{ "x402Version": 2, "id": 34026, "slug": "34026", "resource": "https://api.zfinia.com/x402/v1/ci-workflow-contract-audit", "description": "Audit a CI workflow for what it leaves movable or undeclared. Reports actions pinned to a tag rather than a commit - a tag can be moved by whoever owns the action, so the code a step runs can change without this file changing - missing permissions and timeouts, a job depending on one that is not declared, a pull_request_target trigger, and an expression interpolated straight into a shell command.", "type": "http", "serviceName": "CI Workflow Audit", "resourceType": "Agent Service", "accepts": [ { "scheme": "exact", "network": "eip155:8453", "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "amount": "120000", "amountUsd": 0.12, "maxTimeoutSeconds": 60 } ], "outputSchema": { "properties": { "example": { "type": "object" }, "type": { "type": "string" } }, "required": [ "type" ], "type": "object" }, "extensions": { "bazaar": { "info": { "input": { "body": { "contract": { "required_jobs": [ "build", "publish", "lint" ] }, "workflow": { "jobs": { "build": { "runs-on": "ubuntu-latest", "steps": [ { "uses": "actions/checkout@v4" }, { "uses": "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8" }, { "name": "Greet", "run": "echo \"Building ${{ github.event.pull_request.title }}\"" }, { "run": "npm ci && npm test" } ] }, "notify": { "needs": [ "publish", "lint" ], "runs-on": "ubuntu-latest", "steps": [ { "run": "echo done" } ] }, "publish": { "needs": "build", "permissions": { "contents": "read", "packages": "write" }, "runs-on": "ubuntu-latest", "steps": [ { "uses": "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3" } ], "timeout-minutes": 15 } }, "name": "release", "on": { "pull_request_target": {}, "push": { "branches": [ "main" ] } } } }, "bodyType": "json", "method": "POST", "type": "http" }, "output": { "example": { "assumptions": [ "An action pinned to a 40-character commit hash is pinned; a tag or branch can be moved by whoever owns the action, so the code a step runs can change without this file changing.", "The on key is read from either on or true, because an unquoted on is a YAML boolean and survives conversion to JSON that way.", "Findings describe patterns in the document. Naming pull_request_target or an interpolated expression is reporting what the file says, not demonstrating an exploit." ], "complete": true, "conformant": false, "examined_job_count": 3, "finding_count": 10, "findings": [ { "code": "REQUIRED_JOB_MISSING", "detail": "lint is required and not declared.", "job": "lint" }, { "code": "PULL_REQUEST_TARGET_TRIGGER", "detail": "The workflow triggers on pull_request_target, which runs with repository write context against code from a fork. This reports the trigger, not an exploit." }, { "code": "WORKFLOW_PERMISSIONS_NOT_DECLARED", "detail": "The workflow declares no permissions block, so it inherits whatever the repository default is rather than stating what it needs." } ], "findings_by_code": { "ACTION_NOT_PINNED_TO_COMMIT": 1, "JOB_DEPENDENCY_NOT_DECLARED": 1, "JOB_PERMISSIONS_NOT_DECLARED": 2, "JOB_TIMEOUT_MISSING": 2, "PULL_REQUEST_TARGET_TRIGGER": 1, "REQUIRED_JOB_MISSING": 1, "UNTRUSTED_INTERPOLATION_IN_RUN": 1, "WORKFLOW_PERMISSIONS_NOT_DECLARED": 1 }, "job_count": 3, "jobs": [ { "job": "build", "needs": [], "permissions_declared": false, "runs_on": "ubuntu-latest", "steps": 4, "timeout_minutes": null, "unpinned_actions": [ "actions/checkout@v4" ] }, { "job": "publish", "needs": [ "build" ], "permissions_declared": true, "runs_on": "ubuntu-latest", "steps": 1, "timeout_minutes": 15, "unpinned_actions": [] }, { "job": "notify", "needs": [ "publish", "lint" ], "permissions_declared": false, "runs_on": "ubuntu-latest", "steps": 1, "timeout_minutes": null, "unpinned_actions": [] } ], "limitations": [ "Observable facts about the workflow supplied. Nothing is run, no action is fetched, and this is not a security assessment or a compliance determination.", "conformant is true only when every declared rule was evaluated and none failed." ], "limits": { "maxComponents": 5000, "maxDependencies": 5000, "maxFindings": 500, "maxJobs": 200, "maxResources": 2000, "maxServices": 200, "maxVariables": 1000 }, "not_examined": [], "observed_at": "2026-10-02T00:00:00.000Z", "passed": false, "request_id": "example-request", "service_id": "ci_workflow_contract_audit", "service_version": "1.0.0", "step_count": 6, "trigger_names": [ "push", "pull_request_target" ], "unpinned_action_count": 1, "workflow_permissions_declared": false }, "type": "json" } }, "schema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "input": { "additionalProperties": false, "properties": { "body": { "additionalProperties": false, "properties": { "contract": { "additionalProperties": false, "properties": { "forbid_pull_request_target": { "type": "boolean" }, "require_permissions": { "type": "boolean" }, "require_pinned_actions": { "type": "boolean" }, "require_timeout": { "type": "boolean" }, "required_jobs": { "items": { "maxLength": 128, "type": "string" }, "maxItems": 200, "minItems": 1, "type": "array" } }, "type": "object" }, "workflow": { "type": "object" } }, "required": [ "workflow" ], "type": "object" }, "bodyType": { "enum": [ "json", "form-data", "text" ], "type": "string" }, "method": { "enum": [ "POST" ], "type": "string" }, "type": { "const": "http", "type": "string" } }, "required": [ "type", "method", "bodyType", "body" ], "type": "object" }, "output": { "properties": { "example": { "type": "object" }, "type": { "type": "string" } }, "required": [ "type" ], "type": "object" } }, "required": [ "input" ], "type": "object" } } }, "tags": [ "configuration", "continuous integration", "supply chain hygiene", "linting", "developer tooling", "bazaar" ], "sourceHost": "api.zfinia.com", "lastUpdated": "2026-10-04T08:02:50.284Z", "quality": { "calls30d": 1, "uniquePayers30d": 1, "lastCalledAt": "2026-10-04T08:02:44.497Z" }, "metadata": { "serviceName": "CI Workflow Audit", "extensions": { "bazaar": { "info": { "input": { "body": { "contract": { "required_jobs": [ "build", "publish", "lint" ] }, "workflow": { "jobs": { "build": { "runs-on": "ubuntu-latest", "steps": [ { "uses": "actions/checkout@v4" }, { "uses": "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8" }, { "name": "Greet", "run": "echo \"Building ${{ github.event.pull_request.title }}\"" }, { "run": "npm ci && npm test" } ] }, "notify": { "needs": [ "publish", "lint" ], "runs-on": "ubuntu-latest", "steps": [ { "run": "echo done" } ] }, "publish": { "needs": "build", "permissions": { "contents": "read", "packages": "write" }, "runs-on": "ubuntu-latest", "steps": [ { "uses": "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3" } ], "timeout-minutes": 15 } }, "name": "release", "on": { "pull_request_target": {}, "push": { "branches": [ "main" ] } } } }, "bodyType": "json", "method": "POST", "type": "http" }, "output": { "example": { "assumptions": [ "An action pinned to a 40-character commit hash is pinned; a tag or branch can be moved by whoever owns the action, so the code a step runs can change without this file changing.", "The on key is read from either on or true, because an unquoted on is a YAML boolean and survives conversion to JSON that way.", "Findings describe patterns in the document. Naming pull_request_target or an interpolated expression is reporting what the file says, not demonstrating an exploit." ], "complete": true, "conformant": false, "examined_job_count": 3, "finding_count": 10, "findings": [ { "code": "REQUIRED_JOB_MISSING", "detail": "lint is required and not declared.", "job": "lint" }, { "code": "PULL_REQUEST_TARGET_TRIGGER", "detail": "The workflow triggers on pull_request_target, which runs with repository write context against code from a fork. This reports the trigger, not an exploit." }, { "code": "WORKFLOW_PERMISSIONS_NOT_DECLARED", "detail": "The workflow declares no permissions block, so it inherits whatever the repository default is rather than stating what it needs." } ], "findings_by_code": { "ACTION_NOT_PINNED_TO_COMMIT": 1, "JOB_DEPENDENCY_NOT_DECLARED": 1, "JOB_PERMISSIONS_NOT_DECLARED": 2, "JOB_TIMEOUT_MISSING": 2, "PULL_REQUEST_TARGET_TRIGGER": 1, "REQUIRED_JOB_MISSING": 1, "UNTRUSTED_INTERPOLATION_IN_RUN": 1, "WORKFLOW_PERMISSIONS_NOT_DECLARED": 1 }, "job_count": 3, "jobs": [ { "job": "build", "needs": [], "permissions_declared": false, "runs_on": "ubuntu-latest", "steps": 4, "timeout_minutes": null, "unpinned_actions": [ "actions/checkout@v4" ] }, { "job": "publish", "needs": [ "build" ], "permissions_declared": true, "runs_on": "ubuntu-latest", "steps": 1, "timeout_minutes": 15, "unpinned_actions": [] }, { "job": "notify", "needs": [ "publish", "lint" ], "permissions_declared": false, "runs_on": "ubuntu-latest", "steps": 1, "timeout_minutes": null, "unpinned_actions": [] } ], "limitations": [ "Observable facts about the workflow supplied. Nothing is run, no action is fetched, and this is not a security assessment or a compliance determination.", "conformant is true only when every declared rule was evaluated and none