actionsbench 0.1.1__tar.gz

actionsbench-0.1.1/.gitignore

@@ -0,0 +1,26 @@
+# Python
+__pycache__/
+*.py[cod]
+.venv/
+*.egg-info/
+build/
+dist/
+
+# Tooling caches
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+
+# Local scanner run output (reports are published deliberately, never committed by accident)
+results/
+
+# OS / editor
+.DS_Store
+.idea/
+.vscode/
+
+# Pinned scanner binaries installed by scripts/
+.tools/
+
+# Node tooling under tools/
+node_modules/

actionsbench-0.1.1/CITATION.cff

@@ -0,0 +1,23 @@
+cff-version: 1.2.0
+message: "If you use ActionsBench, please cite it as below and state the corpus version you used."
+title: "ActionsBench: a labeled benchmark for GitHub Actions workflow security scanners"
+type: dataset
+authors:
+  - family-names: Tijani
+    given-names: Aliu
+version: 0.1.1
+date-released: 2026-10-06
+license: CC-BY-4.0
+repository-code: "https://github.com/NeesimEra/ActionsBench"
+url: "https://github.com/NeesimEra/ActionsBench"
+abstract: >-
+  A labeled corpus of minimized GitHub Actions workflows, each tagged with the weakness it contains or marked
+  clean, and a harness that scores workflow security scanners against it per weakness class. The corpus is
+  licensed CC BY 4.0, which is the license named here, and the harness code is licensed MIT; both licenses
+  ship with the package. Version 0.1.1 is an initial release (pre-1.0) of 44 hand-built cases: all labels are
+  proposed by one author and audited against primary sources, but not independently reviewed.
+keywords:
+  - github-actions
+  - security
+  - benchmark
+  - static-analysis

actionsbench-0.1.1/CONTRIBUTING.md

@@ -0,0 +1,113 @@
+# Contributing
+
+Labels are claims, and the project improves when they are challenged. There are three
+ways to help: add a case, challenge a label, or improve the harness.
+
+## Development setup
+
+Requires Python 3.11+ and [uv](https://docs.astral.sh/uv/).
+
+```bash
+uv sync
+uv run ruff check . && uv run ruff format --check .
+uv run mypy
+uv run pytest
+uv run actionsbench validate
+```
+
+CI runs the same commands on Python 3.11 and 3.13.
+
+Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/)
+(`feat:`, `fix:`, `docs:`, `refactor:`, `test:`, `chore:`, with a scope when useful, for
+example `feat(corpus): add AB-INJ-0008`). Keep unrelated changes in separate commits.
+
+## Branches and pull requests
+
+- **`dev` is the default branch and the only target for pull requests.** Branch from `dev`
+  (for example `feat/...`, `fix/...`, `docs/...`) and open the pull request against `dev`. It
+  is squash-merged, and the pull request title becomes the commit title, so write it as a
+  Conventional Commit.
+- **`main` is the released state.** It changes only through a release pull request from `dev`,
+  merged with a merge commit by a maintainer. Release tags (`v*`) are created on `main` and are
+  immutable.
+- The required check **PR target** fails any pull request whose base is not `dev`, except the
+  release pull request from `dev` into `main`. If it fails, change the base branch of your pull
+  request to `dev`; the check re-runs on its own.
+- Direct pushes to `dev` and `main` are blocked. Both CI checks must pass.
+
+Reasoning and trade-offs: [ADR 0004](docs/adr/0004-branching-model.md).
+
+### Releasing (maintainers)
+
+1. Update `corpus/CHANGELOG.md` on `dev` through a normal pull request.
+2. Open a pull request from `dev` to `main` titled `release: vX.Y.Z` and merge it with a merge
+   commit.
+3. Create the GitHub release for `vX.Y.Z` targeting that merge commit; this creates the tag. Tags cannot be
+   moved or deleted. Publishing to PyPI and archiving on Zenodo follow from the release; the one-time setup and
+   the full sequence are in [docs/publishing.md](docs/publishing.md).
+
+## Adding a case
+
+Read [docs/methodology.md](docs/methodology.md) first. In short:
+
+1. Create `corpus/cases/<id>/` containing the workflow files under `.github/` and a
+   `case.yaml`. Use the next free ID. The ID prefix is the case's primary weakness class
+   (`INJ`, `PIN`, ...) or `NEG` for a clean case that looks risky but is safe.
+2. Keep the case minimal and single-purpose. Pin every `uses:` to a full commit SHA and
+   set `permissions:` unless the case is about exactly that, so that only the intended
+   weakness is labeled.
+3. Anchor each expected finding at the **sink**: the line where untrusted data reaches the
+   interpreter. Put a short `evidence` substring that appears on that line.
+4. Write a `rationale` a reviewer can check, and add `references`. If you reasoned the
+   label from first principles and found no independent source, say so in the rationale.
+5. Leave `status: proposed` and `reviewer: null`. An independent reviewer moves a case to
+   `agreed`. You cannot review your own case.
+6. Run `uv run actionsbench validate`.
+
+Never add a workflow from a real repository that still has a live vulnerability, real
+secrets, or anything that works as a real exploit. See [SECURITY.md](SECURITY.md).
+
+## Challenging a label
+
+Open an issue with the **Challenge a label** template. Include evidence: documentation,
+an advisory, or a minimal reproduction. A challenge that cannot be resolved marks the case
+`disputed`; it is not deleted. The outcome is recorded in the case's `notes`.
+
+## Reviewing a case
+
+Read the workflow, decide independently whether the label is right, then set `status:
+agreed` and your handle as `reviewer` in a pull request, or comment on the case's pull
+request or issue if you disagree.
+
+## Adding a scanner adapter
+
+Two adapters exist so far (zizmor and actionlint). Add another only after checking the tool's
+real output:
+
+1. Run the tool by hand on an isolated copy of a case's `.github/` and read its raw output.
+   Record the version and the exact flags that make the run deterministic.
+2. Add `src/actionsbench/adapters/<tool>.py` implementing the contract in `adapters/base.py`:
+   the command, accepted exit codes, a parser, a pinned version, and a rule map. Use `prepare`
+   if the tool needs something in the isolated copy (actionlint needs a project marker) and
+   `probe_version` if the tool does not print its version in its output. If the tool is a
+   binary, add a pinned installer under `scripts/` that verifies a checksum.
+   If any setting changes the tool's verdict (zizmor's persona is one), expose it through
+   `from_options`, pass it to the tool explicitly, and report it in `configuration`; the
+   baseline is the tool's default made explicit.
+3. Map only rules whose meaning you have reviewed against a benchmark class. Everything else
+   stays unmapped and is reported by the runner. Record each decision, mapped or deliberately not
+   mapped, in [docs/rule-mappings.md](docs/rule-mappings.md), including where you disagree with
+   the source study. Never map a rule just because it fired on a labeled case. Set `scope` to the classes that have a
+   reviewed mapping, not to everything the tool claims.
+4. Add unit tests with a trimmed real output sample, and an opt-in integration test
+   (`pytest -m integration`) that runs the real tool.
+5. Register it in `adapters/__init__.py` and say in the pull request which rules you mapped and
+   why.
+
+Any scanner can also be scored without an adapter by producing a findings file that matches
+[findings.schema.json](src/actionsbench/schemas/findings.schema.json).
+
+## License
+
+By contributing you agree that your contribution is licensed under the license of the part
+of the repository it touches: MIT for code, CC BY 4.0 for the corpus under `corpus/`.

