{"id":71002,"recorded_at":"2026-10-26T14:38:01.282255Z","observed_at":"2026-10-26T14:38:01.282209Z","subject_kind":"source_record","subject":"x402_bazaar:https://api.zfinia.com/x402/v1/ci-workflow-contract-audit","kind":"listing","method":"baseline/1","body":{"endpoints":[["x402","https://api.zfinia.com/x402/v1/ci-workflow-contract-audit"]],"name":"CI Workflow Audit","owner_address":"0x25e8245f07d5e4873987293dad666afbe56a9608","raw":{"accepts":[{"amount":"120000","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","version":"2"},"maxTimeoutSeconds":60,"network":"eip155:8453","payTo":"0x25e8245f07d5e4873987293dad666afbe56a9608","scheme":"exact"}],"description":"Audit a CI workflow for what it leaves movable or undeclared. Reports actions pinned to a tag rather than a commit - a tag can be moved by whoever owns the action, so the code a step runs can change without this file changing - missing permissions and timeouts, a job depending on one that is not declared, a pull_request_target trigger, and an expression interpolated straight into a shell command.","extensions":{"bazaar":{"info":{"input":{"body":{"contract":{"required_jobs":["build","publish","lint"]},"workflow":{"jobs":{"build":{"runs-on":"ubuntu-latest","steps":[{"uses":"actions/checkout@v4"},{"uses":"actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"},{"name":"Greet","run":"echo \"Building ${{ github.event.pull_request.title }}\""},{"run":"npm ci && npm test"}]},"notify":{"needs":["publish","lint"],"runs-on":"ubuntu-latest","steps":[{"run":"echo done"}]},"publish":{"needs":"build","permissions":{"contents":"read","packages":"write"},"runs-on":"ubuntu-latest","steps":[{"uses":"actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"}],"timeout-minutes":15}},"name":"release","on":{"pull_request_target":{},"push":{"branches":["main"]}}}},"bodyType":"json","method":"POST","type":"http"},"output":{"example":{"assumptions":["An action pinned to a 40-character commit hash is pinned; a tag or branch can be moved by whoever owns the action, so the code a step runs can change without this file changing.","The on key is read from either on or true, because an unquoted on is a YAML boolean and survives conversion to JSON that way.","Findings describe patterns in the document. Naming pull_request_target or an interpolated expression is reporting what the file says, not demonstrating an exploit."],"complete":true,"conformant":false,"examined_job_count":3,"finding_count":10,"findings":[{"code":"REQUIRED_JOB_MISSING","detail":"lint is required and not declared.","job":"lint"},{"code":"PULL_REQUEST_TARGET_TRIGGER","detail":"The workflow triggers on pull_request_target, which runs with repository write context against code from a fork. This reports the trigger, not an exploit."},{"code":"WORKFLOW_PERMISSIONS_NOT_DECLARED","detail":"The workflow declares no permissions block, so it inherits whatever the repository default is rather than stating what it needs."}],"findings_by_code":{"ACTION_NOT_PINNED_TO_COMMIT":1,"JOB_DEPENDENCY_NOT_DECLARED":1,"JOB_PERMISSIONS_NOT_DECLARED":2,"JOB_TIMEOUT_MISSING":2,"PULL_REQUEST_TARGET_TRIGGER":1,"REQUIRED_JOB_MISSING":1,"UNTRUSTED_INTERPOLATION_IN_RUN":1,"WORKFLOW_PERMISSIONS_NOT_DECLARED":1},"job_count":3,"jobs":[{"job":"build","needs":[],"permissions_declared":false,"runs_on":"ubuntu-latest","steps":4,"timeout_minutes":null,"unpinned_actions":["actions/checkout@v4"]},{"job":"publish","needs":["build"],"permissions_declared":true,"runs_on":"ubuntu-latest","steps":1,"timeout_minutes":15,"unpinned_actions":[]},{"job":"notify","needs":["publish","lint"],"permissions_declared":false,"runs_on":"ubuntu-latest","steps":1,"timeout_minutes":null,"unpinned_actions":[]}],"limitations":["Observable facts about the workflow supplied. Nothing is run, no action is fetched, and this is not a security assessment or a compliance determination.","conformant is true only when every declared rule was evaluated and none