{"api":"v1","generated_at":"2026-10-10T14:28:45.382Z","licence":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/","attribution":"TOLL, with a link to the page cited"},"page":"https://tollindex.com/e/aayatai-com-github-action-54d8c8","pinned_page":"https://tollindex.com/e/aayatai-com-github-action-54d8c8/at/2026-10-10T12-29Z","pinned":false,"method":"https://tollindex.com/ledger/method","snapshot_at":"2026-10-10T12:29:27.643Z","snapshot_stamp":"2026-10-10T12-29Z","endpoint":{"slug":"aayatai-com-github-action-54d8c8","canonical_url":"https://aayatai.com/github/action","resource":"https://aayatai.com/github/action","http_method":"GET","type":"http","x402_version":2,"registries":["cdp"],"primary_registry":"cdp","curated_by_coinbase":false,"description":"Is this GitHub Action safe for your workflow? Pass what follows uses: (e.g. tj-actions/changed-files@v45). Checks known advisories and compromises (OSV), SHA vs tag vs branch pinning, deprecated Node runtimes, unpinned Docker images and nested actions in action.yml, publisher and repository health. Verdict, score and fixes.","service_name":"Aayat AI","declared_category":null,"declared_tags":["github-actions","ci","security","supply-chain","coding"],"route_template":null,"registry_updated":"2026-10-08T06:12:00.238Z"},"derived":{"note":"fields no registry supplies; TOLL derives them and marks them derived on the page","title":"github action","category":"storage","first_observed_by_toll":"2026-09-28T13:51:25.436Z","last_observed_by_toll":"2026-10-10T12:29:27.642Z","observation_began":"2026-09-10"},"presence":{"listed_now":true,"first_absent_at":null,"delisting_confirmed_at":null,"events":[{"registry":"cdp","at":"2026-09-28T13:51:25.437Z","event":"listed"}]},"accepts":[{"registry":"cdp","ordinal":0,"network":"eip155:8453","asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","asset_name":"USD Coin","symbol":"USDC","decimals":6,"amount_display":"0.005 USDC","amount_units":0.005,"decimals_known":true,"pay_to":"0xbA7d7DcA32B3659DbAB451E5b408FF8F23F13442","scheme":"exact"},{"registry":"cdp","ordinal":1,"network":"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp","asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","asset_name":null,"symbol":"USDC","decimals":6,"amount_display":"0.005 USDC","amount_units":0.005,"decimals_known":true,"pay_to":"Byc8ebwdxxB4u4U9xuMnH9HwwKTV4JYAFLeU1jNCCT4Q","scheme":"exact"},{"registry":"cdp","ordinal":2,"network":"eip155:137","asset":"0x3c499c542cef5e3811e1192ce70d8cc03d5c3359","asset_name":"USD Coin","symbol":"USDC","decimals":6,"amount_display":"0.005 USDC","amount_units":0.005,"decimals_known":true,"pay_to":"0xbA7d7DcA32B3659DbAB451E5b408FF8F23F13442","scheme":"exact"},{"registry":"cdp","ordinal":3,"network":"eip155:42161","asset":"0xaf88d065e77c8cc2239327c5edb3a432268e5831","asset_name":"USD Coin","symbol":"USDC","decimals":6,"amount_display":"0.005 USDC","amount_units":0.005,"decimals_known":true,"pay_to":"0xbA7d7DcA32B3659DbAB451E5b408FF8F23F13442","scheme":"exact"}],"counters":{"observed_at":"2026-10-10T12:29:27.643Z","calls_30d":3,"unique_payers_30d":3,"last_called_at":"2026-10-08T06:12:00.095Z"},"validation":{"latest":{"observed_at":"2026-10-09T07:05:12.216Z","state":"pass","failed_checks":[],"endpoint_http_status":402,"run_id":"daily-2026-10-09"},"uptime":[{"days":7,"observed":6,"passed":6,"ratio":1},{"days":30,"observed":13,"passed":12,"ratio":0.9230769230769231},{"days":90,"observed":13,"passed":12,"ratio":0.9230769230769231}],"history_90d":[{"observed_at":"2026-10-09T07:05:12.216Z","state":"pass","failed_checks":[],"run_id":"daily-2026-10-09","state_changed":false},{"observed_at":"2026-10-08T08:35:05.458Z","state":"pass","failed_checks":[],"run_id":"daily-2026-10-08","state_changed":false},{"observed_at":"2026-10-07T07:50:01.576Z","state":"pass","failed_checks":[],"run_id":"daily-2026-10-07","state_changed":false},{"observed_at":"2026-10-06T08:41:30.758Z","state":"pass","failed_checks":[],"run_id":"daily-2026-10-06","state_changed":false},{"observed_at":"2026-10-05T07:52:35.982Z","state":"pass","failed_checks":[],"run_id":"daily-2026-10-05","state_changed":false},{"observed_at":"2026-10-04T10:26:55.977Z","state":"pass","failed_checks":[],"run_id":"daily-2026-10-04","state_changed":false},{"observed_at":"2026-10-03T05:24:09.508Z","state":"pass","failed_checks":[],"run_id":"daily-2026-10-03","state_changed":false},{"observed_at":"2026-10-02T14:37:30.474Z","state":"pass","failed_checks":[],"run_id":"daily-2026-10-02","state_changed":false},{"observed_at":"2026-10-01T07:34:06.564Z","state":"pass","failed_checks":[],"run_id":"daily-2026-10-01","state_changed":false},{"observed_at":"2026-09-30T06:51:56.370Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