Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/debugger-py.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/debugger-py.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/debugger-py.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/debugger-py.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/debugger-py.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/debugger-py.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/debugger-py.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/debugger-py.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/debugger-py.yml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/debugger-py.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ghp.yml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ghp.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ghp.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ghp.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ghp.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ghp.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ghp.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ghp.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ghp.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ghp.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ghp.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ghp.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ls-clangd.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-clangd.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ls-clangd.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-clangd.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ls-clangd.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-clangd.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ls-clangd.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-clangd.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ls-clangd.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-clangd.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ls-clangd.yml:65: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-clangd.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ls-clangd.yml:75: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-clangd.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ls-clangd.yml:84: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-clangd.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ls-eclipsejdt.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-eclipsejdt.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ls-eclipsejdt.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-eclipsejdt.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ls-eclipsejdt.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-eclipsejdt.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ls-eclipsejdt.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-eclipsejdt.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ls-eclipsejdt.yml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-eclipsejdt.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ls-groovy.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-groovy.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ls-groovy.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-groovy.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ls-groovy.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-groovy.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ls-groovy.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-groovy.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ls-groovy.yml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/ls-groovy.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/main.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/main.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/main.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/peer.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/peer.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/peer.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/peer.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/peer.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/peer.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/verify.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/verify.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/verify.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/verify.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/verify.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/TypeFox/monaco-languageclient/verify.yml/main?enable=pin
Warn: containerImage not pinned by hash: packages/examples/resources/clangd/build.Dockerfile:1: pin your Docker image by updating ghcr.io/typefox/monaco-languageclient/clangd-wasm-configure:latest to ghcr.io/typefox/monaco-languageclient/clangd-wasm-configure:latest@sha256:6faa54b0b7ed7294a334c52d029756c7ac4a501f9145913d9ce3f691090a3703
Warn: containerImage not pinned by hash: packages/examples/resources/clangd/configure.Dockerfile:1: pin your Docker image by updating ubuntu to ubuntu@sha256:72297848456d5d37d1262630108ab308d3e9ec7ed1c3286a32fe09856619a782
Warn: containerImage not pinned by hash: packages/examples/resources/debugger/Dockerfile:1: pin your Docker image by updating ghcr.io/graalvm/graalpy-community:24 to ghcr.io/graalvm/graalpy-community:24@sha256:56ebb0521872b0a78c3cdf42a727136f7fa0f78aa16ce508d64eecf8c9c2cf16
Warn: containerImage not pinned by hash: packages/examples/resources/eclipse.jdt.ls/Dockerfile:1: pin your Docker image by updating eclipse-temurin:17-jdk to eclipse-temurin:17-jdk@sha256:3cbb344931142db86b06ea2b7aa24c62a02299108dd0d20260a982f071f3ce55
Warn: containerImage not pinned by hash: packages/examples/resources/groovy/Dockerfile:1: pin your Docker image by updating gradle:7-jdk17-focal to gradle:7-jdk17-focal@sha256:6f93cc35c8231c536d5f15548ef3f6f7e3160e15be9e50eec000b60beac839d4
Warn: downloadThenRun not pinned by hash: packages/examples/resources/clangd/configure.Dockerfile:7
Warn: downloadThenRun not pinned by hash: packages/examples/resources/debugger/Dockerfile:3
Warn: downloadThenRun not pinned by hash: packages/examples/resources/eclipse.jdt.ls/Dockerfile:12
Warn: npmCommand not pinned by hash: packages/examples/resources/eclipse.jdt.ls/Dockerfile:24-26
Warn: downloadThenRun not pinned by hash: packages/examples/resources/groovy/Dockerfile:12
Warn: npmCommand not pinned by hash: packages/examples/resources/groovy/Dockerfile:32-34
Info: 0 out of 16 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 22 third-party GitHubAction dependencies pinned
Info: 0 out of 5 containerImage dependencies pinned
Info: 0 out of 4 downloadThenRun dependencies pinned
Info: 4 out of 6 npmCommand dependencies pinned