failed."],"limits":{"maxComponents":5000,"maxDependencies":5000,"maxFindings":500,"maxJobs":200,"maxResources":2000,"maxServices":200,"maxVariables":1000},"not_examined":[],"observed_at":"2026-10-02T00:00:00.000Z","passed":false,"request_id":"example-request","service_id":"ci_workflow_contract_audit","service_version":"1.0.0","step_count":6,"trigger_names":["push","pull_request_target"],"unpinned_action_count":1,"workflow_permissions_declared":false},"type":"json"}},"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"body":{"additionalProperties":false,"properties":{"contract":{"additionalProperties":false,"properties":{"forbid_pull_request_target":{"type":"boolean"},"require_permissions":{"type":"boolean"},"require_pinned_actions":{"type":"boolean"},"require_timeout":{"type":"boolean"},"required_jobs":{"items":{"maxLength":128,"type":"string"},"maxItems":200,"minItems":1,"type":"array"}},"type":"object"},"workflow":{"type":"object"}},"required":["workflow"],"type":"object"},"bodyType":{"enum":["json","form-data","text"],"type":"string"},"method":{"enum":["POST"],"type":"string"},"type":{"const":"http","type":"string"}},"required":["type","method","bodyType","body"],"type":"object"},"output":{"properties":{"example":{"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"}}},"lastUpdated":"2026-10-04T08:02:50.284Z","quality":{"l30DaysTotalCalls":1,"l30DaysUniquePayers":1,"lastCalledAt":"2026-10-04T08:02:44.497Z"},"resource":"https://api.zfinia.com/x402/v1/ci-workflow-contract-audit","serviceName":"CI Workflow Audit","tags":["configuration","continuous integration","supply chain hygiene","linting","developer tooling"],"type":"http","x402Version":2},"source":"x402_bazaar","summary":"Audit a CI workflow for what it leaves movable or undeclared. Reports actions pinned to a tag rather than a commit - a tag can be moved by whoever owns the action, so the code a step runs can change without this file changing - missing permissions and timeouts, a job depending on one that is not declared, a pull_request_target trigger, and an expression interpolated straight into a shell command."},"body_sha256":"6027751ce1fcce3d01e6b530a2bd8af86fc319c9e326c0c925e29f89a18ab072","prev_id":null,"leaf":"0x585422e46abadddf1a636081809f0fc01bee5ac351f34d78532130faeaa1cbb1","leaf_text":"{\"body\":\"6027751ce1fcce3d01e6b530a2bd8af86fc319c9e326c0c925e29f89a18ab072\",\"id\":71002,\"kind\":\"listing\",\"method\":\"baseline/1\",\"observed_us\":1793025481282209,\"prev\":null,\"subject\":\"x402_bazaar:https://api.zfinia.com/x402/v1/ci-workflow-contract-audit\",\"subject_kind\":\"source_record\"}","day":{"day":"2026-10-26","leaves":296695,"root":"0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8","chained":"0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a","anchor_chain":"eip155:5042002","anchor_tx":"0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae","anchor_block":69251483},"proof":["0x5853f4cd837fc1fb3fa5ce81c95aee27f47c707afaa07f449dfcdde42cd0b685","0x254b2a022f387ccd8c8ba93d4deee4fa0dd5c49160eaf8f90a6bd7956864dca0","0x8b51a1b549351259595d27a224f883c336b15f145950ab7887ec7f5089c67eab","0x6a0202d971255faca2fe092859f015763a5176b8f56ffc615444463735e05e78","0x8afc9e11f872cf125571192a3b4b611dc60c853ea44557c7f60f238e06c3db35","0x313d746fd3881420637888a5fc494eb9d2188e317e6c45870ed23a1169522bcb","0xfe08efe49a92c6bd481d35c8823dc3521e4ad8e886c0623b263c2f1a3c0579bf","0xb26a1a385e095510486747e9254026fd1b20d851df6a83d6887d8ead14dfbbc3","0xeec474b2166d79d6d85e43fb077ac5f387533bb4b90b1ed81c0d404104bc545a","0x7ae162dcc3142c20e9800f624edcd459f9a47b7db25601e5e24164992c46399a","0x86f49d35fee840c62060e3a6cbc75237dbfdc70dd7439506d3f085c9cca8e4f2","0x01ecb94c2efbfb8e9050ebbd813fbba80bbcbc345f98de707345bc4bc88c94e8","0x8ba3430866b4c11cea7eba9923ee4fa8a5074849df417006e4441426c1f13056","0x5cdeb4648502e0633d01cc4f3379d48cccb9d4f528565b2868eb93db0df9e829","0x7726154b91b2ad65b13849ef6cb6443b1f0ff113a3089c9bd5f2bcfc16be099d","0x47b89901b0f07938a6b9a66ddf35683903f79d756a7c7763665fd632758b08d0","0x9a83be955a206deb65b995adfd92c58fa31c95fbbf926bd199d300e70b08b26d","0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d","0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a"]}