Repository: grafana/grafana-plugin-examples
Pull request #537: Workflow: Generate examples from actions
Author: login: academo
Labels: name: enhancement
description: New feature or request
name: github_actions
description: Pull requests that update GitHub Actions code
Created: 2025-05-20T13:51:07Z | Merged: 2025-05-21T11:28:59Z

* Introduces the update-examples-workflow
* Removes the update workflow (not necessary anymore)
* Removes the dependabot configuration for examples (not necessary anymore)

The new workflow will trigger weekly, manual trigger, or external trigger (to trigger it from create-plugin repository itself). 

This workflow will re-scaffold all the plugins in this repository and open a PR with the changes (if any)


Diff:
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a57e10e24..9ceb720bb 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,76 +7,3 @@ updates:
     open-pull-requests-limit: 2
     reviewers:
       - "grafana/plugins-platform"
-
-  - package-ecosystem: "npm"
-    directory: "/app-basic"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 5
-    reviewers:
-      - "grafana/plugins-platform-frontend"
-
-  - package-ecosystem: "npm"
-    directory: "/app-with-dashboards"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 3
-    reviewers:
-      - "grafana/plugins-platform-frontend"
-
-  - package-ecosystem: "npm"
-    directory: "/datasource-basic"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 3
-    reviewers:
-      - "grafana/plugins-platform-frontend"
-
-  - package-ecosystem: "npm"
-    directory: "/datasource-http"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 3
-    reviewers:
-      - "grafana/plugins-platform-frontend"
-  
-  
-  - package-ecosystem: "npm"
-    directory: "/datasource-http-backend"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 3
-    reviewers:
-      - "grafana/plugins-platform-frontend"
-  
-  - package-ecosystem: "npm"
-    directory: "/datasource-streaming-websocket"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 3
-    reviewers:
-      - "grafana/plugins-platform-frontend"
-  
-  - package-ecosystem: "npm"
-    directory: "/panel-basic"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 3
-    reviewers:
-      - "grafana/plugins-platform-frontend"
-
-  - package-ecosystem: "npm"
-    directory: "/panel-datalinks"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 3
-    reviewers:
-      - "grafana/plugins-platform-frontend"
-
-  - package-ecosystem: "npm"
-    directory: "/panel-frame-select"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 3
-    reviewers:
-      - "grafana/plugins-platform-frontend"
\ No newline at end of file
diff --git a/.github/workflows/automatic-update.yml b/.github/workflows/automatic-update.yml
deleted file mode 100644
index 74c05ae7d..000000000
--- a/.github/workflows/automatic-update.yml
+++ /dev/null
@@ -1,83 +0,0 @@
-name: Update Grafana Version
-
-on:
-  schedule:
-    - cron: "0 8 * * *"
-  workflow_dispatch:
-
-jobs:
-  update-grafana:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      id-token: write
-    steps:
-      - id: get-secrets
-        uses: grafana/shared-workflows/actions/get-vault-secrets@28361cdb22223e5f1e34358c86c20908e7248760 # get-vault-secrets-v1.1.0
-        with:
-          # Secrets placed in the ci/repo/grafana/grafana-plugin-examples path in Vault
-          repo_secrets: |
-            GITHUB_APP_ID=plugins-platform-bot-app:app_id
-            GITHUB_APP_PRIVATE_KEY=plugins-platform-bot-app:app_pem
-
-      - name: Generate token
-        id: generate_token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        with:
-          app-id: ${{ env.GITHUB_APP_ID }}
-          private-key: ${{ env.GITHUB_APP_PRIVATE_KEY }}
-
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Update Grafana version
-        run: |
-          bash scripts/update-grafana-version.sh
-
-      - name: Check for changes
-        id: status
-        run: |
-          if [[ -n "$(git status --porcelain)" ]]; then
-            echo "Has changes to commit"
-            echo "has_changes=true" >> $GITHUB_OUTPUT
-          else
-            echo "No changes to commit"
-            echo "has_changes=false" >> $GITHUB_OUTPUT
-          fi
-      - name: Create PR
-        id: create_pr
-        if: ${{ steps.status.outputs.has_changes == 'true' }}
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
-        with:
-          token: ${{ steps.generate_token.outputs.token }}
-          branch: new-update-plugin-examples
-          # If running this workflow via a workflow_dispatch event, we want to target the main branch
-          base: main
-          #  Author field is ignored when sign-commits is set to true
-          # author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
-          delete-branch: true
-          commit-message: "chore: update configuration to latest version"
-          sign-commits: true
-          title: "Chore: Bump plugin-examples configuration to latest version"
-          body: |
-            Bumps [`grafana-plugin-examples`](https://github.com/grafana/grafana-plugin-examples) configuration to the latest version.
-
-            **Notes for reviewer:**
-            This is an auto-generated PR which ran `npx -y @grafana/create-plugin@latest update`, updates plugin.json files, grafana-plugin-sdk-go and docker-compose files for each plugin example
-
-      - name: Enable auto-merge for PR
-        if: steps.status.outputs.has_changes == 'true'
-        run: gh pr merge $PR_URL --auto --squash
-        env:
-          PR_URL: https://github.com/grafana/grafana-plugin-examples/pull/${{ steps.create_pr.outputs.pull-request-number }}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-
-      - name: Auto approve PR
-        if: steps.status.outputs.has_changes == 'true'
-        run: gh pr review $PR_URL --approve -b "Approving update"
-        env:
-          PR_URL: https://github.com/grafana/grafana-plugin-examples/pull/${{ steps.create_pr.outputs.pull-request-number }}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
diff --git a/.github/workflows/update-examples.yaml b/.github/workflows/update-examples.yaml
new file mode 100644
index 000000000..ed5d96f06
--- /dev/null
+++ b/.github/workflows/update-examples.yaml
@@ -0,0 +1,79 @@
+name: Update plugin examples from create-plugin
+
+on:
+  schedule:
+    - cron: "0 0 * * 0" # Run weekly (every Sunday at midnight UTC)
+  workflow_dispatch: # Enable manual trigger
+  repository_dispatch: # To trigger from plugin-tools
+
+jobs:
+  update-examples:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          # require for PR action
+          persist-credentials: true
+
+      - name: Setup nodejs 22
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+
+      - name: Generate Basic Panel
+        shell: bash
+        run: |
+          rm -rf examples/panel-basic
+          npx -y @grafana/create-plugin@latest --plugin-name=basic --org-name=myorg --plugin-type=panel --no-backend
+          mv myorg-basic-panel examples/panel-basic
+
+      - name: Generate Basic Datasource
+        shell: bash
+        run: |
+          rm -rf examples/datasource-basic
+          npx -y @grafana/create-plugin@latest --plugin-name=basic --org-name=myorg --plugin-type=datasource --no-backend
+          mv myorg-basic-datasource examples/datasource-basic
+
+      - name: Generate Basic App
+        shell: bash
+        run: |
+          rm -rf examples/app-basic
+          npx -y @grafana/create-plugin@latest --plugin-name=basic --org-name=myorg --plugin-type=app --no-backend
+          mv myorg-basic-app examples/app-basic
+
+      - name: Generate Backend Datasource
+        shell: bash
+        run: |
+          rm -rf examples/datasource-with-backend
+          npx -y @grafana/create-plugin@latest --plugin-name=backend --org-name=myorg --plugin-type=datasource --backend
+          mv myorg-backend-datasource examples/datasource-with-backend
+
+      - name: Generate Backend App
+        shell: bash
+        run: |
+          rm -rf examples/app-with-backend
+          npx -y @grafana/create-plugin@latest --plugin-name=backend --org-name=myorg --plugin-type=app --backend
+          mv myorg-backend-app examples/app-with-backend
+
+      - name: Run npm install for each package.json in examples
+        shell: bash
+        run: |
+          find examples -name "package.json" -execdir npm install \;
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          title: "Chore: Update plugin examples to latest version"
+          commit-message: "Automated update to latest version"
+          body: |
+            This is an auto-generated PR
+            
+            It updates all the examples based on the latest version of create-plugin.
+          branch: update-plugin-examples
+          delete-branch: true
+          base: main
+
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index bde0c3b9a..ed6e059dc 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -21,9 +21,11 @@ The Project Team looks forward to your contributions. 🙌🏾✨
 
