github-actions-ci

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The scripts/validate-workflows.sh will, at runtime, fetch and execute remote installer code (curl -> bash to https://raw.githubusercontent.com/rhysd/actionlint/v$actionlint_version/scripts/download-actionlint.bash and/or run go install github.com/rhysd/actionlint/cmd/actionlint@v$actionlint_version), so it has a runtime external dependency that executes remote code.