error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/backend-code-checks.yml:3:1
   |
 3 | / on:
 4 | |   pull_request:
...  |
15 | |       - 'docs/**'
16 | |       - 'latest.json'
   | |_____________________^ generally used when publishing artifacts generated at runtime
17 |
...
31 |           uses: actions/setup-go@v5
32 | /         with:
33 | |           # Explicitly set Go version to 1.24.1 to ensure consistent OpenAPI spec generation
...  |
36 | |           go-version: 1.24.1
37 | |           cache: true
   | |_____________________^ opt-in for caching here
   |
   = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/go-lint.yml:2:1
   |
 2 | / on:
 3 | |   push:
...  |
10 | |       - release-*.*.*
11 | |   pull_request:
   | |_______________^ generally used when publishing artifacts generated at runtime
12 |
...
22 |             persist-credentials: false
23 |         - uses: actions/setup-go@v5
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
   |
   = note: audit confidence → Low

error[bot-conditions]: spoofable bot actor check
  --> ./.github/workflows/pr-dependabot-update-go-workspace.yml:18:3
   |
18 | /   update:
19 | |     runs-on: "ubuntu-latest"
20 | |     if: ${{ github.actor == 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository }}
   | |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ actor context may be spoofable
21 | |     continue-on-error: true
...  |
68 | |           git push origin "$BRANCH_NAME"
69 | |         fi
   | |___________^ this job
   |
   = note: audit confidence → Medium
   = note: this finding has an auto-fix

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/run-schema-v2-e2e.yml:3:1
   |
 3 | / on:
 4 | |   push:
...  |
 9 | |     branches:
10 | |       - '**'
   | |____________^ generally used when publishing artifacts generated at runtime
11 |
...
25 |         - name: Pin Go version to mod file
26 |           uses: actions/setup-go@v5
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
   |
   = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/run-schema-v2-e2e.yml:3:1
   |
 3 | / on:
 4 | |   push:
...  |
 9 | |     branches:
10 | |       - '**'
   | |____________^ generally used when publishing artifacts generated at runtime
11 |
...
30 |         - uses: actions/setup-node@v4
31 | /         with:
32 | |           node-version-file: '.nvmrc'
33 | |           cache: 'yarn'
   | |_______________________^ opt-in for caching here
   |
   = note: audit confidence → Low

201 findings (64 ignored, 132 suppressed, 1 fixable): 0 unknown, 0 informational, 0 low, 0 medium, 5 high