{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T15:53:35.528177Z","repo":{"ref":{"host":"github.com","owner":"FuelLabs","name":"sway"},"default_branch":"master","clone_url":"https://github.com/FuelLabs/sway.git","html_url":"https://github.com/FuelLabs/sway","description":"🌴 Empowering everyone to build reliable and efficient smart contracts.","stars":61339,"forks":5431,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":120269,"primary_language":"Rust","license_spdx":"Apache-2.0","created_at":"2021-01-19T20:54:33Z","pushed_at":"2026-11-10T22:29:46Z","security_policy_url":"https://github.com/FuelLabs/sway/security/policy","distribution":{"owner_created_at":"2019-09-30T15:56:25Z","owner_type":"Organization","release_assets":[{"name":"forc-binaries-darwin_amd64.tar.gz","size":78364396,"download_count":200,"release_tag":"v0.72.1","url":"https://github.com/FuelLabs/sway/releases/download/v0.72.1/forc-binaries-darwin_amd64.tar.gz"},{"name":"forc-binaries-darwin_arm64.tar.gz","size":74199231,"download_count":285,"release_tag":"v0.72.1","url":"https://github.com/FuelLabs/sway/releases/download/v0.72.1/forc-binaries-darwin_arm64.tar.gz"},{"name":"forc-binaries-linux_amd64.tar.gz","size":78395148,"download_count":13614,"release_tag":"v0.72.1","url":"https://github.com/FuelLabs/sway/releases/download/v0.72.1/forc-binaries-linux_amd64.tar.gz"},{"name":"forc-binaries-linux_arm64.tar.gz","size":74480414,"download_count":888,"release_tag":"v0.72.1","url":"https://github.com/FuelLabs/sway/releases/download/v0.72.1/forc-binaries-linux_arm64.tar.gz"},{"name":"forc-binaries-darwin_amd64.tar.gz","size":78200982,"download_count":14,"release_tag":"v0.72.0","url":"https://github.com/FuelLabs/sway/releases/download/v0.72.0/forc-binaries-darwin_amd64.tar.gz"},{"name":"forc-binaries-darwin_arm64.tar.gz","size":74211923,"download_count":50,"release_tag":"v0.72.0","url":"https://github.com/FuelLabs/sway/releases/download/v0.72.0/forc-binaries-darwin_arm64.tar.gz"},{"name":"forc-binaries-linux_amd64.tar.gz","size":78374503,"download_count":5708,"release_tag":"v0.72.0","url":"https://github.com/FuelLabs/sway/releases/download/v0.72.0/forc-binaries-linux_amd64.tar.gz"},{"name":"forc-binaries-linux_arm64.tar.gz","size":74404149,"download_count":202,"release_tag":"v0.72.0","url":"https://github.com/FuelLabs/sway/releases/download/v0.72.0/forc-binaries-linux_arm64.tar.gz"},{"name":"forc-binaries-darwin_amd64.tar.gz","size":78509818,"download_count":17,"release_tag":"v0.71.2","url":"https://github.com/FuelLabs/sway/releases/download/v0.71.2/forc-binaries-darwin_amd64.tar.gz"},{"name":"forc-binaries-darwin_arm64.tar.gz","size":74447692,"download_count":14,"release_tag":"v0.71.2","url":"https://github.com/FuelLabs/sway/releases/download/v0.71.2/forc-binaries-darwin_arm64.tar.gz"},{"name":"forc-binaries-linux_amd64.tar.gz","size":78824149,"download_count":2942,"release_tag":"v0.71.2","url":"https://github.com/FuelLabs/sway/releases/download/v0.71.2/forc-binaries-linux_amd64.tar.gz"},{"name":"forc-binaries-linux_arm64.tar.gz","size":74933898,"download_count":98,"release_tag":"v0.71.2","url":"https://github.com/FuelLabs/sway/releases/download/v0.71.2/forc-binaries-linux_arm64.tar.gz"},{"name":"forc-binaries-darwin_amd64.tar.gz","size":81563087,"download_count":66,"release_tag":"v0.71.0","url":"https://github.com/FuelLabs/sway/releases/download/v0.71.0/forc-binaries-darwin_amd64.tar.gz"},{"name":"forc-binaries-darwin_arm64.tar.gz","size":79760457,"download_count":52,"release_tag":"v0.71.0","url":"https://github.com/FuelLabs/sway/releases/download/v0.71.0/forc-binaries-darwin_arm64.tar.gz"},{"name":"forc-binaries-linux_amd64.tar.gz","size":81490022,"download_count":4193,"release_tag":"v0.71.0","url":"https://github.com/FuelLabs/sway/releases/download/v0.71.0/forc-binaries-linux_amd64.tar.gz"},{"name":"forc-binaries-linux_arm64.tar.gz","size":77354243,"download_count":51,"release_tag":"v0.71.0","url":"https://github.com/FuelLabs/sway/releases/download/v0.71.0/forc-binaries-linux_arm64.tar.gz"},{"name":"forc-binaries-darwin_amd64.tar.gz","size":178730296,"download_count":24,"release_tag":"v0.70.3","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.3/forc-binaries-darwin_amd64.tar.gz"},{"name":"forc-binaries-darwin_arm64.tar.gz","size":172410360,"download_count":50,"release_tag":"v0.70.3","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.3/forc-binaries-darwin_arm64.tar.gz"},{"name":"forc-binaries-linux_amd64.tar.gz","size":180254300,"download_count":3429,"release_tag":"v0.70.3","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.3/forc-binaries-linux_amd64.tar.gz"},{"name":"forc-binaries-linux_arm64.tar.gz","size":169775227,"download_count":134,"release_tag":"v0.70.3","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.3/forc-binaries-linux_arm64.tar.gz"},{"name":"forc-binaries-darwin_amd64.tar.gz","size":182967605,"download_count":37,"release_tag":"v0.70.2","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.2/forc-binaries-darwin_amd64.tar.gz"},{"name":"forc-binaries-darwin_arm64.tar.gz","size":176378934,"download_count":379,"release_tag":"v0.70.2","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.2/forc-binaries-darwin_arm64.tar.gz"},{"name":"forc-binaries-linux_amd64.tar.gz","size":184494142,"download_count":27426,"release_tag":"v0.70.2","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.2/forc-binaries-linux_amd64.tar.gz"},{"name":"forc-binaries-linux_arm64.tar.gz","size":173252247,"download_count":2030,"release_tag":"v0.70.2","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.2/forc-binaries-linux_arm64.tar.gz"},{"name":"forc-binaries-darwin_amd64.tar.gz","size":182219886,"download_count":26,"release_tag":"v0.70.1","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.1/forc-binaries-darwin_amd64.tar.gz"},{"name":"forc-binaries-darwin_arm64.tar.gz","size":175844564,"download_count":103,"release_tag":"v0.70.1","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.1/forc-binaries-darwin_arm64.tar.gz"},{"name":"forc-binaries-linux_amd64.tar.gz","size":183868197,"download_count":10024,"release_tag":"v0.70.1","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.1/forc-binaries-linux_amd64.tar.gz"},{"name":"forc-binaries-linux_arm64.tar.gz","size":172769077,"download_count":398,"release_tag":"v0.70.1","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.1/forc-binaries-linux_arm64.tar.gz"},{"name":"forc-binaries-darwin_amd64.tar.gz","size":191347608,"download_count":13,"release_tag":"v0.70.0","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.0/forc-binaries-darwin_amd64.tar.gz"},{"name":"forc-binaries-darwin_arm64.tar.gz","size":184241681,"download_count":21,"release_tag":"v0.70.0","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.0/forc-binaries-darwin_arm64.tar.gz"},{"name":"forc-binaries-linux_amd64.tar.gz","size":195425774,"download_count":326,"release_tag":"v0.70.0","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.0/forc-binaries-linux_amd64.tar.gz"},{"name":"forc-binaries-linux_arm64.tar.gz","size":184804186,"download_count":17,"release_tag":"v0.70.0","url":"https://github.com/FuelLabs/sway/releases/download/v0.70.0/forc-binaries-linux_arm64.tar.gz"},{"name":"forc-binaries-darwin_amd64.tar.gz","size":185900987,"download_count":7,"release_tag":"v0.69.6","url":"https://github.com/FuelLabs/sway/releases/download/v0.69.6/forc-binaries-darwin_amd64.tar.gz"},{"name":"forc-binaries-darwin_arm64.tar.gz","size":178890057,"download_count":7,"release_tag":"v0.69.6","url":"https://github.com/FuelLabs/sway/releases/download/v0.69.6/forc-binaries-darwin_arm64.tar.gz"},{"name":"forc-binaries-linux_amd64.tar.gz","size":180185632,"download_count":70,"release_tag":"v0.69.6","url":"https://github.com/FuelLabs/sway/releases/download/v0.69.6/forc-binaries-linux_amd64.tar.gz"},{"name":"forc-binaries-linux_arm64.tar.gz","size":175957716,"download_count":17,"release_tag":"v0.69.6","url":"https://github.com/FuelLabs/sway/releases/download/v0.69.6/forc-binaries-linux_arm64.tar.gz"}]}},"commit_sha":"7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71","profile":{"lines_by_language":{"Rust":239323,"Shell":3583,"JavaScript":311},"files_by_category":{"other":3466,"config":3441,"source":706,"docs":320,"test":75,"binary":15,"generated":5,"vendored":5},"source_lines":217599,"test_lines":25618},"pillars":{"ai_provenance":{"score":0.1,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.001,"suspected_share":0.0626,"estimated_share":0.001,"ai_artifacts":0.0,"flagged_work_units":13.0,"flagged_releases":0.0,"style_index":0.122},"summary":"Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals."},"quality":{"score":66.2,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":32.6,"duplication":54.7,"lint":99.0,"testing":80.9,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.12, CI runs tests; 37% of function code in complex or long functions; 10% duplicated lines. Weakest area: complexity."},"security":{"score":43.3,"confidence":0.7,"coverage":0.86,"label":"poor","breakdown":{"secrets":null,"sast":99.1,"dependencies":11.6,"ci_actions":0.0,"posture":60.0,"scorecard":null},"summary":"Security posture is poor: 56 known vulnerabilities in 37 dependencies; 1 high-severity SAST findings; 137 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":150.0,"checked":150.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":3667.0,"attributed_commits":3.0,"attributed_commit_share":0.0008181074447777475,"effective_loc":577338.0,"attributed_loc":576.0,"attributed_loc_share":0.0009976824667698992,"tools_detected":3.