actionsbench-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Aliu Tijani
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

actionsbench-0.1.1/PKG-INFO

@@ -0,0 +1,124 @@
+Metadata-Version: 2.5
+Name: actionsbench
+Version: 0.1.1
+Summary: A labeled benchmark and evaluation harness for GitHub Actions workflow security scanners.
+Project-URL: Homepage, https://github.com/NeesimEra/ActionsBench
+Project-URL: Repository, https://github.com/NeesimEra/ActionsBench
+Project-URL: Issues, https://github.com/NeesimEra/ActionsBench/issues
+Project-URL: Changelog, https://github.com/NeesimEra/ActionsBench/blob/main/corpus/CHANGELOG.md
+Author: Aliu Tijani
+License-Expression: MIT AND CC-BY-4.0
+License-File: LICENSE
+License-File: corpus/LICENSE
+Keywords: benchmark,ci,github-actions,security,static-analysis
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: jsonschema>=4.21
+Requires-Dist: pyyaml>=6.0
+Description-Content-Type: text/markdown
+
+# ActionsBench
+
+A labeled benchmark and evaluation harness for GitHub Actions workflow security scanners.
+
+> **Status: initial release (0.1.0, pre-1.0).** The corpus is a small hand-built set (44 cases) and every label is still
+> `proposed` (one author). The facts behind them were audited against primary sources
+> ([docs/evidence-audit.md](https://github.com/NeesimEra/ActionsBench/blob/main/docs/evidence-audit.md)), but no label has been independently reviewed.
+> Nothing here is a result yet. It is public early so the
+> labels can be challenged, not because it is finished.
+
+## Why this exists
+
+Several open-source scanners analyze GitHub Actions workflows for security weaknesses,
+and they disagree widely. In a 2026 study of 9 scanners on 2,722 real workflows, one tool
+reported 107 injection findings where another reported 1,778 on the same files. The same
+study found no verified, labeled dataset of workflows with known weaknesses, so precision
+and recall could not be computed ([arXiv 2601.14455](https://arxiv.org/html/2601.14455v2)).
+
+ActionsBench provides the missing piece:
+
+1. A **labeled corpus** of minimized workflows, each tagged with the weakness it contains,
+   or marked clean.
+2. A **harness** that scores any scanner against the corpus, per weakness class.
+3. **Versioned, reproducible releases** so results stay comparable over time.
+
+It is not a scanner, and it does not rank tools. It reports per-class evidence.
+
+Full motivation, scope and risks: [docs/PRD.md](https://github.com/NeesimEra/ActionsBench/blob/main/docs/PRD.md).
+
+## Quickstart
+
+Requires Python 3.11+ and [uv](https://docs.astral.sh/uv/).
+
+```bash
+uv sync
+uv run actionsbench validate      # check every case in corpus/cases
+uv run actionsbench stats         # cases per weakness class
+uv run actionsbench run --tool zizmor      # needs uvx; add --config persona=auditor for another setting
+sh scripts/install-actionlint.sh           # pinned, checksum-verified download into .tools/
+uv run actionsbench run --tool actionlint
+uv run actionsbench score results/zizmor-1.30.1-regular/findings.json
+```
+
+`run` executes a scanner that has a reviewed adapter (so far zizmor and actionlint, each scored
+on the injection class only) and writes a findings file; raw output goes to `results/` (gitignored).
+`score` takes any normalized findings file (schema:
+[findings.schema.json](https://github.com/NeesimEra/ActionsBench/blob/main/src/actionsbench/schemas/findings.schema.json)), so a scanner
+without an adapter can still be scored by producing that file. More adapters are planned
+(see [plan.md](https://github.com/NeesimEra/ActionsBench/blob/main/plan.md)).
+
+Run the commands from the repository root, or pass `--corpus` explicitly.
+
+## How scoring works
+
+- A tool is judged only on the weakness classes it declares in `scope`. Anything outside
+  that scope is reported as a coverage gap, never as a miss or a false alarm.
+- Cases the tool did not run on are excluded, not counted as clean.
+- Matching is one-to-one (class, file, and the same step, job or top-level key; use
+  `--match line` for exact lines), so duplicate findings do
+  not inflate recall.
+- Results are per class. There is no overall score on purpose.
+
+Details: [docs/methodology.md](https://github.com/NeesimEra/ActionsBench/blob/main/docs/methodology.md).
+
+## Repository layout
+
+| Path | Contents |
+|---|---|
+| `corpus/cases/` | The labeled cases. Each case directory is a fake repository root plus a `case.yaml`. |
+| `src/actionsbench/` | Corpus loader and validator, SARIF parser, scorer, CLI. |
+| `src/actionsbench/schemas/` | JSON Schemas for `case.yaml` and the findings file (the public contracts). |
+| `docs/` | PRD, methodology, rule mappings (the review record), architecture decision records. |
+| `plan.md`, `status.md` | The work plan with human gates, and an append-only progress log. |
+
+## A note on the corpus
+
+The cases contain deliberately vulnerable workflows. They are inert: GitHub only runs
+workflows under the repository root's `.github/workflows/`, and these live inside
+`corpus/cases/`. Payloads are benign placeholders. Never copy them into a real repository.
+See [SECURITY.md](https://github.com/NeesimEra/ActionsBench/blob/main/SECURITY.md).
+
+## Contributing
+
+Labels are claims, and they are meant to be challenged. See
+[CONTRIBUTING.md](https://github.com/NeesimEra/ActionsBench/blob/main/CONTRIBUTING.md) for adding cases, challenging a label, and the
+development setup.
+
+All pull requests target the `dev` branch. `main` and the `v*` tags are the released
+state (see [ADR 0004](https://github.com/NeesimEra/ActionsBench/blob/main/docs/adr/0004-branching-model.md)).
+
+## License
+
+- **Code** (`src/`, `tests/`, tooling): [MIT](https://github.com/NeesimEra/ActionsBench/blob/main/LICENSE).
+- **Corpus** (`corpus/`, the labeled cases and their labels):
+  [CC BY 4.0](https://github.com/NeesimEra/ActionsBench/blob/main/corpus/LICENSE). Reuse is welcome with attribution; please cite ActionsBench
+  and the corpus version you used.

