pr verdict derived

{
  "input": {
    "body": {
      "pr_url": "https://github.com/gitpython-developers/GitPython/pull/1901"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "pr": {
        "repo": "widget",
        "owner": "acme",
        "title": "Add uploader",
        "number": 42,
        "head_sha": "d34db33f…"
      },
      "object": "pr_verdict",
      "verdict": "block",
      "coverage": {
        "source": "diff",
        "truncated": false,
        "files_total": 6,
        "files_scanned": 6,
        "skipped_files": [],
        "dimensions_run": [
          "code",
          "secret",
          "ci"
        ],
        "graph_rules_ran": true,
        "dimensions_partial": []
      },
      "findings": [
        {
          "line": 12,
          "path": "src/upload.py",
          "reason": "A hardcoded AWS access key appears in an added line.",
          "rule_id": "aws.akia",
          "evidence": "AWS_KEY = \"AKIA…4E7Q\"",
          "fix_hint": "Remove the hardcoded AWS credential, rotate it, and load it from a secret manager / environment variable.",
          "provider": "secretscan",
          "severity": "high",
          "dimension": "secret"
        },
        {
          "line": null,
          "path": ".github/workflows/ci.yml",
          "reason": "Third-party action pinned to a mutable tag, not a commit SHA.",
          "rule_id": "gha.unpinned_uses",
          "evidence": "uses: actions/checkout@v4",
          "fix_hint": "Pin to the full 40-char commit SHA.",
          "provider": "cicdscan",
          "severity": "high",
          "dimension": "ci"
        }
      ],
      "disclaimer": "Automated merge-risk indicators — security signals, not a guarantee.",
      "risk_score": 80,
      "ruleset_versions": {
        "ci": "2026.07.24",
        "code": "2026.07.16",
        "secret": "2026.07.16"
      },
      "counts_by_severity": {
        "high": 2,
        "medium": 1
      },
      "findings_truncated": false,
      "counts_by_dimension": {
        "ci": 1,
        "code": 1,
        "secret": 1
      }
    }
  }
}