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 1 attributed commits, 68 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Claude Code: 1 attributed commits, 51 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Cursor agent: 1 attributed commits, 457 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Cursor agent: trailer 'Co-authored-by: Cursor'","ref":"102ab6cb0378c4e89b2c0679158ffbec41a0b26e","url":"https://github.com/FuelLabs/sway/commit/102ab6cb0378c4e89b2c0679158ffbec41a0b26e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"08dad8c58d6db928bd5eafa2862dfed59706b2b0","url":"https://github.com/FuelLabs/sway/commit/08dad8c58d6db928bd5eafa2862dfed59706b2b0","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"6bdfa0c10f582e0a8822464c0db5971acc0ccf07","url":"https://github.com/FuelLabs/sway/commit/6bdfa0c10f582e0a8822464c0db5971acc0ccf07","weight":0.9}],"data":{"attributed_loc_by_commit":{"6bdfa0c10f582e0a8822464c0db5971acc0ccf07":68,"08dad8c58d6db928bd5eafa2862dfed59706b2b0":51,"102ab6cb0378c4e89b2c0679158ffbec41a0b26e":457},"tools":{"github-copilot":{"name":"GitHub Copilot coding agent","commits":1,"loc":68,"first_seen":1755146930,"last_seen":1755146930},"claude-code":{"name":"Claude Code","commits":1,"loc":51,"first_seen":1787347270,"last_seen":1787347270},"cursor":{"name":"Cursor agent","commits":1,"loc":457,"first_seen":1791459354,"last_seen":1791459354}},"monthly":{"2021-01":{"loc":3,"attributed_loc":0},"2021-05":{"loc":19525,"attributed_loc":0},"2021-06":{"loc":3225,"attributed_loc":0},"2021-07":{"loc":4173,"attributed_loc":0},"2021-08":{"loc":3102,"attributed_loc":0},"2021-09":{"loc":5804,"attributed_loc":0},"2021-10":{"loc":6514,"attributed_loc":0},"2021-11":{"loc":7370,"attributed_loc":0},"2021-12":{"loc":5658,"attributed_loc":0},"2022-01":{"loc":13713,"attributed_loc":0},"2022-02":{"loc":6125,"attributed_loc":0},"2022-03":{"loc":19580,"attributed_loc":0},"2022-04":{"loc":13800,"attributed_loc":0},"2022-05":{"loc":18347,"attributed_loc":0},"2022-06":{"loc":17255,"attributed_loc":0},"2022-07":{"loc":17070,"attributed_loc":0},"2022-08":{"loc":17598,"attributed_loc":0},"2022-09":{"loc":9722,"attributed_loc":0},"2022-10":{"loc":28073,"attributed_loc":0},"2022-11":{"loc":14477,"attributed_loc":0},"2022-12":{"loc":12649,"attributed_loc":0},"2023-01":{"loc":19839,"attributed_loc":0},"2023-02":{"loc":22412,"attributed_loc":0},"2023-03":{"loc":17638,"attributed_loc":0},"2023-04":{"loc":16629,"attributed_loc":0},"2023-05":{"loc":5743,"attributed_loc":0},"2023-06":{"loc":4931,"attributed_loc":0},"2023-07":{"loc":10751,"attributed_loc":0},"2023-08":{"loc":11087,"attributed_loc":0},"2023-09":{"loc":7289,"attributed_loc":0},"2023-10":{"loc":11847,"attributed_loc":0},"2023-11":{"loc":5348,"attributed_loc":0},"2023-12":{"loc":5223,"attributed_loc":0},"2024-01":{"loc":10216,"attributed_loc":0},"2024-02":{"loc":8969,"attributed_loc":0},"2024-03":{"loc":7829,"attributed_loc":0},"2024-04":{"loc":6824,"attributed_loc":0},"2024-05":{"loc":9033,"attributed_loc":0},"2024-06":{"loc":6162,"attributed_loc":0},"2024-07":{"loc":5200,"attributed_loc":0},"2024-08":{"loc":14132,"attributed_loc":0},"2024-09":{"loc":4533,"attributed_loc":0},"2024-10":{"loc":5976,"attributed_loc":0},"2024-11":{"loc":5888,"attributed_loc":0},"2024-12":{"loc":2843,"attributed_loc":0},"2025-01":{"loc":8552,"attributed_loc":0},"2025-02":{"loc":11746,"attributed_loc":0},"2025-03":{"loc":10541,"attributed_loc":0},"2025-04":{"loc":9855,"attributed_loc":0},"2025-05":{"loc":8461,"attributed_loc":0},"2025-06":{"loc":7611,"attributed_loc":0},"2025-07":{"loc":9538,"attributed_loc":0},"2025-08":{"loc":3266,"attributed_loc":68},"2025-09":{"loc":3966,"attributed_loc":0},"2025-10":{"loc":6588,"attributed_loc":0},"2025-11":{"loc":3864,"attributed_loc":0},"2025-12":{"loc":952,"attributed_loc":0},"2026-01":{"loc":1737,"attributed_loc":0},"2026-02":{"loc":1003,"attributed_loc":0},"2026-03":{"loc":1900,"attributed_loc":0},"2026-04":{"loc":3990,"attributed_loc":0},"2026-05":{"loc":2659,"attributed_loc":0},"2026-06":{"loc":3240,"attributed_loc":0},"2026-07":{"loc":2585,"attributed_loc":0},"2026-08":{"loc":3543,"attributed_loc":51},"2026-09":{"loc":666,"attributed_loc":0},"2026-10":{"loc":950,"attributed_loc":457}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"work_units":2488.0,"flagged_units":13.0,"pre_ai_era_bursts":1.0,"pre_ai_era_measured_loc":9373.0,"pre_ai_era_burst_loc":2450.0,"measured_loc":541958.0,"flagged_loc":36131.0,"flagged_loc_share":0.06666752774200214,"max_loc_per_hour":1748.0,"median_loc_per_hour":18.23356789632032,"pr_timed_units":1393.0,"excluded_import_loc":34892.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"4,175 lines of first-party code in ~4.0h (1,044 lines/hour, 1 commit session)","ref":"830b6111d7b54573822a003fc14d806489d374e6","url":"https://github.com/FuelLabs/sway/commit/830b6111d7b54573822a003fc14d806489d374e6","weight":0.313125},{"kind":"velocity-burst","description":"4,134 lines of first-party code in ~4.0h (1,034 lines/hour, 1 commit session)","ref":"c1ef577b555a5c8d4801f34c6c19395f68406baa","url":"https://github.com/FuelLabs/sway/commit/c1ef577b555a5c8d4801f34c6c19395f68406baa","weight":0.31005},{"kind":"velocity-burst","description":"2,175 lines of first-party code in ~2.7h (817 lines/hour, PR #6437)","ref":"2f53e22f571b730f0fe792885eb52cb9064d3ef9","url":"https://github.com/FuelLabs/sway/commit/2f53e22f571b730f0fe792885eb52cb9064d3ef9","weight":0.24512156944589375},{"kind":"velocity-burst","description":"3,215 lines of first-party code in ~4.0h (804 lines/hour, 1 commit session)","ref":"7b1f8590b3d912255bfc6ad7eb064a5d6118d67d","url":"https://github.com/FuelLabs/sway/commit/7b1f8590b3d912255bfc6ad7eb064a5d6118d67d","weight":0.24112499999999998},{"kind":"velocity-burst","description":"3,051 lines of first-party code in ~4.0h (763 lines/hour, 1 commit session)","ref":"3a063c649b912638dedf49a0eed540ee31a00486","url":"https://github.com/FuelLabs/sway/commit/3a063c649b912638dedf49a0eed540ee31a00486","weight":0.228825},{"kind":"velocity-burst","description":"2,140 lines of first-party code in ~2.9h (747 lines/hour, 2 commit session)","ref":"34e8e31d74acfb188138661a7e37488f9352e2ac","url":"https://github.com/FuelLabs/sway/commit/34e8e31d74acfb188138661a7e37488f9352e2ac","weight":0.22406204556471163},{"kind":"velocity-burst","description":"2,976 lines of first-party code in ~4.0h (744 lines/hour, 1 commit session)","ref":"dff4d64e7a4f9972ef3622ddc808b772a2fef69e","url":"https://github.com/FuelLabs/sway/commit/dff4d64e7a4f9972ef3622ddc808b772a2fef69e","weight":0.22319999999999998},{"kind":"velocity-burst","description":"2,907 lines of first-party code in ~4.0h (727 lines/hour, 1 commit session)","ref":"1ea6e8b8c11c17c1f7dbbb66e1aa8fd4c5e2a518","url":"https://github.com/FuelLabs/sway/commit/1ea6e8b8c11c17c1f7dbbb66e1aa8fd4c5e2a518","weight":0.218025},{"kind":"velocity-burst","description":"1,597 lines of first-party code in ~2.3h (697 lines/hour, PR #3757)","ref":"b44d8ba1a1fded9b2432da4b72eb40dbf2a6ccb5","url":"https://github.com/FuelLabs/sway/commit/b44d8ba1a1fded9b2432da4b72eb40dbf2a6ccb5","weight":0.20908716208025216},{"kind":"velocity-burst","description":"2,594 lines of first-party code in ~4.0h (648 lines/hour, 1 commit session)","ref":"11e363ae278214a60da0d566993734c87cdbb6a8","url":"https://github.com/FuelLabs/sway/commit/11e363ae278214a60da0d566993734c87cdbb6a8","weight":0.19454999999999997},{"kind":"velocity-burst","description":"2,582 lines of first-party code in ~4.0h (646 lines/hour, 1 commit session)","ref":"0a4ac5da5ef926a4fe2a9c92ff2b6a3f87d8cb75","url":"https://github.com/FuelLabs/sway/commit/0a4ac5da5ef926a4fe2a9c92ff2b6a3f87d8cb75","weight":0.19365},{"kind":"velocity-burst","description":"2,352 lines of first-party code in ~4.0h (588 lines/hour, 1 commit session)","ref":"ff6f914e28483028404db5122baa98951a9b3e45","url":"https://github.com/FuelLabs/sway/commit/ff6f914e28483028404db5122baa98951a9b3e45","weight":0.17639999999999997},{"kind":"velocity-burst","description":"2,233 lines of first-party code in ~4.0h (558 lines/hour, 1 commit session)","ref":"09d67871a9801f11e3abb0fa3f1f5849dedaeaba","url":"https://github.com/FuelLabs/sway/commit/09d67871a9801f11e3abb0fa3f1f5849dedaeaba","weight":0.167475}],"data":{"flagged_loc_by_commit":{"09b35d1f00245e99a2d334074705db829d9c3bc3":2042,"34e8e31d74acfb188138661a7e37488f9352e2ac":98,"11e363ae278214a60da0d566993734c87cdbb6a8":2594,"830b6111d7b54573822a003fc14d806489d374e6":4175,"7b1f8590b3d912255bfc6ad7eb064a5d6118d67d":3215,"3a063c649b912638dedf49a0eed540ee31a00486":3051,"c1ef577b555a5c8d4801f34c6c19395f68406baa":4134,"dff4d64e7a4f9972ef3622ddc808b772a2fef69e":2976,"b44d8ba1a1fded9b2432da4b72eb40dbf2a6ccb5":1597,"0a4ac5da5ef926a4fe2a9c92ff2b6a3f87d8cb75":2582,"ff6f914e28483028404db5122baa98951a9b3e45":2352,"1ea6e8b8c11c17c1f7dbbb66e1aa8fd4c5e2a518":2907,"09d67871a9801f11e3abb0fa3f1f5849dedaeaba":2233,"2f53e22f571b730f0fe792885eb52cb9064d3ef9":2175},"excluded_import_commits":["18ac20536b0383de8b595c75bd8cf6a556b50d5c","6b8a46b8c0e44db4ffe44d84b75d750d4375cca0","978de4dd803dc6ef30ba9543354cef50d35e5fa9","f5f8566e8c6e5b19f5d2d58b983150304c81771d","fe6b76e2c4206857a86cd7a4cc0196d52fd46896"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"releases":99.0,"flagged_releases":0.0,"max_loc_per_day":14067.9},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.34.0","to":"v0.35.0","loc":7353,"days":6.78,"loc_per_day":1084.9,"flagged":false},{"from":"v0.35.0","to":"v0.35.1","loc":6912,"days":7.47,"loc_per_day":925.2,"flagged":false},{"from":"v0.35.1","to":"v0.35.2","loc":1701,"days":2.05,"loc_per_day":829.8,"flagged":false},{"from":"v0.35.2","to":"v0.35.3","loc":753,"days":3.94,"loc_per_day":191.1,"flagged":false},{"from":"v0.35.3","to":"v0.35.4","loc":11136,"days":13.71,"loc_per_day":812.5,"flagged":false},{"from":"v0.35.4","to":"v0.35.5","loc":131,"days":1.15,"loc_per_day":114.1,"flagged":false},{"from":"v0.35.5","to":"v0.36.0","loc":19676,"days":27.34,"loc_per_day":719.6,"flagged":false},{"from":"v0.36.0","to":"v0.36.1","loc":557,"days":0.49,"loc_per_day":1148.4,"flagged":false},{"from":"v0.36.1","to":"v0.37.0","loc":158,"days":0.42,"loc_per_day":380.6,"flagged":false},{"from":"v0.37.0","to":"v0.37.1","loc":3564,"days":7.68,"loc_per_day":463.8,"flagged":false},{"from":"v0.37.1","to":"v0.37.2","loc":3854,"days":11.16,"loc_per_day":345.3,"flagged":false},{"from":"v0.37.2","to":"v0.38.0","loc":0,"days":0.32,"loc_per_day":0.0,"flagged":false},{"from":"v0.38.0","to":"v0.39.0","loc":2644,"days":22.41,"loc_per_day":118.0,"flagged":false},{"from":"v0.39.0","to":"v0.39.1","loc":1141,"days":6.98,"loc_per_day":163.4,"flagged":false},{"from":"v0.39.1","to":"v0.40.0","loc":1872,"days":6.87,"loc_per_day":272.3,"flagged":false},{"from":"v0.40.0","to":"v0.40.1","loc":844,"days":0.22,"loc_per_day":3896.2,"flagged":false},{"from":"v0.40.1","to":"v0.41.0","loc":4930,"days":29.5,"loc_per_day":167.1,"flagged":false},{"from":"v0.41.0","to":"v0.42.0","loc":677,"days":6.33,"loc_per_day":106.9,"flagged":false},{"from":"v0.42.0","to":"v0.42.1","loc":1110,"days":0.98,"loc_per_day":1133.7,"flagged":false},{"from":"v0.42.1","to":"v0.43.0","loc":6514,"days":26.42,"loc_per_day":246.6,"flagged":false},{"from":"v0.43.0","to":"v0.43.1","loc":422,"days":0.6,"loc_per_day":707.2,"flagged":false},{"from":"v0.43.1","to":"v0.43.2","loc":0,"days":0.21,"loc_per_day":0.0,"flagged":false},{"from":"v0.43.2","to":"v0.44.0","loc":3009,"days":10.88,"loc_per_day":276.5,"flagged":false},{"from":"v0.44.0","to":"v0.44.1","loc":662,"days":2.24,"loc_per_day":295.2,"flagged":false},{"from":"v0.44.1","to":"v0.45.0","loc":3445,"days":8.58,"loc_per_day":401.7,"flagged":false},{"from":"v0.45.0","to":"v0.46.0","loc":3156,"days":20.35,"loc_per_day":155.1,"flagged":false},{"from":"v0.46.0","to":"v0.46.1","loc":4573,"days":14.13,"loc_per_day":323.6,"flagged":false},{"from":"v0.46.1","to":"v0.47.0","loc":12419,"days":38.43,"loc_per_day":323.1,"flagged":false},{"from":"v0.47.0","to":"v0.48.0","loc":7123,"days":29.99,"loc_per_day":237.5,"flagged":false},{"from":"v0.48.0","to":"v0.48.1","loc":0,"days":0.16,"loc_per_day":0.0,"flagged":false},{"from":"v0.48.1","to":"v0.49.0","loc":7425,"days":42.63,"loc_per_day":174.2,"flagged":false},{"from":"v0.49.0","to":"v0.49.1","loc":95,"days":1.7,"loc_per_day":55.9,"flagged":false},{"from":"v0.49.1","to":"v0.50.0","loc":6627,"days":18.83,"loc_per_day":352.0,"flagged":false},{"from":"v0.50.0","to":"v0.51.0","loc":6638,"days":15.2,"loc_per_day":436.6,"flagged":false},{"from":"v0.51.0","to":"v0.51.1","loc":0,"days":0.45,"loc_per_day":0.0,"flagged":false},{"from":"v0.51.1","to":"v0.52.0","loc":8975,"days":33.14,"loc_per_day":270.8,"flagged":false},{"from":"v0.52.0","to":"v0.52.1","loc":741,"days":6.98,"loc_per_day":106.1,"flagged":false},{"from":"v0.52.1","to":"v0.53.0","loc":1955,"days":8.1,"loc_per_day":241.5,"flagged":false},{"from":"v0.53.0","to":"v0.54.0","loc":229,"days":1.53,"loc_per_day":149.4,"flagged":false},{"from":"v0.54.0","to":"v0.55.0","loc":916,"days":5.32,"loc_per_day":172.1,"flagged":false},{"from":"v0.55.0","to":"v0.56.0","loc":1354,"days":7.75,"loc_per_day":174.7,"flagged":false},{"from":"v0.56.0","to":"v0.56.1","loc":4171,"days":12.86,"loc_per_day":324.3,"flagged":false},{"from":"v0.56.1","to":"v0.57.0","loc":2594,"days":4.69,"loc_per_day":552.9,"flagged":false},{"from":"v0.57.0","to":"v0.58.0","loc":146,"days":0.36,"loc_per_day":402.2,"flagged":false},{"from":"v0.58.0","to":"v0.59.0","loc":1221,"days":3.49,"loc_per_day":349.9,"flagged":false},{"from":"v0.59.0","to":"v0.60.0","loc":381,"days":5.25,"loc_per_day":72.5,"flagged":false},{"from":"v0.60.0","to":"v0.61.0","loc":6821,"days":27.75,"loc_per_day":245.8,"flagged":false},{"from":"v0.61.0","to":"v0.61.1","loc":1705,"days":13.39,"loc_per_day":127.3,"flagged":false},{"from":"v0.61.1","to":"v0.61.2","loc":534,"days":1.06,"loc_per_day":505.7,"flagged":false},{"from":"v0.61.2","to":"v0.62.0","loc":3156,"days":14.03,"loc_per_day":224.9,"flagged":false},{"from":"v0.62.0","to":"v0.63.0","loc":8936,"days":32.73,"loc_per_day":273.1,"flagged":false},{"from":"v0.63.0","to":"v0.63.1","loc":2316,"days":0.16,"loc_per_day":14067.9,"flagged":false},{"from":"v0.63.1","to":"v0.63.2","loc":3903,"days":9.02,"loc_per_day":432.6,"flagged":false},{"from":"v0.63.2","to":"v0.63.3","loc":171,"days":0.41,"loc_per_day":416.1,"flagged":false},{"from":"v0.63.3","to":"v0.63.4","loc":303,"days":7.48,"loc_per_day":40.5,"flagged":false},{"from":"v0.63.4","to":"v0.63.5","loc":96,"days":1.0,"loc_per_day":96.0,"flagged":false},{"from":"v0.63.5","to":"v0.63.6","loc":1489,"days":12.05,"loc_per_day":123.6,"flagged":false},{"from":"v0.63.6","to":"v0.64.0","loc":2679,"days":7.11,"loc_per_day":377.0,"flagged":false},{"from":"v0.64.0","to":"v0.65.0","loc":806,"days":10.35,"loc_per_day":77.8,"flagged":false},{"from":"v0.65.0","to":"v0.65.1","loc":345,"days":0.39,"loc_per_day":877.2,"flagged":false},{"from":"v0.65.1","to":"v0.65.2","loc":5,"days":0.85,"loc_per_day":5.9,"flagged":false},{"from":"v0.65.2","to":"v0.66.0","loc":133,"days":7.89,"loc_per_day":16.9,"flagged":false},{"from":"v0.66.0","to":"v0.66.1","loc":2,"days":0.08,"loc_per_day":26.3,"flagged":false},{"from":"v0.66.1","to":"v0.66.2","loc":24,"days":1.02,"loc_per_day":23.6,"flagged":false},{"from":"v0.66.2","to":"v0.66.3","loc":4489,"days":14.0,"loc_per_day":320.7,"flagged":false},{"from":"v0.66.3","to":"v0.66.4","loc":521,"days":4.17,"loc_per_day":124.9,"flagged":false},{"from":"v0.66.4","to":"v0.66.5","loc":4802,"days":17.25,"loc_per_day":278.3,"flagged":false},{"from":"v0.66.5","to":"v0.66.6","loc":12084,"days":63.51,"loc_per_day":190.3,"flagged":false},{"from":"v0.66.6","to":"v0.66.7","loc":935,"days":13.28,"loc_per_day":70.4,"flagged":false},{"from":"v0.66.7","to":"v0.66.8","loc":11422,"days":27.37,"loc_per_day":417.2,"flagged":false},{"from":"v0.66.8","to":"v0.66.9","loc":3382,"days":6.61,"loc_per_day":512.0,"flagged":false},{"from":"v0.66.9","to":"v0.66.10","loc":0,"days":0.06,"loc_per_day":0.0,"flagged":false},{"from":"v0.66.10","to":"v0.67.0","loc":651,"days":1.88,"loc_per_day":346.4,"flagged":false},{"from":"v0.67.0","to":"v0.67.1","loc":13589,"days":40.15,"loc_per_day":338.5,"flagged":false},{"from":"v0.67.1","to":"v0.67.2","loc":0,"days":0.26,"loc_per_day":0.0,"flagged":false},{"from":"v0.67.2","to":"v0.68.0","loc":0,"days":0.67,"loc_per_day":0.0,"flagged":false},{"from":"v0.68.0","to":"v0.68.1","loc":234,"days":0.47,"loc_per_day":496.9,"flagged":false},{"from":"v0.68.1","to":"v0.68.2","loc":2203,"days":7.59,"loc_per_day":290.2,"flagged":false},{"from":"v0.68.2","to":"v0.68.3","loc":1814,"days":11.4,"loc_per_day":159.2,"flagged":false},{"from":"v0.68.3","to":"v0.68.4","loc":0,"days":0.84,"loc_per_day":0.0,"flagged":false},{"from":"v0.68.4","to":"v0.68.5","loc":1778,"days":6.64,"loc_per_day":267.9,"flagged":false},{"from":"v0.68.5","to":"v0.68.6","loc":2839,"days":7.77,"loc_per_day":365.4,"flagged":false},{"from":"v0.68.6","to":"v0.68.7","loc":2786,"days":7.08,"loc_per_day":393.4,"flagged":false},{"from":"v0.68.7","to":"v0.68.8","loc":3705,"days":14.56,"loc_per_day":254.5,"flagged":false},{"from":"v0.68.8","to":"v0.68.9","loc":214,"days":4.19,"loc_per_day":51.1,"flagged":false},{"from":"v0.68.9","to":"v0.69.0","loc":250,"days":0.39,"loc_per_day":648.0,"flagged":false},{"from":"v0.69.0","to":"v0.69.1","loc":4383,"days":24.14,"loc_per_day":181.6,"flagged":false},{"from":"v0.69.1","to":"v0.69.2","loc":14787,"days":67.21,"loc_per_day":220.0,"flagged":false},{"from":"v0.69.2","to":"v0.69.3","loc":37,"days":0.5,"loc_per_day":74.0,"flagged":false},{"from":"v0.69.3","to":"v0.69.4","loc":42,"days":1.18,"loc_per_day":35.6,"flagged":false},{"from":"v0.69.4","to":"v0.69.5","loc":41,"days":4.94,"loc_per_day":8.3,"flagged":false},{"from":"v0.69.5","to":"v0.69.6","loc":0,"days":0.19,"loc_per_day":0.0,"flagged":false},{"from":"v0.69.6","to":"v0.70.0","loc":725,"days":4.39,"loc_per_day":165.3,"flagged":false},{"from":"v0.70.0","to":"v0.70.1","loc":2719,"days":6.13,"loc_per_day":443.5,"flagged":false},{"from":"v0.70.1","to":"v0.71.0","loc":14330,"days":186.17,"loc_per_day":77.0,"flagged":false},{"from":"v0.71.0","to":"v0.71.1","loc":4838,"days":41.12,"loc_per_day":117.6,"flagged":false},{"from":"v0.71.1","to":"v0.71.2","loc":154,"days":0.44,"loc_per_day":346.9,"flagged":false},{"from":"v0.71.2","to":"v0.72.0","loc":5889,"days":62.57,"loc_per_day":94.1,"flagged":false},{"from":"v0.72.0","to":"v0.72.1","loc":3543,"days":32.08,"loc_per_day":110.4,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":217599.0,"index":0.122,"count:narrated_steps":26.0,"per_kloc:narrated_steps":0.119,"files:narrated_steps":11.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":1.0,"per_kloc:emoji_in_code":0.005,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, attempt to load the lock.","ref":"forc-pkg/src/pkg.rs:683","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-pkg/src/pkg.rs#L683","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Next, construct the package graph from the lock.","ref":"forc-pkg/src/pkg.rs:693","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-pkg/src/pkg.rs#L693","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, compile to an AST. We'll update the namespace and check for JSON ABI output.","ref":"forc-pkg/src/pkg.rs:1725","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-pkg/src/pkg.rs#L1725","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Finally, format the root manifest using taplo formatter","ref":"forc-plugins/forc-fmt/src/main.rs:227","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-plugins/forc-fmt/src/main.rs#L227","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, let's check the arguments.","ref":"forc-plugins/forc-migrate/src/migrations/error_type.rs:70","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-plugins/forc-migrate/src/migrations/error_type.rs#L70","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Then, the function name.","ref":"forc-plugins/forc-migrate/src/migrations/error_type.rs:93","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-plugins/forc-migrate/src/migrations/error_type.rs#L93","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1: Liveness Analysis.","ref":"sway-core/src/asm_generation/fuel/register_allocator.rs:584","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/sway-core/src/asm_generation/fuel/register_allocator.rs#L584","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 2: Construct the interference graph.","ref":"sway-core/src/asm_generation/fuel/register_allocator.rs:587","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/sway-core/src/asm_generation/fuel/register_allocator.rs#L587","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"failed","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"gitleaks exited -9: "},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":16.0,"findings_high":1.0,"findings_medium":0.0,"findings_low":15.0,"weighted_findings":5.55,"scanned_lines":217599.0,"parse_errors":7.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"deployment/Dockerfile","line":38,"fingerprint":"dockerfile.security.missing-user:deployment/Dockerfile:38"},{"rule_id":"opengrep/rust.lang.security.args","severity":"low","message":"args should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":".github/workflows/scripts/check-dep-versions/src/main.rs","line":27,"fingerprint":"rust.lang.security.args:.github/workflows/scripts/check-dep-versions/src/main.rs:27"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"forc-pkg/src/source/ipfs.rs","line":447,"fingerprint":"rust.lang.security.unsafe-usage:forc-pkg/src/source/ipfs.rs:447"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"forc-pkg/src/source/ipfs.rs","line":450,"fingerprint":"rust.lang.security.unsafe-usage:forc-pkg/src/source/ipfs.rs:450"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"forc-pkg/src/source/ipfs.rs","line":452,"fingerprint":"rust.lang.security.unsafe-usage:forc-pkg/src/source/ipfs.rs:452"},{"rule_id":"opengrep/rust.lang.security.args","severity":"low","message":"args should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":"forc-plugins/forc-tx/src/lib.rs","line":556,"fingerprint":"rust.lang.security.args:forc-plugins/forc-tx/src/lib.rs:556"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"forc-test/src/ecal.rs","line":25,"fingerprint":"rust.lang.security.unsafe-usage:forc-test/src/ecal.rs:25"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"forc-test/src/ecal.rs","line":32,"fingerprint":"rust.lang.security.unsafe-usage:forc-test/src/ecal.rs:32"},{"rule_id":"opengrep/rust.lang.security.current-exe","severity":"low","message":"current_exe should not be used for security operations. From the docs: \"The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change the output arbitrarily.