 ## Report an Error or Bug
 
+The examples in this repository are auto-generated from [create-plugin](https://github.com/grafana/plugin-tools/tree/main/packages/create-plugin).
+
 If you run into an error or bug with the project:
 
-- Open an Issue at https://github.com/grafana/grafana-plugin-examples/issues
+- Open an Issue at [https://github.com/grafana/plugin-tools/issues](https://github.com/grafana/plugin-tools/issues).
 - Include _reproduction steps_ that someone else can follow to recreate the bug or error on their own.
 - Provide project and platform versions (nodejs, npm, etc), depending on what seems relevant. If not, please be ready to provide that information if maintainers ask for it.
 
@@ -36,9 +38,8 @@ Once it's filed:
 
 ## Request a new example or extension to an existing template
 
-If our examples don't cover your use case and you would like to see a new template project available:
+The examples in this repository were generated from [create-plugin](https://github.com/grafana/plugin-tools/tree/main/packages/create-plugin). If you want to add a new example or extension to an existing template, you can [open a new issue](https://github.com/grafana/plugin-tools/issues) there.
 
-- Open an Issue at https://github.com/grafana/grafana-plugin-examples/issues
 - Provide as much context as you can about what you are trying to do.
 - Please indicate whether it should be incorporated within an existing template or a new example.
 
diff --git a/README.md b/README.md
index caaff301b..0b0b34d1b 100644
--- a/README.md
+++ b/README.md
@@ -2,23 +2,27 @@
 
 This repository contains example plugins to showcase different use cases.
 
+The examples in this website were auto-generated from the existing templates in [create-plugin](https://github.com/grafana/plugin-tools/tree/main/packages/create-plugin).
+
 ## App plugins
 
-| Example                                                       | Description                                                                                |
-| ------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
-| [app-basic](examples/app-basic)                               | Shows how to build a basic app plugin that uses custom routing                             |
+| Example                                       | Description                                                                                |
+| --------------------------------------------- | ------------------------------------------------------------------------------------------ |
+| [app-basic](examples/app-basic)               | Shows how to build a basic app plugin that uses custom routing                             |
+| [app-with-backend](examples/app-with-backend) | Shows how to build a basic app plugin that uses custom routing and has a backend component |
 
 ## Panel plugins
 
-| Example                                           | Description                                                                                                                       |
-| ------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
-| [panel-basic](examples/panel-basic)               | Shows how to build a panel plugin that uses the time series graph from `@grafana/ui` to read and update the dashboard time range. |
+| Example                             | Description                                                                                                                       |
+| ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
+| [panel-basic](examples/panel-basic) | Shows how to build a panel plugin that uses the time series graph from `@grafana/ui` to read and update the dashboard time range. |
 
 ## Data source plugins
 
-| Example                                                                                   | Description                                                                                                   |
-| ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
-| [datasource-basic](examples/datasource-basic)                                             | Shows how to build a basic data source plugin.                                                                |
+| Example                                                     | Description                                                                |
+| ----------------------------------------------------------- | -------------------------------------------------------------------------- |
+| [datasource-basic](examples/datasource-basic)               | Shows how to build a basic data source plugin.                             |
+| [datasource-with-backend](examples/datasource-with-backend) | Shows how to build a basic data source plugin and has a backend component. |
 
