chore(deps): bump the actions group across 1 directory with 6 updates

[dependabot]

Bumps the actions group with 6 updates in the / directory:

Package	From	To
actions/deploy-pages	5.0.0	5.0.1
github/codeql-action/init	4.37.8	4.38.0
github/codeql-action/analyze	4.37.8	4.38.0
github/codeql-action/upload-sarif	4.37.8	4.38.0
hyperpolymath/smtp-notify-action	0.2.0	0.3.0
trufflesecurity/trufflehog	3.97.0	3.97.4

Updates actions/deploy-pages from 5.0.0 to 5.0.1

Release notes

Sourced from actions/deploy-pages's releases.

v5.0.1

Changelog

• Add backoff and jitter to deployment polling @​yoannchaudet (#444)
• Improve deployment request test coverage @​adwitiyagoyal (#440)

---

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Commits

• 368f825 Merge pull request #444 from actions/yoannchaudet-deployment-polling-backoff
• 7e97763 Validate deployment polling intervals
• 0143e11 Add backoff and jitter to deployment polling
• 5e98f10 Merge pull request #440 from actions/user/adwitiya
• 8b0625a Improve deployment request test coverage
• See full diff in compare view

Updates github/codeql-action/init from 4.37.8 to 4.38.0

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.8 to 4.38.0

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.37.8 to 4.38.0

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates hyperpolymath/smtp-notify-action from 0.2.0 to 0.3.0

Release notes

Sourced from hyperpolymath/smtp-notify-action's releases.

v0.3.0

Static, byte-reproducible smtp-notify binaries. CI rebuilt them from this tag and verified they hash to exactly the SHA-256 pins inside this tag's action.yml before publishing.

Changelog

Sourced from hyperpolymath/smtp-notify-action's changelog.

// SPDX-License-Identifier: MPL-2.0 = Changelog :toc: macro :toclevels: 2

All notable changes to this action are recorded here. The format follows https://keepachangelog.com/en/1.1.0/[Keep a Changelog]; versions follow https://semver.org/spec/v2.0.0.html[Semantic Versioning].

The unit of release is the action ref: the tag or commit you pin determines both action.yml and, through the SHA-256 pins inside it, the exact binary that runs.

toc::[]

== v0.3.0 — 2026-09-09

[IMPORTANT]

main is not a release, and pinning @main is not supported.

Between a release commit landing on main and its tag being pushed, action.yml on main names assets that do not exist yet, so @main fails at the download step. This window is unavoidable rather than an oversight: the release workflow refuses to publish unless the asset URL in the tagged commit already names the tag being released, so the commit must precede the tag. The window is minutes long and is one more reason @main is not a supported ref.

Pin a tag, or a commit SHA that is an ancestor of one.

=== Added

• STARTTLS on the submission port. secure: false or secure: starttls now starts in the clear on port 587 and upgrades the same connection in place per RFC 3207, including the mandatory second EHLO after the upgrade. The upgrade is not opportunistic: a server that does not advertise STARTTLS fails the step, and that check runs before the command is sent, so no credential is ever written to a cleartext stream. Certificate verification is identical on both TLS paths.
• EHLO capability parsing (issue #9). The EHLO reply is parsed into a Capabilities value — STARTTLS, the AUTH mechanism list (including the Exchange AUTH=LOGIN spelling), SIZE and 8BITMIME — and an AUTH failure now names what the server actually advertised. A mechanism mismatch and a wrong password no longer look alike in the log.
• The proven state machine now carries two tables, selected by transport, each proven separately: the implicit-TLS table is proven to contain no upgrade rows, and the STARTTLS table is proven to reach them from the start state. A row that is present but unreachable would have authenticated in the clear while every prior proof stayed green.
• AUTH LOGIN, and mechanism selection (issue #10). The mechanism is chosen

... (truncated)

Commits

• 22e7bdb release: v0.3.0 — action.yml fetches the STARTTLS binaries
• 11c4ba9 feat: reach Microsoft 365 and Google Workspace on the submission port (STARTT...
• See full diff in compare view

Updates trufflesecurity/trufflehog from 3.97.0 to 3.97.4

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.97.4

What's Changed

• Make Transport Errors indeterminate for Twilio secrets and twilioapikeys by @​jordanTunstill in trufflesecurity/trufflehog#5267
• Improve the json-enumerator source by @​bradlarsen in trufflesecurity/trufflehog#5265
• added tests for twilio detector fixes by @​jordanTunstill in trufflesecurity/trufflehog#5271

Full Changelog: trufflesecurity/trufflehog@v3.97.3...v3.97.4

v3.97.3

What's Changed

• fix(s3): cut a child context per object so key/size log values don't pile up by @​mariduv in trufflesecurity/trufflehog#5236
• Revert "[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source" by @​trufflesteeeve in trufflesecurity/trufflehog#5269

Full Changelog: trufflesecurity/trufflehog@v3.97.2...v3.97.3

v3.97.2

What's Changed

• detectors/github/v2: differentiate token type in ExtraData by @​hartsock in trufflesecurity/trufflehog#5223
• Update dependency trufflesecurity/.github to v1.0.4 by @​renovate[bot] in trufflesecurity/trufflehog#5228
• ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @​bryanbeverly in trufflesecurity/trufflehog#5231
• Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @​renovate[bot] in trufflesecurity/trufflehog#5172
• Update github-actions by @​renovate[bot] in trufflesecurity/trufflehog#5197
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in trufflesecurity/trufflehog#5173
• Update module github.com/aws/smithy-go to v1.27.9 by @​renovate[bot] in trufflesecurity/trufflehog#5174
• [SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @​dipto-truffle in trufflesecurity/trufflehog#5234
• [INS-377] Add V2 for weights and biases detector by @​mustansir14 in trufflesecurity/trufflehog#4951
• Fix PagerDuty detector: treat 403 and 402 as verified credentials by @​unsmith in trufflesecurity/trufflehog#5230
• [INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @​camgunz in trufflesecurity/trufflehog#5248
• Implement Enumerate for the Jenkins source by @​Ahsan-Sarbaz in trufflesecurity/trufflehog#5229
• Update link to Truffle Security documentation by @​shahzadhaider1 in trufflesecurity/trufflehog#5256
• Retry git clone on secondary rate limit (bare 403/429) by @​kashifkhan0771 in trufflesecurity/trufflehog#5260

New Contributors

• @​hartsock made their first contribution in trufflesecurity/trufflehog#5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

v3.97.1

What's Changed

• Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @​renovate[bot] in trufflesecurity/trufflehog#5196
• Fix GHEC with Data Residency (*.ghe.com) base URL by @​shahzadhaider1 in trufflesecurity/trufflehog#4777
• docs: add generic config-secret custom detector example by @​pgmpofu in trufflesecurity/trufflehog#5195
• fix(detectors/docker): don't greedy match in keyPat by @​mariduv in trufflesecurity/trufflehog#5214
• [SCAN-1020] neon scram pgx by @​alafiand in trufflesecurity/trufflehog#5217
• Raised MongoDB detector timeout value by @​jordanTunstill in trufflesecurity/trufflehog#5222
• preallocate bindings capacity in dockerhub and groq, with unit tests by @​jordanTunstill in trufflesecurity/trufflehog#5213
• [SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @​amanfcp in trufflesecurity/trufflehog#5224
• Refine SECURITY.md by @​bradlarsen in trufflesecurity/trufflehog#5216

... (truncated)

Commits

• 363923b added tests for twilio detector fixes (#5271)
• f537081 Improve the json-enumerator source (#5265)
• 8a9a4c6 Made retry exaustion indeterminate for Twilio secrets and twilioapikeys (#5267)
• 8947a7f Revert "De-base64 SourceUnit.UnitData in the GitHub Source (#5248)" (#5269)
• ea33cd0 fix(s3): cut a child context per object so key/size log values don't pile up ...
• cc1fe98 Retry git clone on secondary rate limit (bare 403/429) (#5260)
• 74dcf3f Update link to Truffle Security documentation (#5256)
• 2b75fd2 Implement Enumerate for the Jenkins source (#5229)
• 0c952ac De-base64 SourceUnit.UnitData in the GitHub Source (#5248)
• 1ea7fc1 expand result code in pagerduty detector (#5230)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 18181316-5ab2-4781-afbc-31617b559557

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🔍 Hypatia Security Scan

Findings: 47 issues detected

Severity	Count
🔴 Critical	7
🟠 High	5
🟡 Medium	35

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in hypatia-scan.yml",
    "type": "missing_timeout_minutes",
    "file": "hypatia-scan.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence