error[template-injection]: code injection via template expansion
   --> ./.github/workflows/release.yml:118:9
    |
118 |         - name: Validate version matches
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
119 | /         run: |
120 | |           VERSION=$(python -c "import yaml; print(yaml.safe_load(open('galaxy.yml'))['version'])")
...   |
123 | |             exit 1
124 | |           fi
    | |____________^ github.event.inputs.version may expand into attacker-controllable code
    |
    = note: audit confidence → High

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/release.yml:118:9
    |
118 |         - name: Validate version matches
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
119 | /         run: |
120 | |           VERSION=$(python -c "import yaml; print(yaml.safe_load(open('galaxy.yml'))['version'])")
...   |
123 | |             exit 1
124 | |           fi
    | |____________^ github.event.inputs.version may expand into attacker-controllable code
    |
    = note: audit confidence → High

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/release.yml:153:9
    |
153 | ... - name: Validate version is published to Galaxy
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
154 | ...   run: curl --head -s -f -o /dev/null https://galaxy.ansible.com/download/grafana-grafana-${{ github.event.inputs.version }}.tar.gz
    |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ github.event.inputs.version may expand into attacker-controllable code
    |
    = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
   --> ./.github/workflows/release.yml:157:9
    |
157 |         uses: softprops/action-gh-release@v1
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High

45 findings (34 ignored, 7 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 4 high