 > [!NOTE]
 > The plugin examples in this repository use NPM to manage frontend dependencies. Whilst you are welcome to copy these examples and use Yarn or PNPM instead, we offer no support for them.
@@ -83,7 +87,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: "22"
       - name: Install dependencies
         run: npm install
       - name: Build plugin
@@ -91,9 +95,9 @@ jobs:
       - name: Compatibility check
         uses: grafana/plugin-actions/is-compatible@main
         with:
-          module: './src/module.ts'
-          comment-pr: 'yes'
-          fail-if-incompatible: 'no'
+          module: "./src/module.ts"
+          comment-pr: "yes"
+          fail-if-incompatible: "no"
 ```
 
 This runs a compatibility check for the latest release of Grafana plugins API in your project every time a new push or pull request is open. If it finds an error you will see a message indicating you have an incompatibility.


Reviews:
user: login: github-advanced-security[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-05-20T14:19:44Z
user: login: github-advanced-security[bot]
body: zizmor found more than 20 potential problems in the proposed changes. Check the [Files changed](/grafana/grafana-plugin-examples/pull/537/files) tab for more details.
state: COMMENTED
author_association: NONE
submitted_at: 2025-05-20T14:41:43Z
user: login: academo
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-20T15:14:12Z
user: login: xnyo
body: Awesome work! Some comments but I like this approach!
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-05-20T16:50:41Z
user: login: academo
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-21T07:40:58Z
user: login: academo
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-21T07:43:12Z
user: login: jackw
body: I'm wondering if it would be simpler to not use a matrix with multiple jobs and artifacts for this and instead clone the repo, trash the directories inside `examples` and then run the 5 lines of `npx @grafana/create-plugin ...args` back to back. If we want to validate the updates are good we already have the integration tests to validate that the re-generated examples are good to go. Can always add a slack notification to that. 🤔 

The current workflow is already using hardcoded values for the artifacts which if we introduced another example (like scenes app) would require multiple changes rather than adding a single line of `npx @grafana/create-plugin...` if we drop the matrix n artifacts.
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-21T08:21:16Z
user: login: academo
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-21T09:31:00Z
user: login: jackw
body: LGTM! 🚀 
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-21T09:48:52Z

Review comments:
diff_hunk: @@ -0,0 +1,194 @@
+name: Update plugin examples from create-plugin
+
+on:
+  schedule:
+    - cron: "0 0 * * 0" # Run weekly (every Sunday at midnight UTC)
+  workflow_dispatch: # Enable manual trigger
+  repository_dispatch: # Enable external trigger
+  push:
+    branches:
+      - academo/scaffold-basic-examples
+
+jobs:
+  generate-new-examples:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        # examples: ['panel-basic', 'datasource-basic', 'app-basic', 'datasource-backend', 'app-backend']
+        examples: ['panel-basic', 'datasource-basic']
+        include:
+          - examples: panel-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: panel
+            has-backend: false
+            artifact-name: basic-panel
+          - examples: datasource-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: datasource
+            has-backend: false
+            artifact-name: basic-datasource
+          # - examples: app-basic
+          #   plugin-name: basicscaffold
+          #   plugin-org: grafana
+          #   plugin-type: app
+          #   has-backend: false
+          #   artifact-name: basic-app
+          # - examples: datasource-backend
+          #   plugin-name: backendscaffold
+          #   plugin-org: grafana
+          #   plugin-type: datasource
+          #   has-backend: true
+          #   artifact-name: backend-datasource
+          # - examples: app-backend
+          #   plugin-name: backendscaffold
+          #   plugin-org: grafana
+          #   plugin-type: app
+          #   has-backend: true
+          #   artifact-name: backend-app
+    steps:
+      - name: Setup nodejs 22
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+
+      - name: Run create plugin
+        id: generate
+        shell: bash
+        run: |
+          CMD_ARGS="--plugin-name=${PLUGIN_NAME} --org-name=${PLUGIN_ORG} --plugin-type=${PLUGIN_TYPE}"
+          # based on has-backend pass --backend or --no-backend
+          if [ "${HAS_BACKEND}" = "true" ]; then
+            CMD_ARGS="$CMD_ARGS --backend"
+          else
+            CMD_ARGS="$CMD_ARGS --no-backend"
+          fi
+          npx -y @grafana/create-plugin@latest $(echo $CMD_ARGS)
+          DIR_NAME="$PLUGIN_ORG-$PLUGIN_NAME-$PLUGIN_TYPE"
+          echo "plugin-dir=$DIR_NAME" >> $GITHUB_OUTPUT
+          echo "Plugin Generated at $DIR_NAME"
+        env:
+          PLUGIN_NAME: ${{ matrix.plugin-name }}
+          PLUGIN_ORG: ${{ matrix.plugin-org }}
+          PLUGIN_TYPE: ${{ matrix.plugin-type }}
+          HAS_BACKEND: ${{ matrix.has-backend }}
+
+
+      # UNCOMMENT BEFORE PR OR MERGE!
+      # - name: Setup Go environment
+      #   if: matrix.has-backend == 'true'
+      #   shell: bash
+      #   run: |
+      #     echo "uses go"
+      #
+      # - name: Setup Go environment
+      #   if: matrix.has-backend == 'true'
+      #   uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      #   with:
+      #     go-version-file: './${{ steps.generate.outputs.plugin-dir }}/go.mod'
+      #
+      # - name: Build backend
+      #   if: matrix.has-backend == 'true'
+      #   uses: magefile/mage-action@6f50bbb8ea47d56e62dee92392788acbc8192d0b # v3.1.0
+      #   with:
+      #     version: latest
+      #     args: build:linux
+      #     workdir: ${{ steps.generate.outputs.plugin-dir }}
+      #
+      # - name: Build plugin frontend
+      #   id: build
+      #   shell: bash
+      #   run: |
+      #     npm install
+      #     npm run build
+      #   working-directory: ${{ steps.generate.outputs.plugin-dir }}
+      #
+      - name: Upload math result for job 1
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{matrix.artifact-name}}
+          path: ./${{steps.generate.outputs.plugin-dir}}
+          if-no-files-found: error
+          overwrite: true
+          include-hidden-files: true
+
+
+  update-examples:
+    runs-on: ubuntu-latest
+    needs: generate-new-examples
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: ls examples
+        shell: bash
+        run: |
+          ls examples
+
+
+      - name: Download basic-panel
+        uses: actions/download-artifact@v4
+        with:
+          name: basic-panel
+          path: ./basic-panel
+
+      - name: Download basic-datasource
+        uses: actions/download-artifact@v4
+        with:
+          name: basic-datasource
+          path: ./basic-datasource
+
+      # - name: Download basic-app
+      #   uses: actions/download-artifact@v4
+      #   with:
+      #     name: basic-app
+      #     path: ./basic-app
+
+      # - name: Download backend-datasource
+      #   uses: actions/download-artifact@v4
+      #   with:
+      #     name: backend-datasource
+      #     path: ./backend-datasource
+
+      # - name: Download backend-app
+      #   uses: actions/download-artifact@v4
+      #   with:
+      #     name: backend-app
+      #     path: ./backend-app
+
+      - name: Remove existing examples
+        shell: bash
+        run: |
+          pushd examples
+          rm -rf basic-panel basic-datasource basic-app backend-datasource backend-app
+          popd
+
+      - name: Move new examples
+        shell: bash
+        run: |
+          mv basic-panel examples/basic-panel
+          mv basic-datasource examples/basic-datasource
+          # mv basic-app examples/basic-app
+          # mv backend-datasource examples/backend-datasource
+          # mv backend-app examples/backend-app
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v7
path: .github/workflows/update-examples.yaml
user: login: github-advanced-security[bot]
body: action is not pinned to a hash (required by blanket policy)

[Show more details](https://github.com/grafana/grafana-plugin-examples/security/code-scanning/1)
created_at: 2025-05-20T14:19:44Z
author_association: NONE
diff_hunk: @@ -0,0 +1,190 @@
+name: Update plugin examples from create-plugin
path: .github/workflows/update-examples.yaml
user: login: academo
body: This is the main file of this PR that requires review
created_at: 2025-05-20T15:14:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,190 @@
+name: Update plugin examples from create-plugin
+
+on:
+  schedule:
+    - cron: "0 0 * * 0" # Run weekly (every Sunday at midnight UTC)
+  workflow_dispatch: # Enable manual trigger
+  repository_dispatch: # To trigger from plugin-tools
+
+jobs:
+  generate-new-examples:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        examples: ['panel-basic', 'datasource-basic', 'app-basic', 'datasource-with-backend', 'app-with-backend']
path: .github/workflows/update-examples.yaml
user: login: xnyo
body: Nit: maybe move the list to different lines for better readability?

```suggestion
        examples:
          - panel-basic
          - datasource-basic
          - app-basic
          - datasource-with-backend
          - app-with-backend
```
created_at: 2025-05-20T15:25:29Z
author_association: MEMBER
diff_hunk: @@ -0,0 +1,190 @@
+name: Update plugin examples from create-plugin
+
+on:
+  schedule:
+    - cron: "0 0 * * 0" # Run weekly (every Sunday at midnight UTC)
+  workflow_dispatch: # Enable manual trigger
+  repository_dispatch: # To trigger from plugin-tools
+
+jobs:
+  generate-new-examples:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        examples: ['panel-basic', 'datasource-basic', 'app-basic', 'datasource-with-backend', 'app-with-backend']
+        include:
+          - examples: panel-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: panel
+            has-backend: false
+            artifact-name: panel-basic
+          - examples: datasource-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: datasource
+            has-backend: false
+            artifact-name: datasource-basic
+          - examples: app-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: app
+            has-backend: false
+            artifact-name: app-basic
+          - examples: datasource-with-backend
+            plugin-name: backend
+            plugin-org: grafana
+            plugin-type: datasource
+            has-backend: true
+            artifact-name: datasource-with-backend
+          - examples: app-with-backend
+            plugin-name: backend
+            plugin-org: grafana
+            plugin-type: app
+            has-backend: true
+            artifact-name: app-with-backend
+    steps:
+      - name: Setup nodejs 22
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+
+      - name: Run create plugin
+        id: generate
+        shell: bash
+        run: |
+          CMD_ARGS="--plugin-name=${PLUGIN_NAME} --org-name=${PLUGIN_ORG} --plugin-type=${PLUGIN_TYPE}"
+          # based on has-backend pass --backend or --no-backend
+          if [ "${HAS_BACKEND}" = "true" ]; then
+            CMD_ARGS="$CMD_ARGS --backend"
+          else
+            CMD_ARGS="$CMD_ARGS --no-backend"
+          fi
+          npx -y @grafana/create-plugin@latest $(echo $CMD_ARGS)
+          DIR_NAME="$PLUGIN_ORG-$PLUGIN_NAME-$PLUGIN_TYPE"
+          echo "plugin-dir=$DIR_NAME" >> $GITHUB_OUTPUT
+          echo "Plugin Generated at $DIR_NAME"
+        env:
+          PLUGIN_NAME: ${{ matrix.plugin-name }}
+          PLUGIN_ORG: ${{ matrix.plugin-org }}
+          PLUGIN_TYPE: ${{ matrix.plugin-type }}
+          HAS_BACKEND: ${{ matrix.has-backend }}
+
+      - name: Setup Go environment
+        if: matrix.has-backend == 'true'
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version-file: './${{ steps.generate.outputs.plugin-dir }}/go.mod'
+
+      - name: Build backend
+        if: matrix.has-backend == 'true'
+        uses: magefile/mage-action@6f50bbb8ea47d56e62dee92392788acbc8192d0b # v3.1.0
+        with:
+          version: latest
+          args: build:linux
+          workdir: ${{ steps.generate.outputs.plugin-dir }}
+
+      - name: Build plugin frontend
+        id: build
+        shell: bash
+        run: |
+          npm install
+          npm run build
+        working-directory: ${{ steps.generate.outputs.plugin-dir }}
path: .github/workflows/update-examples.yaml
user: login: xnyo
body: Do we run these to validate that the plugin can be built/compiled successfully?
created_at: 2025-05-20T16:49:32Z
author_association: MEMBER
diff_hunk: @@ -0,0 +1,190 @@
+name: Update plugin examples from create-plugin
+
+on:
+  schedule:
+    - cron: "0 0 * * 0" # Run weekly (every Sunday at midnight UTC)
+  workflow_dispatch: # Enable manual trigger
+  repository_dispatch: # To trigger from plugin-tools
+
+jobs:
+  generate-new-examples:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        examples: ['panel-basic', 'datasource-basic', 'app-basic', 'datasource-with-backend', 'app-with-backend']
+        include:
+          - examples: panel-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: panel
+            has-backend: false
+            artifact-name: panel-basic
+          - examples: datasource-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: datasource
+            has-backend: false
+            artifact-name: datasource-basic
+          - examples: app-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: app
+            has-backend: false
+            artifact-name: app-basic
+          - examples: datasource-with-backend
+            plugin-name: backend
+            plugin-org: grafana
+            plugin-type: datasource
+            has-backend: true
+            artifact-name: datasource-with-backend
+          - examples: app-with-backend
+            plugin-name: backend
+            plugin-org: grafana
+            plugin-type: app
+            has-backend: true
+            artifact-name: app-with-backend
+    steps:
+      - name: Setup nodejs 22
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+
+      - name: Run create plugin
+        id: generate
+        shell: bash
+        run: |
+          CMD_ARGS="--plugin-name=${PLUGIN_NAME} --org-name=${PLUGIN_ORG} --plugin-type=${PLUGIN_TYPE}"
+          # based on has-backend pass --backend or --no-backend
+          if [ "${HAS_BACKEND}" = "true" ]; then
+            CMD_ARGS="$CMD_ARGS --backend"
+          else
+            CMD_ARGS="$CMD_ARGS --no-backend"
+          fi
+          npx -y @grafana/create-plugin@latest $(echo $CMD_ARGS)
+          DIR_NAME="$PLUGIN_ORG-$PLUGIN_NAME-$PLUGIN_TYPE"
+          echo "plugin-dir=$DIR_NAME" >> $GITHUB_OUTPUT
+          echo "Plugin Generated at $DIR_NAME"
+        env:
+          PLUGIN_NAME: ${{ matrix.plugin-name }}
+          PLUGIN_ORG: ${{ matrix.plugin-org }}
+          PLUGIN_TYPE: ${{ matrix.plugin-type }}
+          HAS_BACKEND: ${{ matrix.has-backend }}
+
+      - name: Setup Go environment
+        if: matrix.has-backend == 'true'
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version-file: './${{ steps.generate.outputs.plugin-dir }}/go.mod'
+
+      - name: Build backend
+        if: matrix.has-backend == 'true'
+        uses: magefile/mage-action@6f50bbb8ea47d56e62dee92392788acbc8192d0b # v3.1.0
+        with:
+          version: latest
+          args: build:linux
+          workdir: ${{ steps.generate.outputs.plugin-dir }}
+
+      - name: Build plugin frontend
+        id: build
+        shell: bash
+        run: |
+          npm install
+          npm run build
+        working-directory: ${{ steps.generate.outputs.plugin-dir }}
+
+      - name: Clean up
+        shell: bash
+        run: |
+          rm -rf node_modules
+          rm -rf dist
+        working-directory: ${{ steps.generate.outputs.plugin-dir }}
+
+
+
+      - name: Upload plugin artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{matrix.artifact-name}}
+          path: ./${{steps.generate.outputs.plugin-dir}}
+          if-no-files-found: error
+          overwrite: true
+          include-hidden-files: true
+
+
+  update-examples:
+    runs-on: ubuntu-latest
+    needs: generate-new-examples
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: ls examples
+        shell: bash
+        run: |
+          ls examples
+
+
+      - name: Download panel-basic
+        uses: actions/download-artifact@v4
+        with:
+          name: panel-basic
+          path: ./panel-basic
path: .github/workflows/update-examples.yaml
user: login: xnyo
body: Can we rewrite all these download jobs with a matrix?
created_at: 2025-05-20T16:50:16Z
author_association: MEMBER
diff_hunk: @@ -0,0 +1,190 @@
+name: Update plugin examples from create-plugin
+
+on:
+  schedule:
+    - cron: "0 0 * * 0" # Run weekly (every Sunday at midnight UTC)
+  workflow_dispatch: # Enable manual trigger
+  repository_dispatch: # To trigger from plugin-tools
+
+jobs:
+  generate-new-examples:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        examples: ['panel-basic', 'datasource-basic', 'app-basic', 'datasource-with-backend', 'app-with-backend']
+        include:
+          - examples: panel-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: panel
+            has-backend: false
+            artifact-name: panel-basic
+          - examples: datasource-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: datasource
+            has-backend: false
+            artifact-name: datasource-basic
+          - examples: app-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: app
+            has-backend: false
+            artifact-name: app-basic
+          - examples: datasource-with-backend
+            plugin-name: backend
+            plugin-org: grafana
+            plugin-type: datasource
+            has-backend: true
+            artifact-name: datasource-with-backend
+          - examples: app-with-backend
+            plugin-name: backend
+            plugin-org: grafana
+            plugin-type: app
+            has-backend: true
+            artifact-name: app-with-backend
+    steps:
+      - name: Setup nodejs 22
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+
+      - name: Run create plugin
+        id: generate
+        shell: bash
+        run: |
+          CMD_ARGS="--plugin-name=${PLUGIN_NAME} --org-name=${PLUGIN_ORG} --plugin-type=${PLUGIN_TYPE}"
+          # based on has-backend pass --backend or --no-backend
+          if [ "${HAS_BACKEND}" = "true" ]; then
+            CMD_ARGS="$CMD_ARGS --backend"
+          else
+            CMD_ARGS="$CMD_ARGS --no-backend"
+          fi
+          npx -y @grafana/create-plugin@latest $(echo $CMD_ARGS)
+          DIR_NAME="$PLUGIN_ORG-$PLUGIN_NAME-$PLUGIN_TYPE"
+          echo "plugin-dir=$DIR_NAME" >> $GITHUB_OUTPUT
+          echo "Plugin Generated at $DIR_NAME"
+        env:
+          PLUGIN_NAME: ${{ matrix.plugin-name }}
+          PLUGIN_ORG: ${{ matrix.plugin-org }}
+          PLUGIN_TYPE: ${{ matrix.plugin-type }}
+          HAS_BACKEND: ${{ matrix.has-backend }}
+
+      - name: Setup Go environment
+        if: matrix.has-backend == 'true'
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version-file: './${{ steps.generate.outputs.plugin-dir }}/go.mod'
+
+      - name: Build backend
+        if: matrix.has-backend == 'true'
+        uses: magefile/mage-action@6f50bbb8ea47d56e62dee92392788acbc8192d0b # v3.1.0
+        with:
+          version: latest
+          args: build:linux
+          workdir: ${{ steps.generate.outputs.plugin-dir }}
+
+      - name: Build plugin frontend
+        id: build
+        shell: bash
+        run: |
+          npm install
+          npm run build
+        working-directory: ${{ steps.generate.outputs.plugin-dir }}
path: .github/workflows/update-examples.yaml
user: login: academo
body: Exactly! I am going to add a slack notification if they fail in a follow up PR
created_at: 2025-05-21T07:40:58Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,190 @@
+name: Update plugin examples from create-plugin
+
+on:
+  schedule:
+    - cron: "0 0 * * 0" # Run weekly (every Sunday at midnight UTC)
+  workflow_dispatch: # Enable manual trigger
+  repository_dispatch: # To trigger from plugin-tools
+
+jobs:
+  generate-new-examples:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        examples: ['panel-basic', 'datasource-basic', 'app-basic', 'datasource-with-backend', 'app-with-backend']
+        include:
+          - examples: panel-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: panel
+            has-backend: false
+            artifact-name: panel-basic
+          - examples: datasource-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: datasource
+            has-backend: false
+            artifact-name: datasource-basic
+          - examples: app-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: app
+            has-backend: false
+            artifact-name: app-basic
+          - examples: datasource-with-backend
+            plugin-name: backend
+            plugin-org: grafana
+            plugin-type: datasource
+            has-backend: true
+            artifact-name: datasource-with-backend
+          - examples: app-with-backend
+            plugin-name: backend
+            plugin-org: grafana
+            plugin-type: app
+            has-backend: true
+            artifact-name: app-with-backend
+    steps:
+      - name: Setup nodejs 22
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+