\" [confidence high]","path":"forc/src/cli/plugin.rs","line":27,"fingerprint":"rust.lang.security.current-exe:forc/src/cli/plugin.rs:27"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs","line":5412,"fingerprint":"rust.lang.security.unsafe-usage:sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs:5412"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs","line":5413,"fingerprint":"rust.lang.security.unsafe-usage:sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs:5413"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs","line":5421,"fingerprint":"rust.lang.security.unsafe-usage:sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs:5421"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs","line":5422,"fingerprint":"rust.lang.security.unsafe-usage:sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs:5422"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs","line":5430,"fingerprint":"rust.lang.security.unsafe-usage:sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs:5430"},{"rule_id":"opengrep/rust.lang.security.args","severity":"low","message":"args should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":"sway-ir/src/bin/opt.rs","line":22,"fingerprint":"rust.lang.security.args:sway-ir/src/bin/opt.rs:22"},{"rule_id":"opengrep/rust.lang.security.args","severity":"low","message":"args should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":"sway-ir/src/optimize.rs","line":120,"fingerprint":"rust.lang.security.args:sway-ir/src/optimize.rs:120"}],"evidence":[],"data":{"rulesets":["rust","bash","javascript","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":37.0,"vulnerabilities":56.0,"vulns_critical":0.0,"vulns_high":6.0,"vulns_medium":4.0,"vulns_low":8.0,"vulns_unknown":38.0,"penalty":129.0},"findings":[{"rule_id":"osv/RUSTSEC-2026-0194","severity":"high","message":"quick-xml@0.39.4 (crates.io) is affected by RUSTSEC-2026-0194","path":"Cargo.lock","line":null,"fingerprint":"quick-xml@0.39.4 (crates.io):RUSTSEC-2026-0194"},{"rule_id":"osv/RUSTSEC-2026-0195","severity":"high","message":"quick-xml@0.39.4 (crates.io) is affected by RUSTSEC-2026-0195","path":"Cargo.lock","line":null,"fingerprint":"quick-xml@0.39.4 (crates.io):RUSTSEC-2026-0195"},{"rule_id":"osv/GHSA-4w2j-m93h-cj5j","severity":"high","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0185, GHSA-4w2j-m93h-cj5j","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):GHSA-4w2j-m93h-cj5j"},{"rule_id":"osv/RUSTSEC-2026-0340","severity":"high","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0340","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0340"},{"rule_id":"osv/GHSA-82j2-j2ch-gfr8","severity":"high","message":"rustls-webpki@0.101.7 (crates.io) is affected by RUSTSEC-2026-0104, GHSA-82j2-j2ch-gfr8","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.101.7 (crates.io):GHSA-82j2-j2ch-gfr8"},{"rule_id":"osv/RUSTSEC-2026-0344","severity":"high","message":"ruzstd@0.7.3 (crates.io) is affected by RUSTSEC-2026-0344","path":"Cargo.lock","line":null,"fingerprint":"ruzstd@0.7.3 (crates.io):RUSTSEC-2026-0344"},{"rule_id":"osv/RUSTSEC-2026-0190","severity":"medium","message":"anyhow@1.0.102 (crates.io) is affected by RUSTSEC-2026-0190","path":"Cargo.lock","line":null,"fingerprint":"anyhow@1.0.102 (crates.io):RUSTSEC-2026-0190"},{"rule_id":"osv/RUSTSEC-2023-0089","severity":"medium","message":"atomic-polyfill@1.0.3 (crates.io) is affected by RUSTSEC-2023-0089","path":"Cargo.lock","line":null,"fingerprint":"atomic-polyfill@1.0.3 (crates.io):RUSTSEC-2023-0089"},{"rule_id":"osv/RUSTSEC-2025-0141","severity":"medium","message":"bincode@1.3.3 (crates.io) is affected by RUSTSEC-2025-0141","path":"Cargo.lock","line":null,"fingerprint":"bincode@1.3.3 (crates.io):RUSTSEC-2025-0141"},{"rule_id":"osv/RUSTSEC-2026-0247","severity":"medium","message":"bitmaps@2.1.0 (crates.io) is affected by RUSTSEC-2026-0247","path":"Cargo.lock","line":null,"fingerprint":"bitmaps@2.1.0 (crates.io):RUSTSEC-2026-0247"},{"rule_id":"osv/RUSTSEC-2026-0204","severity":"medium","message":"crossbeam-epoch@0.9.18 (crates.io) is affected by RUSTSEC-2026-0204","path":"Cargo.lock","line":null,"fingerprint":"crossbeam-epoch@0.9.18 (crates.io):RUSTSEC-2026-0204"},{"rule_id":"osv/RUSTSEC-2026-0387","severity":"medium","message":"crypto-bigint@0.5.5 (crates.io) is affected by RUSTSEC-2026-0387","path":"Cargo.lock","line":null,"fingerprint":"crypto-bigint@0.5.5 (crates.io):RUSTSEC-2026-0387"},{"rule_id":"osv/RUSTSEC-2024-0388","severity":"medium","message":"derivative@2.2.0 (crates.io) is affected by RUSTSEC-2024-0388","path":"Cargo.lock","line":null,"fingerprint":"derivative@2.2.0 (crates.io):RUSTSEC-2024-0388"},{"rule_id":"osv/RUSTSEC-2026-0183","severity":"medium","message":"git2@0.19.0 (crates.io) is affected by RUSTSEC-2026-0183","path":"Cargo.lock","line":null,"fingerprint":"git2@0.19.0 (crates.io):RUSTSEC-2026-0183"},{"rule_id":"osv/RUSTSEC-2026-0184","severity":"medium","message":"git2@0.19.0 (crates.io) is affected by RUSTSEC-2026-0184","path":"Cargo.lock","line":null,"fingerprint":"git2@0.19.0 (crates.io):RUSTSEC-2026-0184"},{"rule_id":"osv/RUSTSEC-2026-0258","severity":"medium","message":"h2@0.3.27 (crates.io) is affected by RUSTSEC-2026-0258","path":"Cargo.lock","line":null,"fingerprint":"h2@0.3.27 (crates.io):RUSTSEC-2026-0258"},{"rule_id":"osv/RUSTSEC-2026-0258","severity":"medium","message":"h2@0.4.14 (crates.io) is affected by RUSTSEC-2026-0258","path":"Cargo.lock","line":null,"fingerprint":"h2@0.4.14 (crates.io):RUSTSEC-2026-0258"},{"rule_id":"osv/RUSTSEC-2023-0126","severity":"medium","message":"im@15.1.0 (crates.io) is affected by RUSTSEC-2023-0126","path":"Cargo.lock","line":null,"fingerprint":"im@15.1.0 (crates.io):RUSTSEC-2023-0126"},{"rule_id":"osv/RUSTSEC-2026-0248","severity":"medium","message":"im@15.1.0 (crates.io) is affected by RUSTSEC-2026-0248","path":"Cargo.lock","line":null,"fingerprint":"im@15.1.0 (crates.io):RUSTSEC-2026-0248"},{"rule_id":"osv/RUSTSEC-2026-0418","severity":"medium","message":"libz-sys@1.1.28 (crates.io) is affected by RUSTSEC-2026-0418","path":"Cargo.lock","line":null,"fingerprint":"libz-sys@1.1.28 (crates.io):RUSTSEC-2026-0418"},{"rule_id":"osv/RUSTSEC-2024-0436","severity":"medium","message":"paste@1.0.15 (crates.io) is affected by RUSTSEC-2024-0436","path":"Cargo.lock","line":null,"fingerprint":"paste@1.0.15 (crates.io):RUSTSEC-2024-0436"},{"rule_id":"osv/RUSTSEC-2026-0441","severity":"medium","message":"pin-utils@0.1.0 (crates.io) is affected by RUSTSEC-2026-0441","path":"Cargo.lock","line":null,"fingerprint":"pin-utils@0.1.0 (crates.io):RUSTSEC-2026-0441"},{"rule_id":"osv/RUSTSEC-2024-0370","severity":"medium","message":"proc-macro-error@1.0.4 (crates.io) is affected by RUSTSEC-2024-0370","path":"Cargo.lock","line":null,"fingerprint":"proc-macro-error@1.0.4 (crates.io):RUSTSEC-2024-0370"},{"rule_id":"osv/RUSTSEC-2026-0173","severity":"medium","message":"proc-macro-error2@2.0.1 (crates.io) is affected by RUSTSEC-2026-0173","path":"Cargo.lock","line":null,"fingerprint":"proc-macro-error2@2.0.1 (crates.io):RUSTSEC-2026-0173"},{"rule_id":"osv/RUSTSEC-2026-0338","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0338","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0338"},{"rule_id":"osv/RUSTSEC-2026-0339","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0339","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0339"},{"rule_id":"osv/RUSTSEC-2026-0342","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0342","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0342"},{"rule_id":"osv/RUSTSEC-2026-0523","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0523","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0523"},{"rule_id":"osv/RUSTSEC-2026-0524","severity":"medium","message":"quinn-proto@0.11.14 (crates.io) is affected by RUSTSEC-2026-0524","path":"Cargo.lock","line":null,"fingerprint":"quinn-proto@0.11.14 (crates.io):RUSTSEC-2026-0524"},{"rule_id":"osv/RUSTSEC-2026-0538","severity":"medium","message":"quinn-udp@0.5.14 (crates.io) is affected by RUSTSEC-2026-0538","path":"Cargo.lock","line":null,"fingerprint":"quinn-udp@0.5.14 (crates.io):RUSTSEC-2026-0538"},{"rule_id":"osv/RUSTSEC-2026-0235","severity":"medium","message":"rkyv@0.7.46 (crates.io) is affected by RUSTSEC-2026-0235","path":"Cargo.lock","line":null,"fingerprint":"rkyv@0.7.46 (crates.io):RUSTSEC-2026-0235"},{"rule_id":"osv/RUSTSEC-2026-0220","severity":"medium","message":"ruint@1.18.0 (crates.io) is affected by RUSTSEC-2026-0220","path":"Cargo.lock","line":null,"fingerprint":"ruint@1.18.0 (crates.io):RUSTSEC-2026-0220"},{"rule_id":"osv/RUSTSEC-2026-0486","severity":"medium","message":"rustix@1.1.4 (crates.io) is affected by RUSTSEC-2026-0486","path":"Cargo.lock","line":null,"fingerprint":"rustix@1.1.4 (crates.io):RUSTSEC-2026-0486"},{"rule_id":"osv/GHSA-c8m5-c952-6cm4","severity":"medium","message":"rustls@0.21.12 (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.21.12 (crates.io):GHSA-c8m5-c952-6cm4"},{"rule_id":"osv/GHSA-2mjx-qc3c-rqvc","severity":"medium","message":"rustls@0.23.40 (crates.io) is affected by RUSTSEC-2026-0285, GHSA-2mjx-qc3c-rqvc","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.40 (crates.io):GHSA-2mjx-qc3c-rqvc"},{"rule_id":"osv/GHSA-c8m5-c952-6cm4","severity":"medium","message":"rustls@0.23.40 (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.40 (crates.io):GHSA-c8m5-c952-6cm4"},{"rule_id":"osv/RUSTSEC-2025-0134","severity":"medium","message":"rustls-pemfile@1.0.4 (crates.io) is affected by RUSTSEC-2025-0134","path":"Cargo.lock","line":null,"fingerprint":"rustls-pemfile@1.0.4 (crates.io):RUSTSEC-2025-0134"},{"rule_id":"osv/RUSTSEC-2026-0382","severity":"medium","message":"rustls-webpki@0.101.7 (crates.io) is affected by RUSTSEC-2026-0382","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.101.7 (crates.io):RUSTSEC-2026-0382"},{"rule_id":"osv/RUSTSEC-2026-0382","severity":"medium","message":"rustls-webpki@0.103.13 (crates.io) is affected by RUSTSEC-2026-0382","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.103.13 (crates.io):RUSTSEC-2026-0382"},{"rule_id":"osv/RUSTSEC-2026-0205","severity":"medium","message":"scc@2.4.0 (crates.io) is affected by RUSTSEC-2026-0205","path":"Cargo.lock","line":null,"fingerprint":"scc@2.4.0 (crates.io):RUSTSEC-2026-0205"},{"rule_id":"osv/GHSA-7gcf-g7xr-8hxj","severity":"medium","message":"serde_with@3.20.0 (crates.io) is affected by GHSA-7gcf-g7xr-8hxj","path":"Cargo.lock","line":null,"fingerprint":"serde_with@3.20.0 (crates.io):GHSA-7gcf-g7xr-8hxj"},{"rule_id":"osv/RUSTSEC-2026-0251","severity":"medium","message":"sized-chunks@0.6.5 (crates.io) is affected by RUSTSEC-2026-0251","path":"Cargo.lock","line":null,"fingerprint":"sized-chunks@0.6.5 (crates.io):RUSTSEC-2026-0251"},{"rule_id":"osv/RUSTSEC-2026-0255","severity":"medium","message":"sized-chunks@0.6.5 (crates.io) is affected by RUSTSEC-2026-0255","path":"Cargo.lock","line":null,"fingerprint":"sized-chunks@0.6.5 (crates.io):RUSTSEC-2026-0255"},{"rule_id":"osv/RUSTSEC-2026-0249","severity":"medium","message":"smartstring@1.0.1 (crates.io) is affected by RUSTSEC-2026-0249","path":"Cargo.lock","line":null,"fingerprint":"smartstring@1.0.1 (crates.io):RUSTSEC-2026-0249"},{"rule_id":"osv/RUSTSEC-2026-0386","severity":"medium","message":"tokio@1.52.3 (crates.io) is affected by RUSTSEC-2026-0386","path":"Cargo.lock","line":null,"fingerprint":"tokio@1.52.3 (crates.io):RUSTSEC-2026-0386"},{"rule_id":"osv/RUSTSEC-2026-0383","severity":"medium","message":"webpki-root-certs@1.0.7 (crates.io) is affected by RUSTSEC-2026-0383","path":"Cargo.lock","line":null,"fingerprint":"webpki-root-certs@1.0.7 (crates.io):RUSTSEC-2026-0383"},{"rule_id":"osv/RUSTSEC-2026-0381","severity":"medium","message":"webpki-roots@0.25.4 (crates.io) is affected by RUSTSEC-2026-0381","path":"Cargo.lock","line":null,"fingerprint":"webpki-roots@0.25.4 (crates.io):RUSTSEC-2026-0381"},{"rule_id":"osv/RUSTSEC-2024-0320","severity":"medium","message":"yaml-rust@0.4.5 (crates.io) is affected by RUSTSEC-2024-0320","path":"Cargo.lock","line":null,"fingerprint":"yaml-rust@0.4.5 (crates.io):RUSTSEC-2024-0320"},{"rule_id":"osv/GHSA-j39j-6gw9-jw6h","severity":"low","message":"git2@0.19.0 (crates.io) is affected by RUSTSEC-2026-0008, GHSA-j39j-6gw9-jw6h","path":"Cargo.lock","line":null,"fingerprint":"git2@0.19.0 (crates.io):GHSA-j39j-6gw9-jw6h"},{"rule_id":"osv/GHSA-w44r-93j7-qv28","severity":"low","message":"rustls@0.21.12 (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.21.12 (crates.io):GHSA-w44r-93j7-qv28"},{"rule_id":"osv/GHSA-h2v8-394m-p7vv","severity":"low","message":"rustls@0.21.12 (crates.io) is affected by GHSA-h2v8-394m-p7vv","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.21.12 (crates.io):GHSA-h2v8-394m-p7vv"},{"rule_id":"osv/GHSA-h2v8-394m-p7vv","severity":"low","message":"rustls@0.23.40 (crates.io) is affected by RUSTSEC-2026-0348, GHSA-h2v8-394m-p7vv","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.40 (crates.io):GHSA-h2v8-394m-p7vv"},{"rule_id":"osv/GHSA-w44r-93j7-qv28","severity":"low","message":"rustls@0.23.40 (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.40 (crates.io):GHSA-w44r-93j7-qv28"},{"rule_id":"osv/GHSA-965h-392x-2mh5","severity":"low","message":"rustls-webpki@0.101.7 (crates.io) is affected by RUSTSEC-2026-0098, GHSA-965h-392x-2mh5","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.101.7 (crates.io):GHSA-965h-392x-2mh5"},{"rule_id":"osv/GHSA-xgp8-3hg3-c2mh","severity":"low","message":"rustls-webpki@0.101.7 (crates.io) is affected by RUSTSEC-2026-0099, GHSA-xgp8-3hg3-c2mh","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.101.7 (crates.io):GHSA-xgp8-3hg3-c2mh"},{"rule_id":"osv/GHSA-xwfj-jgwm-7wp5","severity":"low","message":"tracing-subscriber@0.3.19 (crates.io) is affected by RUSTSEC-2025-0055, GHSA-xwfj-jgwm-7wp5","path":"Cargo.lock","line":null,"fingerprint":"tracing-subscriber@0.3.19 (crates.io):GHSA-xwfj-jgwm-7wp5"}],"evidence":[],"data":{"ecosystems":["crates.io"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":6.0,"findings":195.0,"findings_high":137.0,"findings_medium":9.0,"findings_low":49.0,"penalty":1493.3},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/benchmark.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/benchmark.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/benchmark.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/benchmark.yml:30"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/benchmark.yml","line":31,"fingerprint":"unpinned-uses:.github/workflows/benchmark.yml:31"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/benchmark.yml","line":35,"fingerprint":"unpinned-uses:.github/workflows/benchmark.yml:35"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/benchmark.yml","line":45,"fingerprint":"unpinned-uses:.github/workflows/benchmark.yml:45"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/ci.yml","line":660,"fingerprint":"template-injection:.github/workflows/ci.yml:660"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":58,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:58"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":61,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:61"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":66,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:66"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":78,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:78"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":81,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:81"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":86,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:86"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":100,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:100"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":103,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:103"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":117,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:117"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":119,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:119"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":122,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:122"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":133,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:133"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":135,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:135"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":138,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:138"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":147,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:147"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":149,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:149"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":152,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:152"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":161,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:161"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":163,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:163"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":166,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:166"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":175,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:175"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":177,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:177"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":180,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:180"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":189,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:189"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":191,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:191"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":194,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:194"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":206,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:206"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":209,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:209"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":226,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:226"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":228,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:228"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":231,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:231"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":249,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:249"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":278,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:278"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":280,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:280"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":283,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:283"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":297,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:297"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":299,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:299"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":302,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:302"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":313,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:313"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":315,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:315"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":319,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:319"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":328,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:328"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":330,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:330"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":341,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:341"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":343,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:343"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":354,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:354"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":356,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:356"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":360,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:360"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":379,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:379"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":381,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:381"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":385,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:385"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":404,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:404"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":406,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:406"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":410,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:410"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":452,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:452"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":454,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:454"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":457,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:457"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":466,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:466"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":472,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:472"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":480,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:480"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":488,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:488"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":497,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:497"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":499,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:499"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":502,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:502"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":529,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:529"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":531,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:531"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":534,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:534"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":573,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:573"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":575,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:575"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":580,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:580"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":584,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:584"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":601,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:601"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":603,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:603"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":607,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:607"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":631,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:631"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":650,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:650"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":653,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:653"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":663,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:663"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":695,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:695"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":698,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:698"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":703,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:703"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":709,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:709"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":727,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:727"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":730,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:730"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":742,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:742"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":788,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:788"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":798,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:798"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":818,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:818"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":865,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:865"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":66,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:66"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":86,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:86"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":122,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:122"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":138,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:138"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":152,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:152"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":166,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:166"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":180,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:180"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":194,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:194"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":231,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:231"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":283,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:283"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":302,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:302"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":319,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:319"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":360,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:360"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":385,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:385"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":410,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:410"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":457,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:457"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":502,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:502"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":534,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:534"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":580,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:580"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":607,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:607"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/ci.yml","line":798,"fingerprint":"cache-poisoning:.github/workflows/ci.yml:798"},{"rule_id":"zizmor/github-app","severity":"high","message":"dangerous use of GitHub App tokens [confidence high]","path":".github/workflows/ci.yml","line":477,"fingerprint":"github-app:.github/workflows/ci.yml:477"},{"rule_id":"zizmor/github-app","severity":"high","message":"dangerous use of GitHub App tokens [confidence high]","path":".github/workflows/ci.yml","line":472,"fingerprint":"github-app:.github/workflows/ci.yml:472"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs.yml","line":10,"fingerprint":"unpinned-uses:.github/workflows/docs.yml:10"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":52,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:52"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":55,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:55"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":102,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:102"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":116,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:116"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":124,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:124"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":132,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:132"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":151,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:151"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":160,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:160"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":168,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:168"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":176,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:176"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":195,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:195"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":215,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:215"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/gh-pages.yml","line":52,"fingerprint":"cache-poisoning:.github/workflows/gh-pages.yml:52"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/nightly-cargo-audit.yml","line":11,"fingerprint":"unpinned-uses:.github/workflows/nightly-cargo-audit.yml:11"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/nightly-cargo-audit.yml","line":12,"fingerprint":"unpinned-uses:.github/workflows/nightly-cargo-audit.yml:12"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/spellcheck.yml","line":11,"fingerprint":"unpinned-uses:.github/workflows/spellcheck.yml:11"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/spellcheck.yml","line":14,"fingerprint":"unpinned-uses:.github/workflows/spellcheck.yml:14"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":572,"fingerprint":"artipacked:.github/workflows/ci.yml:572"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":726,"fingerprint":"artipacked:.github/workflows/ci.yml:726"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":787,"fingerprint":"artipacked:.github/workflows/ci.yml:787"},{"rule_id":"zizmor/archived-uses","severity":"medium","message":"action or reusable workflow from archived repository [confidence high]","path":".github/workflows/ci.yml","line":209,"fingerprint":"archived-uses:.github/workflows/ci.yml:209"},{"rule_id":"zizmor/archived-uses","severity":"medium","message":"action or reusable workflow from archived repository [confidence high]","path":".github/workflows/ci.yml","line":865,"fingerprint":"archived-uses:.github/workflows/ci.yml:865"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/docs.yml","line":9,"fingerprint":"excessive-permissions:.github/workflows/docs.yml:9"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/nightly-cargo-audit.yml","line":8,"fingerprint":"excessive-permissions:.github/workflows/nightly-cargo-audit.yml:8"},{"rule_id":"zizmor/archived-uses","severity":"medium","message":"action or reusable workflow from archived repository [confidence