action.yaml:32: code injection via template expansion: may expand into attacker-controllable code

action.yaml:31: code injection via template expansion: may expand into attacker-controllable code

action.yaml:47: code injection via template expansion: may expand into attacker-controllable code

action.yaml:38: dangerous use of environment file: write to GITHUB_PATH may allow code execution

action.yaml:44: code injection via template expansion: may expand into attacker-controllable code

action.yaml:44: code injection via template expansion: may expand into attacker-controllable code

action.yaml:44: code injection via template expansion: may expand into attacker-controllable code

action.yaml:44: code injection via template expansion: may expand into attacker-controllable code

action.yaml:44: code injection via template expansion: may expand into attacker-controllable code

action.yml:19: dangerous use of environment file: write to GITHUB_ENV may allow code execution

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

branch-suggestion.yml:26: action's hash pin has mismatched or missing version comment: points to commit 11d5960a3267

branch-suggestion.yml:28: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false

branch-suggestion.yml:24: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false

action.yaml:17: action's hash pin has mismatched or missing version comment: points to commit 11d5960a3267

action.yaml:17: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false

action.yml:22: action's hash pin has mismatched or missing version comment: points to commit 03f1aad4c6c7

action.yml:15: action's hash pin has mismatched or missing version comment: points to commit 7474bc4690e2

action.yml:22: action's hash pin has mismatched or missing version comment: points to commit 11d5960a3267

action.yml:45: code injection via template expansion: may expand into attacker-controllable code

action.yml:21: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false

No file matched to [/home/runner/work/github-actions/github-actions/**/*requirements*.txt,/home/runner/work/github-actions/github-actions/**/*requirements*.in,/home/runner/work/github-actions/github-actions/**/*constraints*.txt,/home/runner/work/github-actions/github-actions/**/*constraints*.in,/home/runner/work/github-actions/github-actions/**/pyproject.toml,/home/runner/work/github-actions/github-actions/**/uv.lock,/home/runner/work/github-actions/github-actions/**/*.py.lock]. The cache will never get invalidated. Make sure you have checked out the target repository and configured the cache-dependency-glob input correctly.

release-tyk-analytics.yml:463: code injection via template expansion: may expand into attacker-controllable code

release-tyk-analytics.yml:383: code injection via template expansion: may expand into attacker-controllable code

release-tyk-analytics.yml:306: code injection via template expansion: may expand into attacker-controllable code

release-tyk-analytics.yml:206: code injection via template expansion: may expand into attacker-controllable code

release-bot.yaml:348: code injection via template expansion: may expand into attacker-controllable code

release-bot.yaml:340: code injection via template expansion: may expand into attacker-controllable code

release-bot.yaml:338: code injection via template expansion: may expand into attacker-controllable code

release-bot.yaml:337: code injection via template expansion: may expand into attacker-controllable code

release-bot.yaml:145: code injection via template expansion: may expand into attacker-controllable code