+      - name: Run create plugin
+        id: generate
+        shell: bash
+        run: |
+          CMD_ARGS="--plugin-name=${PLUGIN_NAME} --org-name=${PLUGIN_ORG} --plugin-type=${PLUGIN_TYPE}"
+          # based on has-backend pass --backend or --no-backend
+          if [ "${HAS_BACKEND}" = "true" ]; then
+            CMD_ARGS="$CMD_ARGS --backend"
+          else
+            CMD_ARGS="$CMD_ARGS --no-backend"
+          fi
+          npx -y @grafana/create-plugin@latest $(echo $CMD_ARGS)
+          DIR_NAME="$PLUGIN_ORG-$PLUGIN_NAME-$PLUGIN_TYPE"
+          echo "plugin-dir=$DIR_NAME" >> $GITHUB_OUTPUT
+          echo "Plugin Generated at $DIR_NAME"
+        env:
+          PLUGIN_NAME: ${{ matrix.plugin-name }}
+          PLUGIN_ORG: ${{ matrix.plugin-org }}
+          PLUGIN_TYPE: ${{ matrix.plugin-type }}
+          HAS_BACKEND: ${{ matrix.has-backend }}
+
+      - name: Setup Go environment
+        if: matrix.has-backend == 'true'
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version-file: './${{ steps.generate.outputs.plugin-dir }}/go.mod'
+
+      - name: Build backend
+        if: matrix.has-backend == 'true'
+        uses: magefile/mage-action@6f50bbb8ea47d56e62dee92392788acbc8192d0b # v3.1.0
+        with:
+          version: latest
+          args: build:linux
+          workdir: ${{ steps.generate.outputs.plugin-dir }}
+
+      - name: Build plugin frontend
+        id: build
+        shell: bash
+        run: |
+          npm install
+          npm run build
+        working-directory: ${{ steps.generate.outputs.plugin-dir }}
+
+      - name: Clean up
+        shell: bash
+        run: |
+          rm -rf node_modules
+          rm -rf dist
+        working-directory: ${{ steps.generate.outputs.plugin-dir }}
+
+
+
+      - name: Upload plugin artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{matrix.artifact-name}}
+          path: ./${{steps.generate.outputs.plugin-dir}}
+          if-no-files-found: error
+          overwrite: true
+          include-hidden-files: true
+
+
+  update-examples:
+    runs-on: ubuntu-latest
+    needs: generate-new-examples
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: ls examples
+        shell: bash
+        run: |
+          ls examples
+
+
+      - name: Download panel-basic
+        uses: actions/download-artifact@v4
+        with:
+          name: panel-basic
+          path: ./panel-basic
path: .github/workflows/update-examples.yaml
user: login: academo
body: I thought of it but it makes things much more complicated because each matrix runs on its own fresh clone when you do `checkout`.

It'll require me to create an unique branch name so each matrix will commit the changes to its respective example  but then you get possible conflicts depending on which job finishes first or last.

So even though this looks verbose it is the easiest way to avoid matrix conflicts as far as I know.

Do you have a different approach we can use that uses a matrix for this? 
created_at: 2025-05-21T07:43:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,190 @@
+name: Update plugin examples from create-plugin
+
+on:
+  schedule:
+    - cron: "0 0 * * 0" # Run weekly (every Sunday at midnight UTC)
+  workflow_dispatch: # Enable manual trigger
+  repository_dispatch: # To trigger from plugin-tools
+
+jobs:
+  generate-new-examples:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        examples: ['panel-basic', 'datasource-basic', 'app-basic', 'datasource-with-backend', 'app-with-backend']
+        include:
+          - examples: panel-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: panel
+            has-backend: false
+            artifact-name: panel-basic
+          - examples: datasource-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: datasource
+            has-backend: false
+            artifact-name: datasource-basic
+          - examples: app-basic
+            plugin-name: basic
+            plugin-org: grafana
+            plugin-type: app
+            has-backend: false
+            artifact-name: app-basic
+          - examples: datasource-with-backend
+            plugin-name: backend
+            plugin-org: grafana
+            plugin-type: datasource
+            has-backend: true
+            artifact-name: datasource-with-backend
+          - examples: app-with-backend
+            plugin-name: backend
+            plugin-org: grafana
+            plugin-type: app
+            has-backend: true
+            artifact-name: app-with-backend
+    steps:
+      - name: Setup nodejs 22
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+
+      - name: Run create plugin
+        id: generate
+        shell: bash
+        run: |
+          CMD_ARGS="--plugin-name=${PLUGIN_NAME} --org-name=${PLUGIN_ORG} --plugin-type=${PLUGIN_TYPE}"
+          # based on has-backend pass --backend or --no-backend
+          if [ "${HAS_BACKEND}" = "true" ]; then
+            CMD_ARGS="$CMD_ARGS --backend"
+          else
+            CMD_ARGS="$CMD_ARGS --no-backend"
+          fi
+          npx -y @grafana/create-plugin@latest $(echo $CMD_ARGS)
+          DIR_NAME="$PLUGIN_ORG-$PLUGIN_NAME-$PLUGIN_TYPE"
+          echo "plugin-dir=$DIR_NAME" >> $GITHUB_OUTPUT
+          echo "Plugin Generated at $DIR_NAME"
+        env:
+          PLUGIN_NAME: ${{ matrix.plugin-name }}
+          PLUGIN_ORG: ${{ matrix.plugin-org }}
+          PLUGIN_TYPE: ${{ matrix.plugin-type }}
+          HAS_BACKEND: ${{ matrix.has-backend }}
+
+      - name: Setup Go environment
+        if: matrix.has-backend == 'true'
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version-file: './${{ steps.generate.outputs.plugin-dir }}/go.mod'
+
+      - name: Build backend
+        if: matrix.has-backend == 'true'
+        uses: magefile/mage-action@6f50bbb8ea47d56e62dee92392788acbc8192d0b # v3.1.0
+        with:
+          version: latest
+          args: build:linux
+          workdir: ${{ steps.generate.outputs.plugin-dir }}
+
+      - name: Build plugin frontend
+        id: build
+        shell: bash
+        run: |
+          npm install
+          npm run build
+        working-directory: ${{ steps.generate.outputs.plugin-dir }}
path: .github/workflows/update-examples.yaml
user: login: academo
