ci scan derived

{
  "input": {
    "body": {
      "format": "github-actions",
      "content": "name: ci\non: pull_request_target\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n    - uses: actions/checkout@v4\n      with:\n        ref: ${{ github.event.pull_request.head.ref }}\n    - run: echo \"${{ github.event.issue.title }}\"\n"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "format": "github-actions",
      "object": "ci_config",
      "verdict": "block",
      "coverage": {
        "rules_total": 27,
        "objects_by_kind": {
          "job": 1,
          "step": 2,
          "workflow": 1
        },
        "objects_scanned": 4,
        "dimensions_flagged": [
          "injection",
          "triggers"
        ]
      },
      "findings": [
        {
          "path": "jobs.build.steps[1]",
          "reason": "An attacker-controllable expression is expanded inside a run: script — arbitrary code execution on the runner.",
          "rule_id": "gha.template_injection",
          "evidence": "${{ github.event.issue.title }}",
          "fix_hint": "Bind it to an env var and quote the shell reference.",
          "provider": "github-actions",
          "resource": "build.step1",
          "severity": "critical",
          "dimension": "injection"
        }
      ],
      "disclaimer": "Automated security indicators, not a guarantee.",
      "risk_score": 100,
      "config_hash": "sha256:…",
      "object_count": 4,
      "ruleset_version": "2026.07.24",
      "counts_by_severity": {
        "high": 1,
        "critical": 2
      }
    }
  }
}