actionsbench-0.1.1/README.md

@@ -0,0 +1,96 @@
+# ActionsBench
+
+A labeled benchmark and evaluation harness for GitHub Actions workflow security scanners.
+
+> **Status: initial release (0.1.0, pre-1.0).** The corpus is a small hand-built set (44 cases) and every label is still
+> `proposed` (one author). The facts behind them were audited against primary sources
+> ([docs/evidence-audit.md](https://github.com/NeesimEra/ActionsBench/blob/main/docs/evidence-audit.md)), but no label has been independently reviewed.
+> Nothing here is a result yet. It is public early so the
+> labels can be challenged, not because it is finished.
+
+## Why this exists
+
+Several open-source scanners analyze GitHub Actions workflows for security weaknesses,
+and they disagree widely. In a 2026 study of 9 scanners on 2,722 real workflows, one tool
+reported 107 injection findings where another reported 1,778 on the same files. The same
+study found no verified, labeled dataset of workflows with known weaknesses, so precision
+and recall could not be computed ([arXiv 2601.14455](https://arxiv.org/html/2601.14455v2)).
+
+ActionsBench provides the missing piece:
+
+1. A **labeled corpus** of minimized workflows, each tagged with the weakness it contains,
+   or marked clean.
+2. A **harness** that scores any scanner against the corpus, per weakness class.
+3. **Versioned, reproducible releases** so results stay comparable over time.
+
+It is not a scanner, and it does not rank tools. It reports per-class evidence.
+
+Full motivation, scope and risks: [docs/PRD.md](https://github.com/NeesimEra/ActionsBench/blob/main/docs/PRD.md).
+
+## Quickstart
+
+Requires Python 3.11+ and [uv](https://docs.astral.sh/uv/).
+
+```bash
+uv sync
+uv run actionsbench validate      # check every case in corpus/cases
+uv run actionsbench stats         # cases per weakness class
+uv run actionsbench run --tool zizmor      # needs uvx; add --config persona=auditor for another setting
+sh scripts/install-actionlint.sh           # pinned, checksum-verified download into .tools/
+uv run actionsbench run --tool actionlint
+uv run actionsbench score results/zizmor-1.30.1-regular/findings.json
+```
+
+`run` executes a scanner that has a reviewed adapter (so far zizmor and actionlint, each scored
+on the injection class only) and writes a findings file; raw output goes to `results/` (gitignored).
+`score` takes any normalized findings file (schema:
+[findings.schema.json](https://github.com/NeesimEra/ActionsBench/blob/main/src/actionsbench/schemas/findings.schema.json)), so a scanner
+without an adapter can still be scored by producing that file. More adapters are planned
+(see [plan.md](https://github.com/NeesimEra/ActionsBench/blob/main/plan.md)).
+
+Run the commands from the repository root, or pass `--corpus` explicitly.
+
+## How scoring works
+
+- A tool is judged only on the weakness classes it declares in `scope`. Anything outside
+  that scope is reported as a coverage gap, never as a miss or a false alarm.
+- Cases the tool did not run on are excluded, not counted as clean.
+- Matching is one-to-one (class, file, and the same step, job or top-level key; use
+  `--match line` for exact lines), so duplicate findings do
+  not inflate recall.
+- Results are per class. There is no overall score on purpose.
+
