All pull requests

Pull requests

• fix(untrusted-checkout): account for checkout's fork-PR protection and its opt-out

  #673·sushant-me opened Oct 29, 2026Contributor·

  ·
  1

  8

• fix(permissions): accept vulnerability-alerts, and reject write for it

  #672·sushant-me opened Oct 28, 2026Contributor·

  ·
  1

  6

• fix(ai-action-unsafe-sandbox): read codex-action's sandbox and permission-profile inputs

  #671·sushant-me opened Oct 28, 2026Contributor·

  ·
  1

  1

• fix(ai-action-excessive-tools): read only --allowedTools grants, not --disallowedTools

  #669·sushant-me opened Oct 28, 2026Contributor·

  ·
  3

• fix(ai-action-unsafe-sandbox): match --dangerously-skip-permissions, the flag Claude Code accepts

  #668·sushant-me opened Oct 28, 2026Contributor·

  ·
  1

  8

• chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0

  dependenciesgithub_actions
  #667·dependabot[bot] opened Oct 15, 2026Bot·

  ·
  1

• chore(deps): bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0

  dependenciesgithub_actions
  #666·dependabot[bot] opened Oct 15, 2026Bot·

  ·
  1

• chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2

  dependenciesgithub_actions
  #665·dependabot[bot] opened Oct 15, 2026Bot·

  ·
  1

• chore(deps): bump golang.org/x/sys from 0.48.0 to 0.49.0

  dependenciesgo
  #664·dependabot[bot] opened Oct 15, 2026Bot·

  ·
  1

• chore(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0

  dependenciesgo
  #663·dependabot[bot] opened Oct 15, 2026Bot·

  ·
  1

• chore(deps): bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16

  dependenciesgo
  #662·dependabot[bot] opened Oct 15, 2026Bot·

  ·
  1

• fix(expressions): strip string-literal delimiters from an index used as a property name

  #659·sushant-me opened Oct 11, 2026Contributor·

  ·
  1

  4

• fix(dangerous-triggers): score mitigations per job, not across the workflow

  #657·sushant-me opened Oct 11, 2026Contributor·

  ·
  1

  1

• fix(dependabot-ecosystem): report commented-out package-ecosystem entries at info level

  #638·sisakuintel-agent[bot] opened Sep 1, 2026Bot·

  ·

• fix(deprecated-node-runtime): cover softprops/action-gh-release and goreleaser-action in node24 fallback table

  #637·sisakuintel-agent[bot] opened Sep 1, 2026Bot·

  ·

• feat(deprecated-node-runtime): cover jdx/mise-action in offline fallback table

  #632·sisakuintel-agent[bot] opened Aug 29, 2026Bot·

  ·

• fix(deprecated-node-runtime): add 5 first-party actions to node24 fallback table

  #631·sisakuintel-agent[bot] opened Aug 29, 2026Bot·

  ·

• untrusted-checkout: detect git/gh-based PR head checkouts in run scripts

  #628·sisakuintel-agent[bot] opened Aug 28, 2026Bot·

  ·

• fix(code-injection): stop flagging no-split contexts; dedupe reports

  #627·sisakuintel-agent[bot] opened Aug 28, 2026Bot·

  ·

• fix: accept 'deployment' key in job environment section

  #626·sisakuintel-agent[bot] opened Aug 27, 2026Bot·

  ·

• fix(secret-exfiltration): allowlist official Gitee API endpoint

  #625·sisakuintel-agent[bot] opened Aug 27, 2026Bot·

  ·

• fix(deprecated-node-runtime): cover softprops/action-gh-release in offline fallback

  #624·sisakuintel-agent[bot] opened Aug 27, 2026Bot·

  ·

• fix(secret-in-log): don't flag secrets piped into stdin data consumers

  #621·sisakuintel-agent[bot] opened Aug 26, 2026Bot·

  ·

• fix(dependabot-ecosystem): require evidence before flagging setup actions

  #614·sisakuintel-agent[bot] opened Aug 23, 2026Bot·2 tasks done·

  ·
  1

• fix(secret-exfiltration): trust destinations derived entirely from secrets

  #609·sisakuintel-agent[bot] opened Aug 21, 2026Bot·

  ·