All issues

Search results

platform mode: non-root image cannot read the runner's root-owned checkout, 5 controls turn not_evaluable

Status: Open.

#464 In getplumber/plumber;

· thomasboni opened on Sep 10, 2026

BUG: ISSUE-707 is never evaluated for job-level reusable workflow uses

Status: Open.

#462 In getplumber/plumber;

· SaboniAmine opened on Sep 9, 2026

BUG: ISSUE-707 goes silent when the upstream lookup fails, and the run is not marked degraded

Status: Open.

#461 In getplumber/plumber;

· SaboniAmine opened on Sep 9, 2026

Empty control config: score as not_evaluable rather than a vacuous 100

Status: Open.

#459 In getplumber/plumber;

· thomasboni opened on Sep 7, 2026

Dismissal propagation: fetch dismissed_issues from /context, mark findings, exclude from score

Status: Open.

#447 In getplumber/plumber;

· thomasboni opened on Sep 7, 2026

--score-push reports success but the score is never published (0.4.51; 0.4.22 works)

Status: Open.

#445 In getplumber/plumber;

· stephrobert opened on Sep 6, 2026

Unknown control "containerImageMustBePinnedByDigest"

Status: Open.

Bug

#429 In getplumber/plumber;

· horkko opened on Aug 21, 2026

[FEAT] ISSUE-701 should treat tags backed by immutable releases as pinned

Status: Open.

Feature

#421 In getplumber/plumber;

· thomasboni opened on Aug 17, 2026

ISSUE-705 remediation guidance is unactionable for setup-* managed caches

cliCommand-line interfaceCommand-line interface

controls

Status: Open.

Feature

#409 In getplumber/plumber;

· Totara-thib opened on Aug 12, 2026

identity: give the prose-identified controls structured subject keys (next RecipeVersion bump)

Status: Open.

#407 In getplumber/plumber;

· thomasboni opened on Aug 10, 2026

Declare variable-value provenance in control findings (unblocks two controls whose pushes are rejected today)

Status: Open.

#400 In getplumber/plumber;

· thomasboni opened on Aug 7, 2026

Detect workflows using long-lived cloud keys instead of OIDC

Status: Open.

Feature

#399 In getplumber/plumber;

· thomasboni opened on Aug 5, 2026