Evidence row 54312

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://ciaudit.genexxis.com/github-actions"
    ]
  ],
  "name": "ciaudit.genexxis.com/github-actions",
  "owner_address": "0x9287e3102d411029025c7617d75245bfc7920f17",
  "raw": {
    "accepts": [
      {
        "amount": "8000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0x9287e3102D411029025C7617d75245BFc7920f17",
        "scheme": "exact"
      }
    ],
    "description": "Lint a GitHub Actions workflow: actions not pinned to a commit SHA, missing or write-all permissions, pull_request_target with PR head checkout, script injection via event fields in run, secrets on the command line, curl|bash, self-hosted runners, deprecated set-output.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "content": "name: CI\non:\n  push:\n    branches: [main]\n  pull_request:\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 20\n      - run: npm ci\n      - run: npm test\n"
            },
            "bodyType": "json",
            "method": "POST",
            "type": "http"
          },
          "output": {
            "example": {
              "findings": [
                {
                  "fix": "Add at top level: permissions: { contents: read }",
                  "id": "no_permissions",
                  "line": null,
                  "severity": "medium",
                  "snippet": null,
                  "why": "no top-level permissions: the GITHUB_TOKEN gets the repository default"
                },
                {
                  "fix": "Pin to a full commit SHA",
                  "id": "unpinned_action",
                  "line": 10,
                  "severity": "medium",
                  "snippet": "- uses: actions/checkout@v4",
                  "why": "actions/checkout is referenced by a mutable tag/branch"
                }
              ],
              "jobs": [
                "test"
              ],
              "kind": "github-actions",
              "score": 76,
              "summary": {
                "high": 0,
                "low": 0,
                "medium": 3,
                "total": 3
              },
              "triggers": [
                "push",
                "pull_request"
              ]
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "properties": {
                    "content": {
                      "description": "Full text of the file (max 100 KB)",
                      "type": "string"
                    }
                  },
                  "required": [
                    "content"
                  ]
                },
                "bodyType": {
                  "enum": [
                    "json",
                    "form-data",
                    "text"
                  ],
                  "type": "string"
                },
                "method": {
                  "enum": [
                    "POST"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method",
                "bodyType",
                "body"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      },
      "builder-code": {
        "info": {
          "s": [
            "cdp_sdk_server"
          ]
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "additionalProperties": false,
          "properties": {
            "a": {
              "description": "App builder code",
              "pattern": "^[a-z0-9_]{1,32}$",
              "type": "string"
            },
            "s": {
              "description": "Service builder codes",
              "items": {
                "pattern": "^[a-z0-9_]{1,32}$",
                "type": "string"
              },
              "maxItems": 11,
              "type": "array"
            },
            "w": {
              "description": "Wallet builder code",
              "pattern": "^[a-z0-9_]{1,32}$",
              "type": "string"
            }
          },
          "type": "object"
        }
      },
      "eip2612GasSponsoring": {},
      "erc20ApprovalGasSponsoring": {}
    },
    "lastUpdated": "2026-10-26T11:48:56.125Z",
    "quality": {
      "l30DaysTotalCalls": 4,
      "l30DaysUniquePayers": 2,
      "lastCalledAt": "2026-10-26T11:48:55.874Z"
    },
    "resource": "https://ciaudit.genexxis.com/github-actions",
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Lint a GitHub Actions workflow: actions not pinned to a commit SHA, missing or write-all permissions, pull_request_target with PR head checkout, script injection via event fields in run, secrets on the command line, curl|bash, self-hosted runners, deprecated set-output."
}

What the leaf hashes

{"body":"f701ddb33743aabff29e0b783f5015e5edd981d582e59a7d2da7cfcc9ab03dc4","id":54312,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793025431962598,"prev":null,"subject":"x402_bazaar:https://ciaudit.genexxis.com/github-actions","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0x1abda6880a37e710eac33d1330c9ef7587185f4205c627a23c82be7217024020
2. 0xca2c89e4f2ffbcf31ea12441dec15103ca4cc1f2c3fddb75efb9ef99cba286df
3. 0xdc31aa4bec7c56136f69c8964c54ac3dd355ba8fcf2c6be6a5e956c550b0f4c6
4. 0x7961a3f5271fc0c17b23e0f1c386cbdb51d4ebc01d8d1673d5e459a61b18c879
5. 0xb02d83c86ae68ac1467a1faedf88fcf70c7e46e726617d76c04e7cb01ae5d286
6. 0xe2d16662269ae2356854ee6b7ddea9087f4112666b1b322b85cc3fd9b3ddf2ff
7. 0xb18a5356af0355b97d078f769f2409652d1b835cbe3301d395bfddc869e895a1
8. 0x73d1a21c8738aa04f9f08c47c5961d84cd722167777b2b1de60ca605ddc418af
9. 0x522761010ff0a51d7a93a23a2c36ff951f83ab5736b328badc7aa1e01f3d1a08
10. 0xdd23b279d0847860786130eecc85f2b83d5c655bfd9ab282efff968c5d7bdc6d
11. 0x6a51e1d524ffd968d6f505e10f76aacd4ae61fc223a88a38ef8820592653c75a
12. 0x6a8a72430804a14ec575375f3d0ca4364f58310afb2c2e8c92b72f8b75809db9
13. 0xe00c7829e46541e49a308807d357db902e06eff941a833217a8f0dbccd3964f1
14. 0x770e4376196188c7fc9ec40f8e218dc0d1cb92bba5fe0425a0edce27ca9a997f
15. 0x60582ab4b41e72eb70eb0bce07fbf0fb4d2b62a8bad5be50f5d16d511adc746c
16. 0xc6a4d7899a0f442958e26505011190b7cff2483611c1b94eba9043e0ba9ac36e
17. 0x8c756542e482157df0c36464d75c937b845e4423dbbcfad08f0cf8d5a16b9a13
18. 0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d
19. 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae