Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/benchmark.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/benchmark.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/benchmark.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/benchmark.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/changelog.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/changelog.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/close-stale.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/close-stale.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/create-or-update-release-pr.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/create-or-update-release-pr.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/create-or-update-release-pr.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/create-or-update-release-pr.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs.yaml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/docs.yaml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/docs.yaml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs.yaml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/docs.yaml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/lint.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/lint.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/peer-api.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/peer-api.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-to-npm.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/publish-to-npm.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-to-npm.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/publish-to-npm.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sbom.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/sbom.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sbom.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/sbom.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sbom.yml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/sbom.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sbom.yml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/sbom.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sbom.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/sbom.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/survey-on-merged-pr.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/survey-on-merged-pr.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/unit-test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/unit-test.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/unit-test.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/unit-test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:78: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/unit-test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:80: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/unit-test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:105: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/unit-test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:107: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/unit-test.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/unit-test.yml:123: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/unit-test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:134: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/unit-test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:135: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/unit-test.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/unit-test.yml:151: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/unit-test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/w3c-integration-test.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/w3c-integration-test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/w3c-integration-test.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js/w3c-integration-test.yml/main?enable=pin
Warn: pipCommand not pinned by hash: integration-tests/tracecontext-integration-test.sh:13
Warn: pipCommand not pinned by hash: integration-tests/tracecontext-integration-test.sh:14
Warn: npmCommand not pinned by hash: .github/workflows/benchmark.yml:30
Warn: npmCommand not pinned by hash: .github/workflows/create-or-update-release-pr.yml:49
Warn: npmCommand not pinned by hash: .github/workflows/peer-api.yml:21
Warn: npmCommand not pinned by hash: .github/workflows/peer-api.yml:24
Warn: npmCommand not pinned by hash: .github/workflows/sbom.yml:22
Warn: npmCommand not pinned by hash: .github/workflows/unit-test.yml:39
Warn: npmCommand not pinned by hash: .github/workflows/unit-test.yml:45
Info: 4 out of 37 GitHub-owned GitHubAction dependencies pinned
Info: 2 out of 7 third-party GitHubAction dependencies pinned
Info: 0 out of 2 pipCommand dependencies pinned
Info: 10 out of 17 npmCommand dependencies pinned