{"id":54312,"recorded_at":"2026-10-26T14:37:11.962638Z","observed_at":"2026-10-26T14:37:11.962598Z","subject_kind":"source_record","subject":"x402_bazaar:https://ciaudit.genexxis.com/github-actions","kind":"listing","method":"sync.x402_bazaar/1","body":{"endpoints":[["x402","https://ciaudit.genexxis.com/github-actions"]],"name":"ciaudit.genexxis.com/github-actions","owner_address":"0x9287e3102d411029025c7617d75245bfc7920f17","raw":{"accepts":[{"amount":"8000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","version":"2"},"maxTimeoutSeconds":300,"network":"eip155:8453","payTo":"0x9287e3102D411029025C7617d75245BFc7920f17","scheme":"exact"}],"description":"Lint a GitHub Actions workflow: actions not pinned to a commit SHA, missing or write-all permissions, pull_request_target with PR head checkout, script injection via event fields in run, secrets on the command line, curl|bash, self-hosted runners, deprecated set-output.","extensions":{"bazaar":{"info":{"input":{"body":{"content":"name: CI\non:\n  push:\n    branches: [main]\n  pull_request:\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 20\n      - run: npm ci\n      - run: npm test\n"},"bodyType":"json","method":"POST","type":"http"},"output":{"example":{"findings":[{"fix":"Add at top level: permissions: { contents: read }","id":"no_permissions","line":null,"severity":"medium","snippet":null,"why":"no top-level permissions: the GITHUB_TOKEN gets the repository default"},{"fix":"Pin to a full commit SHA","id":"unpinned_action","line":10,"severity":"medium","snippet":"- uses: actions/checkout@v4","why":"actions/checkout is referenced by a mutable tag/branch"}],"jobs":["test"],"kind":"github-actions","score":76,"summary":{"high":0,"low":0,"medium":3,"total":3},"triggers":["push","pull_request"]},"type":"json"}},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"body":{"properties":{"content":{"description":"Full text of the file (max 100 KB)","type":"string"}},"required":["content"]},"bodyType":{"enum":["json","form-data","text"],"type":"string"},"method":{"enum":["POST"],"type":"string"},"type":{"const":"http","type":"string"}},"required":["type","method","bodyType","body"],"type":"object"},"output":{"properties":{"example":{"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"}},"builder-code":{"info":{"s":["cdp_sdk_server"]},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","additionalProperties":false,"properties":{"a":{"description":"App builder code","pattern":"^[a-z0-9_]{1,32}$","type":"string"},"s":{"description":"Service builder codes","items":{"pattern":"^[a-z0-9_]{1,32}$","type":"string"},"maxItems":11,"type":"array"},"w":{"description":"Wallet builder code","pattern":"^[a-z0-9_]{1,32}$","type":"string"}},"type":"object"}},"eip2612GasSponsoring":{},"erc20ApprovalGasSponsoring":{}},"lastUpdated":"2026-10-26T11:48:56.125Z","quality":{"l30DaysTotalCalls":4,"l30DaysUniquePayers":2,"lastCalledAt":"2026-10-26T11:48:55.874Z"},"resource":"https://ciaudit.genexxis.com/github-actions","type":"http","x402Version":2},"source":"x402_bazaar","summary":"Lint a GitHub Actions workflow: actions not pinned to a commit SHA, missing or write-all permissions, pull_request_target with PR head checkout, script injection via event fields in run, secrets on the command line, curl|bash, self-hosted runners, deprecated set-output."},"body_sha256":"f701ddb33743aabff29e0b783f5015e5edd981d582e59a7d2da7cfcc9ab03dc4","prev_id":null,"leaf":"0x1abd7227e2e023ad10041c1ee5f9113d18226604df54f2954068e2a5722eaa3d","leaf_text":"{\"body\":\"f701ddb33743aabff29e0b783f5015e5edd981d582e59a7d2da7cfcc9ab03dc4\",\"id\":54312,\"kind\":\"listing\",\"method\":\"sync.x402_bazaar/1\",\"observed_us\":1793025431962598,\"prev\":null,\"subject\":\"x402_bazaar:https://ciaudit.genexxis.com/github-actions\",\"subject_kind\":\"source_record\"}","day":{"day":"2026-10-26","leaves":296695,"root":"0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8","chained":"0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a","anchor_chain":"eip155:5042002","anchor_tx":"0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae","anchor_block":69251483},"proof":["0x1abda6880a37e710eac33d1330c9ef7587185f4205c627a23c82be7217024020","0xca2c89e4f2ffbcf31ea12441dec15103ca4cc1f2c3fddb75efb9ef99cba286df","0xdc31aa4bec7c56136f69c8964c54ac3dd355ba8fcf2c6be6a5e956c550b0f4c6","0x7961a3f5271fc0c17b23e0f1c386cbdb51d4ebc01d8d1673d5e459a61b18c879","0xb02d83c86ae68ac1467a1faedf88fcf70c7e46e726617d76c04e7cb01ae5d286","0xe2d16662269ae2356854ee6b7ddea9087f4112666b1b322b85cc3fd9b3ddf2ff","0xb18a5356af0355b97d078f769f2409652d1b835cbe3301d395bfddc869e895a1","0x73d1a21c8738aa04f9f08c47c5961d84cd722167777b2b1de60ca605ddc418af","0x522761010ff0a51d7a93a23a2c36ff951f83ab5736b328badc7aa1e01f3d1a08","0xdd23b279d0847860786130eecc85f2b83d5c655bfd9ab282efff968c5d7bdc6d","0x6a51e1d524ffd968d6f505e10f76aacd4ae61fc223a88a38ef8820592653c75a","0x6a8a72430804a14ec575375f3d0ca4364f58310afb2c2e8c92b72f8b75809db9","0xe00c7829e46541e49a308807d357db902e06eff941a833217a8f0dbccd3964f1","0x770e4376196188c7fc9ec40f8e218dc0d1cb92bba5fe0425a0edce27ca9a997f","0x60582ab4b41e72eb70eb0bce07fbf0fb4d2b62a8bad5be50f5d16d511adc746c","0xc6a4d7899a0f442958e26505011190b7cff2483611c1b94eba9043e0ba9ac36e","0x8c756542e482157df0c36464d75c937b845e4423dbbcfad08f0cf8d5a16b9a13","0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d","0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a"]}