high]","path":".github/workflows/nightly-cargo-audit.yml","line":12,"fingerprint":"archived-uses:.github/workflows/nightly-cargo-audit.yml:12"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/spellcheck.yml","line":7,"fingerprint":"excessive-permissions:.github/workflows/spellcheck.yml:7"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/benchmark.yml","line":29,"fingerprint":"artipacked:.github/workflows/benchmark.yml:29"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":57,"fingerprint":"artipacked:.github/workflows/ci.yml:57"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":77,"fingerprint":"artipacked:.github/workflows/ci.yml:77"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":99,"fingerprint":"artipacked:.github/workflows/ci.yml:99"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":117,"fingerprint":"artipacked:.github/workflows/ci.yml:117"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":133,"fingerprint":"artipacked:.github/workflows/ci.yml:133"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":147,"fingerprint":"artipacked:.github/workflows/ci.yml:147"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":161,"fingerprint":"artipacked:.github/workflows/ci.yml:161"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":175,"fingerprint":"artipacked:.github/workflows/ci.yml:175"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":189,"fingerprint":"artipacked:.github/workflows/ci.yml:189"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":205,"fingerprint":"artipacked:.github/workflows/ci.yml:205"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":226,"fingerprint":"artipacked:.github/workflows/ci.yml:226"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":278,"fingerprint":"artipacked:.github/workflows/ci.yml:278"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":297,"fingerprint":"artipacked:.github/workflows/ci.yml:297"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":313,"fingerprint":"artipacked:.github/workflows/ci.yml:313"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":328,"fingerprint":"artipacked:.github/workflows/ci.yml:328"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":341,"fingerprint":"artipacked:.github/workflows/ci.yml:341"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":354,"fingerprint":"artipacked:.github/workflows/ci.yml:354"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":379,"fingerprint":"artipacked:.github/workflows/ci.yml:379"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":404,"fingerprint":"artipacked:.github/workflows/ci.yml:404"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":452,"fingerprint":"artipacked:.github/workflows/ci.yml:452"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":464,"fingerprint":"artipacked:.github/workflows/ci.yml:464"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":478,"fingerprint":"artipacked:.github/workflows/ci.yml:478"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":497,"fingerprint":"artipacked:.github/workflows/ci.yml:497"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":529,"fingerprint":"artipacked:.github/workflows/ci.yml:529"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":601,"fingerprint":"artipacked:.github/workflows/ci.yml:601"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":649,"fingerprint":"artipacked:.github/workflows/ci.yml:649"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":694,"fingerprint":"artipacked:.github/workflows/ci.yml:694"},{"rule_id":"zizmor/template-injection","severity":"low","message":"code injection via template expansion [confidence high]","path":".github/workflows/ci.yml","line":856,"fingerprint":"template-injection:.github/workflows/ci.yml:856"},{"rule_id":"zizmor/template-injection","severity":"low","message":"code injection via template expansion [confidence high]","path":".github/workflows/ci.yml","line":856,"fingerprint":"template-injection:.github/workflows/ci.yml:856"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/gh-pages.yml","line":26,"fingerprint":"artipacked:.github/workflows/gh-pages.yml:26"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/nightly-cargo-audit.yml","line":11,"fingerprint":"artipacked:.github/workflows/nightly-cargo-audit.yml:11"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/spellcheck.yml","line":10,"fingerprint":"artipacked:.github/workflows/spellcheck.yml:10"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/ci.yml","line":365,"fingerprint":"template-injection:.github/workflows/ci.yml:365"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/ci.yml","line":365,"fingerprint":"template-injection:.github/workflows/ci.yml:365"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/ci.yml","line":367,"fingerprint":"template-injection:.github/workflows/ci.yml:367"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/ci.yml","line":368,"fingerprint":"template-injection:.github/workflows/ci.yml:368"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/ci.yml","line":390,"fingerprint":"template-injection:.github/workflows/ci.yml:390"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/ci.yml","line":390,"fingerprint":"template-injection:.github/workflows/ci.yml:390"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/ci.yml","line":392,"fingerprint":"template-injection:.github/workflows/ci.yml:392"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/ci.yml","line":393,"fingerprint":"template-injection:.github/workflows/ci.yml:393"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/ci.yml","line":589,"fingerprint":"template-injection:.github/workflows/ci.yml:589"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/ci.yml","line":589,"fingerprint":"template-injection:.github/workflows/ci.yml:589"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/ci.yml","line":591,"fingerprint":"template-injection:.github/workflows/ci.yml:591"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/ci.yml","line":592,"fingerprint":"template-injection:.github/workflows/ci.yml:592"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/gh-pages.yml","line":189,"fingerprint":"template-injection:.github/workflows/gh-pages.yml:189"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/gh-pages.yml","line":190,"fingerprint":"template-injection:.github/workflows/gh-pages.yml:190"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/gh-pages.yml","line":210,"fingerprint":"template-injection:.github/workflows/gh-pages.yml:210"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/gh-pages.yml","line":211,"fingerprint":"template-injection:.github/workflows/gh-pages.yml:211"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":0.0,"signed_commit_share":1.0,"unpinned_manifests":27.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0},{"kind":"posture","description":"forc-pkg/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"forc-pkg/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"forc-plugins/forc-debug/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"forc-plugins/forc-debug/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"forc-plugins/forc-doc/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"forc-plugins/forc-doc/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"forc-plugins/forc-fmt/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"forc-plugins/forc-fmt/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"forc-plugins/forc-lsp/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"forc-plugins/forc-lsp/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"forc-plugins/forc-migrate/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"forc-plugins/forc-migrate/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"forc-plugins/forc-publish/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"forc-plugins/forc-publish/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"forc-plugins/forc-tx/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"forc-plugins/forc-tx/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"forc-test/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"forc-test/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"forc-util/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"forc-util/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"forc/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"forc/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"scripts/mdbook-forc-documenter/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"scripts/mdbook-forc-documenter/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"sway-ast/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"sway-ast/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"sway-core/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"sway-core/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"sway-error/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"sway-error/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"sway-features/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"sway-features/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"sway-ir/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"sway-ir/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"sway-ir/sway-ir-macros/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"sway-ir/sway-ir-macros/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"sway-lsp/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"sway-lsp/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"sway-parse/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"sway-parse/Cargo.toml","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":36.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v0.72.1 ships forc-binaries-darwin_amd64.tar.gz (200 downloads)","ref":"forc-binaries-darwin_amd64.tar.gz","url":"https://github.com/FuelLabs/sway/releases/download/v0.72.1/forc-binaries-darwin_amd64.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.72.1 ships forc-binaries-darwin_arm64.tar.gz (285 downloads)","ref":"forc-binaries-darwin_arm64.tar.gz","url":"https://github.com/FuelLabs/sway/releases/download/v0.72.1/forc-binaries-darwin_arm64.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.72.1 ships forc-binaries-linux_amd64.tar.gz (13614 downloads)","ref":"forc-binaries-linux_amd64.tar.gz","url":"https://github.com/FuelLabs/sway/releases/download/v0.72.1/forc-binaries-linux_amd64.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.72.1 ships forc-binaries-linux_arm64.tar.gz (888 downloads)","ref":"forc-binaries-linux_arm64.tar.gz","url":"https://github.com/FuelLabs/sway/releases/download/v0.72.1/forc-binaries-linux_arm64.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release v0.72.0 ships forc-binaries-darwin_amd64.tar.gz (14 downloads)","ref":"forc-binaries-darwin_amd64.tar.gz","url":"https://github.com/FuelLabs/sway/releases/download/v0.72.0/forc-binaries-darwin_amd64.tar.gz","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":6714.0,"function_nloc":150857.0,"mean_ccn":4.36,"p90_ccn":9.0,"complex_functions":314.0,"long_functions":238.0,"many_param_functions":79.0,"risky_nloc_share":0.3734},"findings":[],"evidence":[{"kind":"complex-function","description":"span in sway-error/src/error.rs: complexity 222, 236 lines","ref":"sway-error/src/error.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/sway-error/src/error.rs#L1260","weight":1.0},{"kind":"complex-function","description":"format in swayfmt/src/utils/language/expr/mod.rs: complexity 219, 565 lines","ref":"swayfmt/src/utils/language/expr/mod.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/swayfmt/src/utils/language/expr/mod.rs#L88","weight":1.0},{"kind":"complex-function","description":"to_diagnostic in sway-error/src/error.rs: complexity 211, 1894 lines","ref":"sway-error/src/error.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/sway-error/src/error.rs#L1510","weight":1.0},{"kind":"complex-function","description":"parse_opcode in sway-core/src/asm_lang/mod.rs: complexity 198, 421 lines","ref":"sway-core/src/asm_lang/mod.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/sway-core/src/asm_lang/mod.rs#L357","weight":1.0},{"kind":"complex-function","description":"visit_expr in forc-plugins/forc-migrate/src/visiting/mod.rs: complexity 159, 704 lines","ref":"forc-plugins/forc-migrate/src/visiting/mod.