python-github-actions

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The workflows call third‑party GitHub Actions that are fetched and executed at runtime (notably "uses: astral-sh/setup-uv@v4" — i.e. github.com/astral-sh/setup-uv) which runs remote code and is a required runtime dependency (also other actions like codecov/codecov-action@v4 and pypa/gh-action-pypi-publish@release/v1 are fetched and executed similarly).