github-actions[bot]
published Jun 23, 2026, 9:51 PM · updated Jun 23, 2026, 9:51 PM
Daily Runtime Threat Scan
Runtime threat scan complete — focus area: setup-cli/. All 3 independent judges returned clean. Files scanned: action.yml, install.sh, install_test.sh. All network calls are scoped to github.com/api.github.com only; REPO is hardcoded; GH_TOKEN is used only by the gh CLI; SHA256 checksum verification is enforced by default. No hidden files, binary blobs, obfuscated code, exfiltration, or persistence mechanisms found. One functional bug noted (output key mismatch installed-version vs installed_version) but not a security issue. State updated: next scan will cover setup/ (focus_index=0).
Generated from Daily Runtime Threat Scan · 211.3 AIC · ⊞ 36.4K · ◷