body: I removed the matrix entirely and I am going for a much simpler approach since we have to hardcode values anyway
created_at: 2025-05-21T09:31:00Z
author_association: CONTRIBUTOR

PR comments:
user: login: github-actions[bot]
created_at: 2025-05-20T14:19:48Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[unpinned-uses]: unpinned action reference
   --> ./.github/workflows/update-examples.yaml:182:9
    |
182 |         uses: peter-evans/create-pull-request@v7
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High

6 findings (2 ignored, 3 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 1 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-20T14:41:48Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/backend-app/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/backend-app/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/backend-app/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/backend-app/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/backend-app/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/backend-datasource/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/backend-datasource/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/backend-datasource/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/backend-datasource/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/backend-datasource/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/basic-app/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/basic-app/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/basic-app/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/basic-app/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/basic-app/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/basic-datasource/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/basic-datasource/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/basic-datasource/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/basic-datasource/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/basic-datasource/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/basic-panel/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/basic-panel/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/basic-panel/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/basic-panel/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/basic-panel/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

120 findings (62 ignored, 33 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-20T14:57:26Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

120 findings (62 ignored, 33 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-20T15:03:07Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

120 findings (62 ignored, 33 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-20T15:03:29Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

119 findings (62 ignored, 32 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-20T15:06:11Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

119 findings (62 ignored, 32 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T07:46:11Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

119 findings (62 ignored, 32 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T07:49:26Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

119 findings (62 ignored, 32 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T07:58:20Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

119 findings (62 ignored, 32 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T07:59:15Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

119 findings (62 ignored, 32 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T07:59:45Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

119 findings (62 ignored, 32 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T08:00:49Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

119 findings (62 ignored, 32 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T08:19:57Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

119 findings (62 ignored, 32 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T09:18:44Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

118 findings (60 ignored, 33 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T09:20:45Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

118 findings (60 ignored, 33 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T09:24:26Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

118 findings (60 ignored, 33 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T09:28:53Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

118 findings (60 ignored, 33 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T09:31:30Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

118 findings (60 ignored, 33 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T09:33:46Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

118 findings (60 ignored, 33 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T09:34:50Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

118 findings (60 ignored, 33 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-21T11:07:25Z
body: :cry: zizmor failed with exit code 14.

<details>
<summary>Expand for full output</summary>

```
error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/app-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/app-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/datasource-with-backend/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:14:3
   |
14 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:15:3
   |
15 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> ./examples/panel-basic/.github/workflows/ci.yml:16:3
   |
16 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:65:9
   |
65 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

error[unpinned-uses]: unpinned action reference
  --> ./examples/panel-basic/.github/workflows/ci.yml:72:9
   |
72 |         uses: magefile/mage-action@v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

119 findings (60 ignored, 34 suppressed): 0 unknown, 0 informational, 0 low, 0 medium, 25 high
```
</details>
<!-- comment-action/zizmor GitHub Actions static analysis/analysis -->
author_association: CONTRIBUTOR