+Details: [docs/methodology.md](https://github.com/NeesimEra/ActionsBench/blob/main/docs/methodology.md).
+
+## Repository layout
+
+| Path | Contents |
+|---|---|
+| `corpus/cases/` | The labeled cases. Each case directory is a fake repository root plus a `case.yaml`. |
+| `src/actionsbench/` | Corpus loader and validator, SARIF parser, scorer, CLI. |
+| `src/actionsbench/schemas/` | JSON Schemas for `case.yaml` and the findings file (the public contracts). |
+| `docs/` | PRD, methodology, rule mappings (the review record), architecture decision records. |
+| `plan.md`, `status.md` | The work plan with human gates, and an append-only progress log. |
+
+## A note on the corpus
+
+The cases contain deliberately vulnerable workflows. They are inert: GitHub only runs
+workflows under the repository root's `.github/workflows/`, and these live inside
+`corpus/cases/`. Payloads are benign placeholders. Never copy them into a real repository.
+See [SECURITY.md](https://github.com/NeesimEra/ActionsBench/blob/main/SECURITY.md).
+
+## Contributing
+
+Labels are claims, and they are meant to be challenged. See
+[CONTRIBUTING.md](https://github.com/NeesimEra/ActionsBench/blob/main/CONTRIBUTING.md) for adding cases, challenging a label, and the
+development setup.
+
+All pull requests target the `dev` branch. `main` and the `v*` tags are the released
+state (see [ADR 0004](https://github.com/NeesimEra/ActionsBench/blob/main/docs/adr/0004-branching-model.md)).
+
+## License
+
+- **Code** (`src/`, `tests/`, tooling): [MIT](https://github.com/NeesimEra/ActionsBench/blob/main/LICENSE).
+- **Corpus** (`corpus/`, the labeled cases and their labels):
+  [CC BY 4.0](https://github.com/NeesimEra/ActionsBench/blob/main/corpus/LICENSE). Reuse is welcome with attribution; please cite ActionsBench
+  and the corpus version you used.

actionsbench-0.1.1/SECURITY.md

@@ -0,0 +1,35 @@
+# Security policy
+
+## What is in this repository
+
+ActionsBench is a benchmark for security scanners, so `corpus/cases/` deliberately contains
+vulnerable GitHub Actions workflows. They are inert:
+
+- GitHub only runs workflows under the repository root's `.github/workflows/`. The corpus
+  files live deeper, inside `corpus/cases/<id>/.github/`, and are never executed.
+- Payloads are benign placeholders. There is no working exploit code and no real secret.
+- Do not copy corpus workflows into a real repository.
+
+## What must never be added
+
+- A workflow copied from a real repository that still contains a live, unfixed
+  vulnerability. Publishing it would hand out an attack path.
+- Real credentials, tokens, or private keys, even revoked ones.
+- Cases derived from a real repository without attribution and a license check
+  (see plan.md, gate D).
+
+Because the corpus is licensed CC BY 4.0, anything added to it becomes public and
+redistributable. Treat a contribution as permanent.
+
+## Reporting a problem
+
+If you find a case that exposes a live issue in a real project, or a vulnerability in the
+harness itself (for example, a way a crafted `case.yaml` could read files outside its
+directory), please report it privately rather than opening a public issue.
+
+Use GitHub's private vulnerability reporting: open the repository's **Security** tab and
+choose **Report a vulnerability**. Only the maintainers can see the report.
+
+## Supported versions
+
+Pre-alpha. There are no supported releases yet.