-30","state_changed":false},{"observed_at":"2026-09-29T19:10:44.386Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-29","state_changed":true},{"observed_at":"2026-09-28T16:56:16.723Z","state":"fail","failed_checks":["endpoint_reachable"],"run_id":"daily-2026-09-28","state_changed":true},{"observed_at":"2026-09-28T16:42:10.399Z","state":"pass","failed_checks":[],"run_id":"new-after-daily-2026-09-28","state_changed":true}]},"seller":{"wallet":"0xbA7d7DcA32B3659DbAB451E5b408FF8F23F13442","page":"https://tollindex.com/seller/0xbA7d7DcA32B3659DbAB451E5b408FF8F23F13442","endpoints":102,"hosts":1},"reports":0,"registry_record":{"cdp":[{"tags":["github-actions","ci","security","supply-chain","coding"],"type":"http","accepts":[{"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","version":"2"},"payTo":"0xbA7d7DcA32B3659DbAB451E5b408FF8F23F13442","amount":"5000","scheme":"exact","network":"eip155:8453","maxTimeoutSeconds":60},{"asset":"EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v","extra":{"feePayer":"D6ZhtNQ5nT9ZnTHUbqXZsTx5MH2rPFiBBggX4hY1WePM"},"payTo":"Byc8ebwdxxB4u4U9xuMnH9HwwKTV4JYAFLeU1jNCCT4Q","amount":"5000","scheme":"exact","network":"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp","maxTimeoutSeconds":60},{"asset":"0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359","extra":{"name":"USD Coin","version":"2"},"payTo":"0xbA7d7DcA32B3659DbAB451E5b408FF8F23F13442","amount":"5000","scheme":"exact","network":"eip155:137","maxTimeoutSeconds":60},{"asset":"0xaf88d065e77c8cC2239327C5EDb3A432268e5831","extra":{"name":"USD Coin","version":"2"},"payTo":"0xbA7d7DcA32B3659DbAB451E5b408FF8F23F13442","amount":"5000","scheme":"exact","network":"eip155:42161","maxTimeoutSeconds":60}],"quality":{"lastCalledAt":"2026-10-08T06:12:00.095Z","l30DaysTotalCalls":3,"l30DaysUniquePayers":3},"resource":"https://aayatai.com/github/action","extensions":{"bazaar":{"info":{"input":{"type":"http","method":"GET","queryParams":{"uses":"tj-actions/changed-files@v45.0.7"}},"output":{"type":"json","example":{"pin":"version-tag","ref":"v45.0.7","flags":[{"code":"vulnerable","level":"danger","message":"1 advisory(ies) affect v45.0.7: tj-actions/changed-files has a malicious commit. Upgrade to 46.0.1."}],"score":30,"action":"tj-actions/changed-files","runtime":{"image":null,"using":"composite","actionYml":"https://raw.githubusercontent.com/tj-actions/changed-files/v45.0.7/action.yml","nestedUses":[]},"sources":["OSV.dev (GitHub Actions advisories)","action.yml via raw.githubusercontent.com","GitHub REST"],"verdict":"avoid","checkedAt":"2026-09-28T12:00:00.000Z","publisher":"third-party","advisories":[{"id":"GHSA-mrrh-fwg8-r2c3","url":"https://osv.dev/vulnerability/GHSA-mrrh-fwg8-r2c3","aliases":["CVE-2025-30066"],"fixedIn":["46.0.1"],"summary":"tj-actions/changed-files has a malicious commit","severity":"high","published":"2025-03-15T00:00:00Z","affectsThisRef":"yes"}],"repository":{"url":"https://github.com/tj-actions/changed-files","stars":2600,"verdict":"healthy","archived":false,"lastPushAt":"2026-09-20T00:00:00Z","latestRelease":{"tag":"v47.0.0","publishedAt":"2026-09-01T00:00:00Z"}}}}},"schema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["uses"],"properties":{"uses":{"type":"string","maxLength":250,"minLength":5,"description":"The action reference, e.g. actions/checkout@v4 or owner/repo/sub@<40-char sha>."}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["action","ref","pin","verdict","score","flags","advisories"],"properties":{"pin":{"enum":["sha","version-tag","major-tag","branch","other"],"type":"string"},"ref":{"type":"string"},"flags":{"type":"array","items":{"type":"object"}},"score":{"type":"integer"},"trust":{"type":"object","description":"Third-party text, cleaned: read trust.notice; removed = what we stripped."},"action":{"type":"string"},"runtime":{"type":["object","null"]},"sources":{"type":"array","items":{"type":"string"}},"verdict":{"enum":["ok","caution","avoid"],"type":"string"},"checkedAt":{"type":"string"},"publisher":{"enum":["well-known","third-party"],"type":"string"},"advisories":{"type":"array","items":{"type":"object"},"description":"OSV advisories for the action with affectsThisRef: yes / maybe / no / unknown."},"repository":{"type":["object","null"]}}}}}}}}},"description":"Is this GitHub Action safe for your workflow? Pass what follows uses: (e.g. tj-actions/changed-files@v45). Checks known advisories and compromises (OSV), SHA vs tag vs branch pinning, deprecated Node runtimes, unpinned Docker images and nested actions in action.yml, publisher and repository health. Verdict, score and fixes.","lastUpdated":"2026-10-08T06:12:00.238Z","serviceName":"Aayat AI","x402Version":2}]}}