Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-branch-preview.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/deploy-branch-preview.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-branch-preview.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/deploy-branch-preview.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-latest.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/deploy-latest.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-latest.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/deploy-latest.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-latest.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/deploy-latest.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/deploy-latest.yml:105: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/deploy-latest.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/documentation-links.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/documentation-links.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/prettier.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/prettier.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/prettier.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/prettier.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:94: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/publish.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/publish.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/publish.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/publish.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/publish.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/publish.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/publish.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/publish.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish.yml:77: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/publish.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/push_docker_tag.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/push_docker_tag.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spellcheck.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/spellcheck.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spellcheck.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/spellcheck.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-coverage.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/test-coverage.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-coverage.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/test-coverage.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-coverage.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/test-coverage.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-pyodide.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/test-pyodide.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-pyodide.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/test-pyodide.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-pyodide.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/test-pyodide.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sqlite-support.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/test-sqlite-support.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sqlite-support.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/test-sqlite-support.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/test.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tmate-mac.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/tmate-mac.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/tmate-mac.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/tmate-mac.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tmate.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/tmate.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/tmate.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/simonw/datasette/tmate.yml/main?enable=pin
Warn: containerImage not pinned by hash: Dockerfile:1
Warn: containerImage not pinned by hash: demos/apache-proxy/Dockerfile:1: pin your Docker image by updating python:3.11.0-slim-bullseye to python:3.11.0-slim-bullseye@sha256:b5ee5360b357dcd0ab2e1cc5e22fa589b6734bbd55776df6b1700994febf1527
Warn: pipCommand not pinned by hash: Dockerfile:13-15
Warn: pipCommand not pinned by hash: demos/apache-proxy/Dockerfile:28-30
Warn: pipCommand not pinned by hash: .github/workflows/deploy-branch-preview.yml:22
Warn: pipCommand not pinned by hash: .github/workflows/deploy-latest.yml:32
Warn: pipCommand not pinned by hash: .github/workflows/deploy-latest.yml:33
Warn: pipCommand not pinned by hash: .github/workflows/deploy-latest.yml:34
Warn: pipCommand not pinned by hash: .github/workflows/deploy-latest.yml:35
Warn: pipCommand not pinned by hash: .github/workflows/publish.yml:26
Warn: pipCommand not pinned by hash: .github/workflows/publish.yml:47
Warn: pipCommand not pinned by hash: .github/workflows/publish.yml:68
Warn: pipCommand not pinned by hash: .github/workflows/publish.yml:69
Warn: pipCommand not pinned by hash: .github/workflows/spellcheck.yml:21
Warn: pipCommand not pinned by hash: .github/workflows/test-coverage.yml:27
Warn: pipCommand not pinned by hash: .github/workflows/test-coverage.yml:28
Warn: pipCommand not pinned by hash: .github/workflows/test-coverage.yml:29
Warn: pipCommand not pinned by hash: .github/workflows/test-pyodide.yml:29
Warn: pipCommand not pinned by hash: .github/workflows/test-sqlite-support.yml:48
Warn: pipCommand not pinned by hash: .github/workflows/test.yml:28
Warn: pipCommand not pinned by hash: .github/workflows/test.yml:39
Warn: pipCommand not pinned by hash: .github/workflows/test.yml:51
Info: 0 out of 28 GitHub-owned GitHubAction dependencies pinned
Info: 1 out of 8 third-party GitHubAction dependencies pinned
Info: 0 out of 20 pipCommand dependencies pinned
Info: 1 out of 1 npmCommand dependencies pinned
Info: 0 out of 2 containerImage dependencies pinned