actionsbench-0.1.1/corpus/CHANGELOG.md

@@ -0,0 +1,59 @@
+# Corpus changelog
+
+Corpus versions are immutable once released. A new version adds or amends cases; it never
+silently rewrites old ones. Each case records the version that introduced it in `added_in`.
+
+## 0.1.1 (2026-10-06)
+
+The corpus is unchanged from 0.1.0: the same 44 cases with the same labels. This release changes how it is
+packaged. The wheel now bundles the corpus and both licenses, so a `pip install` is usable on its own, and the
+CLI falls back to the bundled corpus when there is no `corpus/cases` in the working directory. The version of
+0.1.0's wheel did not contain the corpus.
+
+## 0.1.0 (2026-10-04)
+
+Seed set of 44 cases (26 positive, 18 negative), all `proposed`.
+
+Injection (first batch):
+
+- AB-INJ-0001: untrusted value wrapped in `format()`
+- AB-INJ-0002: `contains(...) && untrusted value`
+- AB-INJ-0003: untrusted value passed through `toJSON()`
+- AB-INJ-0004: branch name (`github.ref_name`)
+- AB-INJ-0005: commit author name (`head_commit.author.name`)
+- AB-INJ-0006: untrusted value in an `actions/github-script` script
+- AB-INJ-0007: composite action sink with a tainted input and shallow indentation
+- AB-NEG-0001: untrusted value passed through an environment variable
+- AB-NEG-0002: `contains()` used as a boolean condition only
+
+Other classes (second batch, each positive has a clean twin):
+
+- AB-PIN-0001, AB-PIN-0002: action referenced by a tag, by a branch
+- AB-PRM-0001: `permissions: write-all`
+- AB-TRG-0001: `pull_request_target` checking out and building the pull request head
+- AB-SEC-0001: `secrets: inherit` to a reusable workflow
+- AB-KVC-0001: action pinned inside a published advisory's vulnerable range
+- AB-RUN-0001: retired `ubuntu-18.04` runner image
+- AB-CTL-0001: constant `if` condition
+- AB-ART-0001: checkout credentials uploaded in an artifact
+- AB-NEG-0003 to 0009: clean twins for the above
+
+Third batch (harder variants and more than one positive per class, each with a clean twin):
+
+- AB-INJ-0008: untrusted value on a deep line of a multi-line script
+- AB-INJ-0009, AB-INJ-0010: issue title, review comment body
+- AB-PIN-0003: reusable workflow referenced by a tag
+- AB-PRM-0002: workflow-level `contents: write`
+- AB-SEC-0002: hardcoded container registry password
+- AB-SEC-0003: `toJSON(secrets)` in a step's environment
+- AB-KVC-0002: `shivammathur/setup-php` 2.37.0, inside GHSA-pqwm-q9pv-ph8r's vulnerable range
+- AB-RUN-0002: retired `macos-10.15` runner image
+- AB-ART-0002: archive downloaded and unpacked without an integrity check
+- AB-NEG-0010 to 0018: clean twins and probes (a `pull_request_target` trigger with nothing untrusted,
+  a multi-line script via the environment, safe contexts, a pinned reusable workflow, credentials
+  from secrets, one named secret, patched setup-php, `macos-latest`, a verified download)
+
+Before this release an evidence audit checked the facts behind every label (docs/evidence-audit.md). It
+corrected AB-ART-0001 and AB-NEG-0008, whose first draft pinned a checkout version where the described
+weakness does not exist (they now pin 4.2.2), and it demonstrated the injection cases with GitHub's own
+expression engine. No label has been independently reviewed: every case is still `proposed`.