:40:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/test.yml:232:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/test.yml:264:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/test.yml:294:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/test.yml:322:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/test.yml:331:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/update-main-version.yml:26:13	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/update-test-ubuntu-git.yml:29:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/update-test-ubuntu-git.yml:34:15	External action uses a mutable reference
MEDIUM	GA003	.github/workflows/update-test-ubuntu-git.yml:51:15	External action uses a mutable reference

AI-generated explanation

Generated by GitHub Models (openai/gpt-4.1-mini); advisory only.

The scan identified 21 medium severity issues related to the use of external actions with mutable references in the 'actions/checkout' repository. No critical, high, low, or informational issues were found. The main concern is that external actions are not pinned to a specific commit SHA, which can lead to unexpected changes and potential security risks.

Suggested priorities:

• Pin all external action dependencies to their full 40-character commit SHA to ensure immutability.
• Include version comments alongside pinned SHAs for better maintainability and clarity.
• Review and update the pinned SHAs regularly to incorporate necessary updates while maintaining security.

The findings and pass/fail interpretation above come from the deterministic scanner. The optional AI section is explanatory only.

[devUmut35]

First live run passed. Reopening once to verify the final no-cache workflow and idempotent comment update.

[devUmut35]

End-to-end v0.2.0 smoke test passed on the final workflow: cross-repository fetch, deterministic scan, GitHub Models explanation, and idempotent bot-comment update all succeeded.