{"slug":"api-zfinia-com-x402-v1-ci-workflow-contract-audit-d00d9f","title":"Audit a CI workflow for what it leaves movable or undeclared","host":"api.zfinia.com","method":"POST","resource":"https://api.zfinia.com/x402/v1/ci-workflow-contract-audit","category":"code","description":"Audit a CI workflow for what it leaves movable or undeclared. Reports actions pinned to a tag rather than a commit - a tag can be moved by whoever owns the action, so the code a step runs can change without this file changing - missing permissions and timeouts, a job depending on one that is not dec","price_listed":0.12,"price_asked":null,"state":"effects","state_label":"Not tested: has real-world effects","checks_7d":0,"answered_7d":0,"latency_ms_median":null,"reported_calls_30d":1,"reported_payers_30d":1,"networks":["eip155:8453"],"badge":"unverified","paid_checks_7d":0,"paid_ok_7d":0,"example_input":{"body":{"contract":{"required_jobs":["build","publish","lint"]},"workflow":{"jobs":{"build":{"runs-on":"ubuntu-latest","steps":[{"uses":"actions/checkout@v4"},{"uses":"actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"},{"name":"Greet","run":"echo \"Building ${{ github.event.pull_request.title }}\""},{"run":"npm ci && npm test"}]},"notify":{"needs":["publish","lint"],"runs-on":"ubuntu-latest","steps":[{"run":"echo done"}]},"publish":{"needs":"build","permissions":{"contents":"read","packages":"write"},"runs-on":"ubuntu-latest","steps":[{"uses":"actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"}],"timeout-minutes":15}},"name":"release","on":{"pull_request_target":{},"push":{"branches":["main"]}}}},"bodyType":"json","method":"POST","type":"http"},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"body":{"additionalProperties":false,"properties":{"contract":{"additionalProperties":false,"properties":{"forbid_pull_request_target":{"type":"boolean"},"require_permissions":{"type":"boolean"},"require_pinned_actions":{"type":"boolean"},"require_timeout":{"type":"boolean"},"required_jobs":{"items":{"maxLength":128,"type":"string"},"maxItems":200,"minItems":1,"type":"array"}},"type":"object"},"workflow":{"type":"object"}},"required":["workflow"],"type":"object"},"bodyType":{"enum":["json","form-data","text"],"type":"string"},"method":{"enum":["POST"],"type":"string"},"type":{"const":"http","type":"string"}},"required":["type","method","bodyType","body"],"type":"object"},"output":{"properties":{"example":{"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"},"history":[],"description_full":"Audit a CI workflow for what it leaves movable or undeclared. Reports actions pinned to a tag rather than a commit - a tag can be moved by whoever owns the action, so the code a step runs can change without this file changing - missing permissions and timeouts, a job depending on one that is not declared, a pull_request_target trigger, and an expression interpolated straight into a shell command.","last_updated":"2026-10-04T08:02:50.284Z","schemes":["exact"]}