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-plugins/forc-migrate/src/visiting/mod.rs#L961","weight":1.0},{"kind":"complex-function","description":"expr_to_expression in sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs: complexity 147, 491 lines","ref":"sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs#L2633","weight":1.0},{"kind":"complex-function","description":"compile_intrinsic_function in sway-core/src/ir_generation/function.rs: complexity 129, 973 lines","ref":"sway-core/src/ir_generation/function.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/sway-core/src/ir_generation/function.rs#L1011","weight":1.0},{"kind":"complex-function","description":"print_instruction in sway-core/src/asm_generation/finalized_asm.rs: complexity 127, 131 lines","ref":"sway-core/src/asm_generation/finalized_asm.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/sway-core/src/asm_generation/finalized_asm.rs#L438","weight":1.0},{"kind":"complex-function","description":"set_operand in sway-ir/src/instruction.rs: complexity 126, 461 lines","ref":"sway-ir/src/instruction.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/sway-ir/src/instruction.rs#L921","weight":1.0},{"kind":"complex-function","description":"connect_expression in sway-core/src/control_flow_analysis/dead_code_analysis.rs: complexity 122, 859 lines","ref":"sway-core/src/control_flow_analysis/dead_code_analysis.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/sway-core/src/control_flow_analysis/dead_code_analysis.rs#L1203","weight":1.0}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":158123.0,"duplicated_lines":15891.0,"duplicated_share":0.1005,"files":706.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: forc-pkg/src/lock.rs:346 and forc-pkg/src/lock.rs:364","ref":"forc-pkg/src/lock.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-pkg/src/lock.rs#L346","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: forc-pkg/src/manifest/build_profile.rs:53 and forc-pkg/src/manifest/build_profile.rs:76","ref":"forc-pkg/src/manifest/build_profile.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-pkg/src/manifest/build_profile.rs#L53","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: forc-pkg/src/manifest/dep_modifier.rs:367 and forc-pkg/src/manifest/dep_modifier.rs:379","ref":"forc-pkg/src/manifest/dep_modifier.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-pkg/src/manifest/dep_modifier.rs#L367","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: forc-pkg/src/manifest/mod.rs:97 and forc-pkg/src/manifest/mod.rs:120","ref":"forc-pkg/src/manifest/mod.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-pkg/src/manifest/mod.rs#L97","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: forc-pkg/src/pkg.rs:297 and forc-test/src/lib.rs:147","ref":"forc-pkg/src/pkg.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-pkg/src/pkg.rs#L297","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: forc-pkg/src/pkg.rs:468 and forc-pkg/src/pkg.rs:480","ref":"forc-pkg/src/pkg.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-pkg/src/pkg.rs#L468","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: forc-pkg/src/source/git/mod.rs:619 and forc-pkg/src/source/git/mod.rs:639","ref":"forc-pkg/src/source/git/mod.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-pkg/src/source/git/mod.rs#L619","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: forc-pkg/src/source/ipfs.rs:63 and forc-pkg/src/source/reg/mod.rs:376","ref":"forc-pkg/src/source/ipfs.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-pkg/src/source/ipfs.rs#L63","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: forc-pkg/src/source/member.rs:31 and forc-pkg/src/source/path.rs:78","ref":"forc-pkg/src/source/member.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-pkg/src/source/member.rs#L31","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: forc-pkg/src/source/reg/mod.rs:707 and forc-pkg/src/source/reg/mod.rs:729","ref":"forc-pkg/src/source/reg/mod.rs","url":"https://github.com/FuelLabs/sway/blob/7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71/forc-pkg/src/source/reg/mod.rs#L707","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":31.0,"weighted_findings":8.5,"scanned_lines":217599.0,"category:best-practice":1.0,"category:correctness":30.0},"findings":[{"rule_id":"opengrep/bash.lang.best-practice.useless-cat","severity":"medium","message":"Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file.","path":"benchmark.sh","line":106,"fingerprint":"bash.lang.best-practice.useless-cat:benchmark.sh:106"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":".github/workflows/scripts/verify_tag.sh","line":17,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:.github/workflows/scripts/verify_tag.sh:17"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".github/workflows/scripts/verify_tag.sh","line":17,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.github/workflows/scripts/verify_tag.sh:17"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".github/workflows/scripts/verify_tag.sh","line":69,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.github/workflows/scripts/verify_tag.sh:69"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"benchmark.sh","line":37,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:benchmark.sh:37"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"benchmark.sh","line":51,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:benchmark.sh:51"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"benchmark.sh","line":85,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:benchmark.sh:85"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"benchmark.sh","line":86,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:benchmark.sh:86"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"benchmark.sh","line":93,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:benchmark.sh:93"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/bisect-forc/bisect-forc.sh","line":84,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/bisect-forc/bisect-forc.sh:84"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/bisect-forc/bisect-forc.sh","line":87,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/bisect-forc/bisect-forc.sh:87"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/bisect-forc/bisect-forc.sh","line":88,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/bisect-forc/bisect-forc.sh:88"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/formatter/forc-fmt-check-panic.sh","line":13,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/formatter/forc-fmt-check-panic.sh:13"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/formatter/forc-fmt-check-panic.sh","line":15,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/formatter/forc-fmt-check-panic.sh:15"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/formatter/forc-fmt-check-panic.sh","line":19,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/formatter/forc-fmt-check-panic.sh:19"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/highlightjs/build.sh","line":5,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/highlightjs/build.sh:5"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/highlightjs/build.sh","line":9,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/highlightjs/build.sh:9"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/highlightjs/build.sh","line":10,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/highlightjs/build.sh:10"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/highlightjs/build.sh","line":22,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/highlightjs/build.sh:22"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/prism/build.sh","line":6,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/prism/build.sh:6"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/prism/build.sh","line":10,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/prism/build.sh:10"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/prism/build.sh","line":11,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/prism/build.sh:11"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/prism/build.sh","line":12,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/prism/build.sh:12"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/prism/build.sh","line":21,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/prism/build.sh:21"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sway-lib-std/generate.sh","line":6,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sway-lib-std/generate.sh:6"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sway-lib-std/generate.sh","line":17,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sway-lib-std/generate.sh:17"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sway-lib-std/generate.sh","line":19,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sway-lib-std/generate.sh:19"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sway-lib-std/generate.sh","line":21,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sway-lib-std/generate.sh:21"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sway-lib-std/generate.sh","line":68,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sway-lib-std/generate.sh:68"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sway-lib-std/generate.sh","line":141,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sway-lib-std/generate.sh:141"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sway-lib-std/generate.sh","line":206,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sway-lib-std/generate.sh:206"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.2355,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":25618.0,"source_lines":217599.0,"test_ratio":0.1177,"ci_files":6.0,"cochange_share":0.399,"cochange_commits":208.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/benchmark.yml","ref":".github/workflows/benchmark.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/docs.yml","ref":".github/workflows/docs.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/gh-pages.yml","ref":".github/workflows/gh-pages.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/nightly-cargo-audit.yml","ref":".github/workflows/nightly-cargo-audit.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/spellcheck.yml","ref":".github/workflows/spellcheck.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (go test, cargo test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (clippy, rustfmt, cargo fmt)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["go test","cargo test"],"lint_commands":["clippy","rustfmt","cargo fmt"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":64.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":383.0,"other_lines":217216.0,"files_blamed":706.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":31.0,"quality:other_per_kloc":0.143,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":15.0,"security:other_per_kloc":0.069},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}