ci workflow contract audit derived

{
  "input": {
    "body": {
      "contract": {
        "required_jobs": [
          "build",
          "publish",
          "lint"
        ]
      },
      "workflow": {
        "on": {
          "push": {
            "branches": [
              "main"
            ]
          },
          "pull_request_target": {}
        },
        "jobs": {
          "build": {
            "steps": [
              {
                "uses": "actions/checkout@v4"
              },
              {
                "uses": "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"
              },
              {
                "run": "echo \"Building ${{ github.event.pull_request.title }}\"",
                "name": "Greet"
              },
              {
                "run": "npm ci && npm test"
              }
            ],
            "runs-on": "ubuntu-latest"
          },
          "notify": {
            "needs": [
              "publish",
              "lint"
            ],
            "steps": [
              {
                "run": "echo done"
              }
            ],
            "runs-on": "ubuntu-latest"
          },
          "publish": {
            "needs": "build",
            "steps": [
              {
                "uses": "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"
              }
            ],
            "runs-on": "ubuntu-latest",
            "permissions": {
              "contents": "read",
              "packages": "write"
            },
            "timeout-minutes": 15
          }
        },
        "name": "release"
      }
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "jobs": [
        {
          "job": "build",
          "needs": [],
          "steps": 4,
          "runs_on": "ubuntu-latest",
          "timeout_minutes": null,
          "unpinned_actions": [
            "actions/checkout@v4"
          ],
          "permissions_declared": false
        },
        {
          "job": "publish",
          "needs": [
            "build"
          ],
          "steps": 1,
          "runs_on": "ubuntu-latest",
          "timeout_minutes": 15,
          "unpinned_actions": [],
          "permissions_declared": true
        },
        {
          "job": "notify",
          "needs": [
            "publish",
            "lint"
          ],
          "steps": 1,
          "runs_on": "ubuntu-latest",
          "timeout_minutes": null,
          "unpinned_actions": [],
          "permissions_declared": false
        }
      ],
      "limits": {
        "maxJobs": 200,
        "maxFindings": 500,
        "maxServices": 200,
        "maxResources": 2000,
        "maxVariables": 1000,
        "maxComponents": 5000,
        "maxDependencies": 5000
      },
      "passed": false,
      "complete": true,
      "findings": [
        {
          "job": "lint",
          "code": "REQUIRED_JOB_MISSING",
          "detail": "lint is required and not declared."
        },
        {
          "code": "PULL_REQUEST_TARGET_TRIGGER",
          "detail": "The workflow triggers on pull_request_target, which runs with repository write context against code from a fork. This reports the trigger, not an exploit."
        },
        {
          "code": "WORKFLOW_PERMISSIONS_NOT_DECLARED",
          "detail": "The workflow declares no permissions block, so it inherits whatever the repository default is rather than stating what it needs."
        }
      ],
      "job_count": 3,
      "conformant": false,
      "request_id": "example-request",
      "service_id": "ci_workflow_contract_audit",
      "step_count": 6,
      "assumptions": [
        "An action pinned to a 40-character commit hash is pinned; a tag or branch can be moved by whoever owns the action, so the code a step runs can change without this file changing.",
        "The on key is read from either on or true, because an unquoted on is a YAML boolean and survives conversion to JSON that way.",
        "Findings describe patterns in the document. Naming pull_request_target or an interpolated expression is reporting what the file says, not demonstrating an exploit."
      ],
      "limitations": [
        "Observable facts about the workflow supplied. Nothing is run, no action is fetched, and this is not a security assessment or a compliance determination.",
        "conformant is true only when every declared rule was evaluated and none failed."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "finding_count": 10,
      "trigger_names": [
        "push",
        "pull_request_target"
      ],
      "service_version": "1.0.0",
      "findings_by_code": {
        "JOB_TIMEOUT_MISSING": 2,
        "REQUIRED_JOB_MISSING": 1,
        "ACTION_NOT_PINNED_TO_COMMIT": 1,
        "JOB_DEPENDENCY_NOT_DECLARED": 1,
        "PULL_REQUEST_TARGET_TRIGGER": 1,
        "JOB_PERMISSIONS_NOT_DECLARED": 2,
        "UNTRUSTED_INTERPOLATION_IN_RUN": 1,
        "WORKFLOW_PERMISSIONS_NOT_DECLARED": 1
      },
      "examined_job_count": 3,
      "unpinned_action_count": 1,
      "workflow_permissions_declared": false
    }
  }
}