Info: Possibly incomplete results: error parsing shell code: & can only immediately follow a statement: eng/docker/libraries-sdk.windows.Dockerfile:17
Info: Possibly incomplete results: error parsing shell code: & can only immediately follow a statement: eng/docker/libraries-sdk.windows.Dockerfile:26
Info: Possibly incomplete results: error parsing shell code: "fi" can only be used to end an if: eng/testing/RunnerTemplate.sh:0
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/aspnetcore-sync.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/dotnet/runtime/aspnetcore-sync.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/aspnetcore-sync.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/dotnet/runtime/aspnetcore-sync.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/aspnetcore-sync.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/dotnet/runtime/aspnetcore-sync.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/aspnetcore-sync.yml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/dotnet/runtime/aspnetcore-sync.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bump-chrome-version.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/dotnet/runtime/bump-chrome-version.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/bump-chrome-version.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/dotnet/runtime/bump-chrome-version.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/jit-format.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/dotnet/runtime/jit-format.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/jit-format.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/dotnet/runtime/jit-format.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/jit-format.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/dotnet/runtime/jit-format.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/jit-format.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/dotnet/runtime/jit-format.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/locker.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/dotnet/runtime/locker.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/markdownlint.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/dotnet/runtime/markdownlint.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/markdownlint.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/dotnet/runtime/markdownlint.yml/main?enable=pin
Warn: containerImage not pinned by hash: .devcontainer/Dockerfile:5
Warn: containerImage not pinned by hash: .devcontainer/android/Dockerfile:2
Warn: containerImage not pinned by hash: .devcontainer/wasm-multiThreaded/Dockerfile:5
Warn: containerImage not pinned by hash: .devcontainer/wasm/Dockerfile:5
Warn: containerImage not pinned by hash: eng/docker/libraries-sdk.linux.Dockerfile:5
Warn: containerImage not pinned by hash: eng/docker/libraries-sdk.linux.Dockerfile:13
Warn: containerImage not pinned by hash: eng/docker/libraries-sdk.windows.Dockerfile:4
Warn: containerImage not pinned by hash: src/coreclr/nativeaot/docs/Dockerfile.cross-build-x64-arm64:1: pin your Docker image by updating mcr.microsoft.com/dotnet-buildtools/prereqs:cbl-mariner-2.0-cross-arm64 to mcr.microsoft.com/dotnet-buildtools/prereqs:cbl-mariner-2.0-cross-arm64@sha256:bb7b233fe96aa1575c7904574f28c55b6b9a669fa1a0c2675ae5f4f601c662cf
Warn: containerImage not pinned by hash: src/coreclr/nativeaot/docs/Dockerfile.cross-build-x64-x64:1: pin your Docker image by updating mcr.microsoft.com/dotnet-buildtools/prereqs:cbl-mariner-2.0-cross-amd64 to mcr.microsoft.com/dotnet-buildtools/prereqs:cbl-mariner-2.0-cross-amd64@sha256:cfe2db061ad8014f0190e6207136da858180b65b93ffdae7ce27be588e48c725
Warn: containerImage not pinned by hash: src/libraries/Common/tests/System/Net/EnterpriseTests/setup/apacheweb/Dockerfile:1: pin your Docker image by updating mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-18.04 to mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-18.04@sha256:05f14dedfb8c861678be8885509419d79c0dccb0d34a3367fe790c78f94df2f3
Warn: containerImage not pinned by hash: src/libraries/Common/tests/System/Net/EnterpriseTests/setup/kdc/Dockerfile:1: pin your Docker image by updating mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-18.04 to mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-18.04@sha256:05f14dedfb8c861678be8885509419d79c0dccb0d34a3367fe790c78f94df2f3
Warn: containerImage not pinned by hash: src/libraries/Common/tests/System/Net/EnterpriseTests/setup/linuxclient/Dockerfile:1: pin your Docker image by updating mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-22.04 to mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-22.04@sha256:17ea9eec6c53fe90f4b43ac193fb29786fd64c88c3b7754730a2d35450472d99
Warn: containerImage not pinned by hash: src/libraries/System.Net.Http/tests/StressTests/HttpStress/Dockerfile:2
Warn: containerImage not pinned by hash: src/libraries/System.Net.Http/tests/StressTests/HttpStress/windows.Dockerfile:3
Warn: containerImage not pinned by hash: src/libraries/System.Net.Security/tests/StressTests/SslStress/Dockerfile:2
Warn: containerImage not pinned by hash: src/libraries/System.Net.Security/tests/StressTests/SslStress/windows.Dockerfile:3
Warn: containerImage not pinned by hash: src/tests/FunctionalTests/Android/Device_Emulator/gRPC/grpc-dotnet/testassets/Dockerfile:1
Warn: containerImage not pinned by hash: src/tests/FunctionalTests/Android/Device_Emulator/gRPC/grpc-dotnet/testassets/Dockerfile:12: pin your Docker image by updating mcr.microsoft.com/dotnet/aspnet:6.0 to mcr.microsoft.com/dotnet/aspnet:6.0@sha256:e70c493f8af7f95bf459cb2b15c7e7a6173228929c2b7a9a6836b19377890e78
Warn: downloadThenRun not pinned by hash: eng/docker/libraries-sdk.linux.Dockerfile:24
Warn: nugetCommand not pinned by hash: src/tests/FunctionalTests/Android/Device_Emulator/gRPC/grpc-dotnet/testassets/Dockerfile:8: pin your dependecies by either enabling central package management (https://learn.microsoft.com/nuget/consume-packages/Central-Package-Management) or using a lockfile (https://learn.microsoft.com/nuget/consume-packages/package-references-in-project-files#locking-dependencies)
Warn: downloadThenRun not pinned by hash: eng/install-nuget-credprovider.sh:24
Warn: npmCommand not pinned by hash: .github/workflows/locker.yml:33
Warn: npmCommand not pinned by hash: .github/workflows/markdownlint.yml:28
Info: 0 out of 12 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 1 third-party GitHubAction dependencies pinned
Info: 0 out of 18 containerImage dependencies pinned
Info: 0 out of 2 downloadThenRun dependencies pinned
Info: 0 out of 1 nugetCommand dependencies pinned
Info: 0 out of 2 npmCommand dependencies pinned