unpinned action reference: action is not pinned to a hash (required by blanket policy)

unpinned action reference: action is not pinned to a hash (required by blanket policy)

unpinned action reference: action is not pinned to a hash (required by blanket policy)

unpinned action reference: action is not pinned to a hash (required by blanket policy)

code injection via template expansion: may expand into attacker-controllable code

code injection via template expansion: may expand into attacker-controllable code

code injection via template expansion: may expand into attacker-controllable code

code injection via template expansion: may expand into attacker-controllable code

code injection via template expansion: may expand into attacker-controllable code

Found 60 findings for mandatory checks that must always succeed.

macos-release.yml:153: unpinned action reference: action is not pinned to a hash (required by blanket policy)

macos-release.yml:148: unpinned action reference: action is not pinned to a hash (required by blanket policy)

macos-release.yml:41: unpinned action reference: action is not pinned to a hash (required by blanket policy)

macos-release.yml:36: unpinned action reference: action is not pinned to a hash (required by blanket policy)

macos-release.yml:31: unpinned action reference: action is not pinned to a hash (required by blanket policy)

macos-release.yml:27: unpinned action reference: action is not pinned to a hash (required by blanket policy)

macos-cmake.yml:39: unpinned action reference: action is not pinned to a hash (required by blanket policy)

macos-cmake.yml:35: unpinned action reference: action is not pinned to a hash (required by blanket policy)

macos-cmake.yml:31: unpinned action reference: action is not pinned to a hash (required by blanket policy)

macos-cmake.yml:28: unpinned action reference: action is not pinned to a hash (required by blanket policy)

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

test-runner.yml:128: action's hash pin has mismatched or missing version comment: points to commit 11d5960a3267

test-runner.yml:111: secrets unconditionally inherited by called workflow: this reusable workflow

test-runner.yml:97: secrets unconditionally inherited by called workflow: this reusable workflow

test-runner.yml:84: secrets unconditionally inherited by called workflow: this reusable workflow

test-runner.yml:75: secrets unconditionally inherited by called workflow: this reusable workflow

test-runner.yml:103: overly broad permissions: default permissions used due to no permissions: block

test-runner.yml:89: overly broad permissions: default permissions used due to no permissions: block

test-runner.yml:79: overly broad permissions: default permissions used due to no permissions: block

test-runner.yml:42: overly broad permissions: default permissions used due to no permissions: block

test-runner.yml:1: overly broad permissions: default permissions used due to no permissions: block

windows-release.yml:295: action functionality is already included by the runner: use `gh release` in a script step