Evidence row 71002

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://api.zfinia.com/x402/v1/ci-workflow-contract-audit"
    ]
  ],
  "name": "CI Workflow Audit",
  "owner_address": "0x25e8245f07d5e4873987293dad666afbe56a9608",
  "raw": {
    "accepts": [
      {
        "amount": "120000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 60,
        "network": "eip155:8453",
        "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
        "scheme": "exact"
      }
    ],
    "description": "Audit a CI workflow for what it leaves movable or undeclared. Reports actions pinned to a tag rather than a commit - a tag can be moved by whoever owns the action, so the code a step runs can change without this file changing - missing permissions and timeouts, a job depending on one that is not declared, a pull_request_target trigger, and an expression interpolated straight into a shell command.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "contract": {
                "required_jobs": [
                  "build",
                  "publish",
                  "lint"
                ]
              },
              "workflow": {
                "jobs": {
                  "build": {
                    "runs-on": "ubuntu-latest",
                    "steps": [
                      {
                        "uses": "actions/checkout@v4"
                      },
                      {
                        "uses": "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"
                      },
                      {
                        "name": "Greet",
                        "run": "echo \"Building ${{ github.event.pull_request.title }}\""
                      },
                      {
                        "run": "npm ci && npm test"
                      }
                    ]
                  },
                  "notify": {
                    "needs": [
                      "publish",
                      "lint"
                    ],
                    "runs-on": "ubuntu-latest",
                    "steps": [
                      {
                        "run": "echo done"
                      }
                    ]
                  },
                  "publish": {
                    "needs": "build",
                    "permissions": {
                      "contents": "read",
                      "packages": "write"
                    },
                    "runs-on": "ubuntu-latest",
                    "steps": [
                      {
                        "uses": "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"
                      }
                    ],
                    "timeout-minutes": 15
                  }
                },
                "name": "release",
                "on": {
                  "pull_request_target": {},
                  "push": {
                    "branches": [
                      "main"
                    ]
                  }
                }
              }
            },
            "bodyType": "json",
            "method": "POST",
            "type": "http"
          },
          "output": {
            "example": {
              "assumptions": [
                "An action pinned to a 40-character commit hash is pinned; a tag or branch can be moved by whoever owns the action, so the code a step runs can change without this file changing.",
                "The on key is read from either on or true, because an unquoted on is a YAML boolean and survives conversion to JSON that way.",
                "Findings describe patterns in the document. Naming pull_request_target or an interpolated expression is reporting what the file says, not demonstrating an exploit."
              ],
              "complete": true,
              "conformant": false,
              "examined_job_count": 3,
              "finding_count": 10,
              "findings": [
                {
                  "code": "REQUIRED_JOB_MISSING",
                  "detail": "lint is required and not declared.",
                  "job": "lint"
                },
                {
                  "code": "PULL_REQUEST_TARGET_TRIGGER",
                  "detail": "The workflow triggers on pull_request_target, which runs with repository write context against code from a fork. This reports the trigger, not an exploit."
                },
                {
                  "code": "WORKFLOW_PERMISSIONS_NOT_DECLARED",
                  "detail": "The workflow declares no permissions block, so it inherits whatever the repository default is rather than stating what it needs."
                }
              ],
              "findings_by_code": {
                "ACTION_NOT_PINNED_TO_COMMIT": 1,
                "JOB_DEPENDENCY_NOT_DECLARED": 1,
                "JOB_PERMISSIONS_NOT_DECLARED": 2,
                "JOB_TIMEOUT_MISSING": 2,
                "PULL_REQUEST_TARGET_TRIGGER": 1,
                "REQUIRED_JOB_MISSING": 1,
                "UNTRUSTED_INTERPOLATION_IN_RUN": 1,
                "WORKFLOW_PERMISSIONS_NOT_DECLARED": 1
              },
              "job_count": 3,
              "jobs": [
                {
                  "job": "build",
                  "needs": [],
                  "permissions_declared": false,
                  "runs_on": "ubuntu-latest",
                  "steps": 4,
                  "timeout_minutes": null,
                  "unpinned_actions": [
                    "actions/checkout@v4"
                  ]
                },
                {
                  "job": "publish",
                  "needs": [
                    "build"
                  ],
                  "permissions_declared": true,
                  "runs_on": "ubuntu-latest",
                  "steps": 1,
                  "timeout_minutes": 15,
                  "unpinned_actions": []
                },
                {
                  "job": "notify",
                  "needs": [
                    "publish",
                    "lint"
                  ],
                  "permissions_declared": false,
                  "runs_on": "ubuntu-latest",
                  "steps": 1,
                  "timeout_minutes": null,
                  "unpinned_actions": []
                }
              ],
              "limitations": [
                "Observable facts about the workflow supplied. Nothing is run, no action is fetched, and this is not a security assessment or a compliance determination.",
                "conformant is true only when every declared rule was evaluated and none failed."
              ],
              "limits": {
                "maxComponents": 5000,
                "maxDependencies": 5000,
                "maxFindings": 500,
                "maxJobs": 200,
                "maxResources": 2000,
                "maxServices": 200,
                "maxVariables": 1000
              },
              "not_examined": [],
              "observed_at": "2026-10-02T00:00:00.000Z",
              "passed": false,
              "request_id": "example-request",
              "service_id": "ci_workflow_contract_audit",
              "service_version": "1.0.0",
              "step_count": 6,
              "trigger_names": [
                "push",
                "pull_request_target"
              ],
              "unpinned_action_count": 1,
              "workflow_permissions_declared": false
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "additionalProperties": false,
                  "properties": {
                    "contract": {
                      "additionalProperties": false,
                      "properties": {
                        "forbid_pull_request_target": {
                          "type": "boolean"
                        },
                        "require_permissions": {
                          "type": "boolean"
                        },
                        "require_pinned_actions": {
                          "type": "boolean"
                        },
                        "require_timeout": {
                          "type": "boolean"
                        },
                        "required_jobs": {
                          "items": {
                            "maxLength": 128,
                            "type": "string"
                          },
                          "maxItems": 200,
                          "minItems": 1,
                          "type": "array"
                        }
                      },
                      "type": "object"
                    },
                    "workflow": {
                      "type": "object"
                    }
                  },
                  "required": [
                    "workflow"
                  ],
                  "type": "object"
                },
                "bodyType": {
                  "enum": [
                    "json",
                    "form-data",
                    "text"
                  ],
                  "type": "string"
                },
                "method": {
                  "enum": [
                    "POST"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method",
                "bodyType",
                "body"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-10-04T08:02:50.284Z",
    "quality": {
      "l30DaysTotalCalls": 1,
      "l30DaysUniquePayers": 1,
      "lastCalledAt": "2026-10-04T08:02:44.497Z"
    },
    "resource": "https://api.zfinia.com/x402/v1/ci-workflow-contract-audit",
    "serviceName": "CI Workflow Audit",
    "tags": [
      "configuration",
      "continuous integration",
      "supply chain hygiene",
      "linting",
      "developer tooling"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Audit a CI workflow for what it leaves movable or undeclared. Reports actions pinned to a tag rather than a commit - a tag can be moved by whoever owns the action, so the code a step runs can change without this file changing - missing permissions and timeouts, a job depending on one that is not declared, a pull_request_target trigger, and an expression interpolated straight into a shell command."
}

