github-actions

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The workflows reference GitHub Action repositories that are fetched and run at workflow runtime (e.g., actions/checkout@de0fac2e5ef641dbfe0fef2a1de4a5c3a0d70dce and actions/create-github-app-token@), which are remote git-based dependencies executed by the runner and thus constitute runtime external code execution.