failed." ], "limits": { "maxComponents": 5000, "maxDependencies": 5000, "maxFindings": 500, "maxJobs": 200, "maxResources": 2000, "maxServices": 200, "maxVariables": 1000 }, "not_examined": [], "observed_at": "2026-10-02T00:00:00.000Z", "passed": false, "request_id": "example-request", "service_id": "ci_workflow_contract_audit", "service_version": "1.0.0", "step_count": 6, "trigger_names": [ "push", "pull_request_target" ], "unpinned_action_count": 1, "workflow_permissions_declared": false }, "type": "json" } }, "schema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "input": { "additionalProperties": false, "properties": { "body": { "additionalProperties": false, "properties": { "contract": { "additionalProperties": false, "properties": { "forbid_pull_request_target": { "type": "boolean" }, "require_permissions": { "type": "boolean" }, "require_pinned_actions": { "type": "boolean" }, "require_timeout": { "type": "boolean" }, "required_jobs": { "items": { "maxLength": 128, "type": "string" }, "maxItems": 200, "minItems": 1, "type": "array" } }, "type": "object" }, "workflow": { "type": "object" } }, "required": [ "workflow" ], "type": "object" }, "bodyType": { "enum": [ "json", "form-data", "text" ], "type": "string" }, "method": { "enum": [ "POST" ], "type": "string" }, "type": { "const": "http", "type": "string" } }, "required": [ "type", "method", "bodyType", "body" ], "type": "object" }, "output": { "properties": { "example": { "type": "object" }, "type": { "type": "string" } }, "required": [ "type" ], "type": "object" } }, "required": [ "input" ], "type": "object" } } } }, "liveness": { "reliability": null }, "verified": false, "featured": false, "provider": { "host": "api.zfinia.com", "manifest_name": "api.zfinia.com", "source": "cdp-mirror", "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources", "submitted_at": "2026-10-14T01:15:01.050Z" }, "exampleResponse": { "assumptions": [ "An action pinned to a 40-character commit hash is pinned; a tag or branch can be moved by whoever owns the action, so the code a step runs can change without this file changing.", "The on key is read from either on or true, because an unquoted on is a YAML boolean and survives conversion to JSON that way.", "Findings describe patterns in the document. Naming pull_request_target or an interpolated expression is reporting what the file says, not demonstrating an exploit." ], "complete": true, "conformant": false, "examined_job_count": 3, "finding_count": 10, "findings": [ { "code": "REQUIRED_JOB_MISSING", "detail": "lint is required and not declared.", "job": "lint" }, { "code": "PULL_REQUEST_TARGET_TRIGGER", "detail": "The workflow triggers on pull_request_target, which runs with repository write context against code from a fork. This reports the trigger, not an exploit." }, { "code": "WORKFLOW_PERMISSIONS_NOT_DECLARED", "detail": "The workflow declares no permissions block, so it inherits whatever the repository default is rather than stating what it needs." } ], "findings_by_code": { "ACTION_NOT_PINNED_TO_COMMIT": 1, "JOB_DEPENDENCY_NOT_DECLARED": 1, "JOB_PERMISSIONS_NOT_DECLARED": 2, "JOB_TIMEOUT_MISSING": 2, "PULL_REQUEST_TARGET_TRIGGER": 1, "REQUIRED_JOB_MISSING": 1, "UNTRUSTED_INTERPOLATION_IN_RUN": 1, "WORKFLOW_PERMISSIONS_NOT_DECLARED": 1 }, "job_count": 3, "jobs": [ { "job": "build", "needs": [], "permissions_declared": false, "runs_on": "ubuntu-latest", "steps": 4, "timeout_minutes": null, "unpinned_actions": [ "actions/checkout@v4" ] }, { "job": "publish", "needs": [ "build" ], "permissions_declared": true, "runs_on": "ubuntu-latest", "steps": 1, "timeout_minutes": 15, "unpinned_actions": [] }, { "job": "notify", "needs": [ "publish", "lint" ], "permissions_declared": false, "runs_on": "ubuntu-latest", "steps": 1, "timeout_minutes": null, "unpinned_actions": [] } ], "limitations": [ "Observable facts about the workflow supplied. Nothing is run, no action is fetched, and this is not a security assessment or a compliance determination.", "conformant is true only when every declared rule was evaluated and none failed." ], "limits": { "maxComponents": 5000, "maxDependencies": 5000, "maxFindings": 500, "maxJobs": 200, "maxResources": 2000, "maxServices": 200, "maxVariables": 1000 }, "not_examined": [], "observed_at": "2026-10-02T00:00:00.000Z", "passed": false, "request_id": "example-request", "service_id": "ci_workflow_contract_audit", "service_version": "1.0.0", "step_count": 6, "trigger_names": [ "push", "pull_request_target" ], "unpinned_action_count": 1, "workflow_permissions_declared": false } }