Restructure into a cargo workspace and refresh GitHub Actions - #2
2 findings
Reviewed 0 files; 0 findings. 25 files could not be reviewed: .github/workflows/release.yml, .github/workflows/ci.yml, AGENTS.md, Cargo.toml, crates/template-bus/Cargo.toml, crates/template/Cargo.toml, .claude/settings.json, .github/scripts/check-file-coverage.sh, crates/template-bus/src/greeting/mod.rs, crates/template-bus/src/greeting/types.rs, crates/template-bus/src/lib.rs, crates/template-bus/src/names/mod.rs, crates/template-bus/src/version/mod.rs, crates/template/examples/basic.rs, crates/template/examples/verify_github_release.rs, crates/template/examples/verify_module.rs, crates/template/src/greeting/mod.rs, crates/template/src/lib.rs, crates/template/src/tinybus_module/mod.rs, deny.toml, crates/template-bus/src/greeting/test.rs, crates/template-bus/src/names/test.rs, crates/template-bus/src/version/test.rs, crates/template/src/tinybus_module/test.rs, crates/template/tests/public_api.rs. 8 files were not security-reviewed: MODULE.md (prose or tabular data), README.md (prose or tabular data), crates/template-bus/README.md (prose or tabular data), crates/template/src/tinybus_module/README.md (prose or tabular data), docs/plans/example-retry-policy.md (prose or tabular data), and 3 more.
| Finding | Where | |
|---|---|---|
taiki-e/install-action is pinned to v2, which is mutable |
.github/workflows/ci.yml:35 |
|
taiki-e/install-action is pinned to v2, which is mutable |
.github/workflows/release.yml:48 |
 `taiki-e/install-action` is pinned to `v2`, which is mutable
[RULE] unpinned-action
A tag or branch can be repointed by whoever owns taiki-e, and the new code runs with this workflow's secrets. Pin to a full commit SHA and let Dependabot bump it.
 `taiki-e/install-action` is pinned to `v2`, which is mutable
.github/workflows/release.yml:48
[RULE] unpinned-action
A tag or branch can be repointed by whoever owns taiki-e, and the new code runs with this workflow's secrets. Pin to a full commit SHA and let Dependabot bump it.