What the leaf hashes

{"body":"6027751ce1fcce3d01e6b530a2bd8af86fc319c9e326c0c925e29f89a18ab072","id":71002,"kind":"listing","method":"baseline/1","observed_us":1793025481282209,"prev":null,"subject":"x402_bazaar:https://api.zfinia.com/x402/v1/ci-workflow-contract-audit","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0x5853f4cd837fc1fb3fa5ce81c95aee27f47c707afaa07f449dfcdde42cd0b685
2. 0x254b2a022f387ccd8c8ba93d4deee4fa0dd5c49160eaf8f90a6bd7956864dca0
3. 0x8b51a1b549351259595d27a224f883c336b15f145950ab7887ec7f5089c67eab
4. 0x6a0202d971255faca2fe092859f015763a5176b8f56ffc615444463735e05e78
5. 0x8afc9e11f872cf125571192a3b4b611dc60c853ea44557c7f60f238e06c3db35
6. 0x313d746fd3881420637888a5fc494eb9d2188e317e6c45870ed23a1169522bcb
7. 0xfe08efe49a92c6bd481d35c8823dc3521e4ad8e886c0623b263c2f1a3c0579bf
8. 0xb26a1a385e095510486747e9254026fd1b20d851df6a83d6887d8ead14dfbbc3
9. 0xeec474b2166d79d6d85e43fb077ac5f387533bb4b90b1ed81c0d404104bc545a
10. 0x7ae162dcc3142c20e9800f624edcd459f9a47b7db25601e5e24164992c46399a
11. 0x86f49d35fee840c62060e3a6cbc75237dbfdc70dd7439506d3f085c9cca8e4f2
12. 0x01ecb94c2efbfb8e9050ebbd813fbba80bbcbc345f98de707345bc4bc88c94e8
13. 0x8ba3430866b4c11cea7eba9923ee4fa8a5074849df417006e4441426c1f13056
14. 0x5cdeb4648502e0633d01cc4f3379d48cccb9d4f528565b2868eb93db0df9e829
15. 0x7726154b91b2ad65b13849ef6cb6443b1f0ff113a3089c9bd5f2bcfc16be099d
16. 0x47b89901b0f07938a6b9a66ddf35683903f79d756a7c7763665fd632758b08d0
17. 0x9a83be955a206deb65b995adfd92c58fa31c95fbbf926bd199d300e70b08b26d
18. 0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d
19. 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae