CI Workflow Audit

What the provider says

Quoted from x402 Bazaar · source record · read 2026-10-26

---

Facts and where they come from

Price

0.12 USDC per call Provider claim

Recorded value: 0.12 USDC per call.

Unit

per call

Protocol

x402, REST · transport: HTTP Provider claim

Auth

x402

Endpoint

https://api.zfinia.com/x402/v1/ci-workflow-contract-audit

Source

x402 Bazaar (Coinbase CDP) · Public discovery API (provider-published records)

Last checked

Not checked by us yet — the data is as the source published it

First seen

2026-10-24

Usage

1 calls · 1 unique payers in the 30 days before 2026-10-24. Measured by the x402 Bazaar, not by us and not by the provider.

Payments and earnings

No settled payment on record. Earnings for this service are unknown — not zero. The source counts 1 calls in 30 days, which at the published price is roughly $0.12 of activity. Activity is not revenue; no charge has been reconciled for it.

Payment rails

A payment rail is where the provider asks to be paid. It is not proof that anything was paid through it. See evidence levels.

Input and output, as published

Request

{
    "body": {
        "contract": {
            "required_jobs": [
                "build",
                "publish",
                "lint"
            ]
        },
        "workflow": {
            "jobs": {
                "build": {
                    "runs-on": "ubuntu-latest",
                    "steps": [
                        {
                            "uses": "actions/checkout@v4"
                        },
                        {
                            "uses": "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"
                        },
                        {
                            "name": "Greet",
                            "run": "echo \"Building ${{ github.event.pull_request.title }}\""
                        },
                        {
                            "run": "npm ci && npm test"
                        }
                    ]
                },
                "notify": {
                    "needs": [
                        "publish",
                        "lint"
                    ],
                    "runs-on": "ubuntu-latest",
                    "steps": [
                        {
                            "run": "echo done"
                        }
                    ]
                },
                "publish": {
                    "needs": "build",
                    "permissions": {
                        "contents": "read",
                        "packages": "write"
                    },
                    "runs-on": "ubuntu-latest",
                    "steps": [
                        {
                            "uses": "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"
                        }
                    ],
                    "timeout-minutes": 15
                }
            },
            "name": "release",
            "on": {
                "pull_request_target": [],
                "push": {
                    "branches": [
                        "main"
                    ]
                }
            }
        }
    },
    "bodyType": "json",
    "method": "POST",
    "type": "http"
}

Response

{
    "example": {
        "assumptions": [
            "An action pinned to a 40-character commit hash is pinned; a tag or branch can be moved by whoever owns the action, so the code a step runs can change without this file changing.",
            "The on key is read from either on or true, because an unquoted on is a YAML boolean and survives conversion to JSON that way.",
            "Findings describe patterns in the document. Naming pull_request_target or an interpolated expression is reporting what the file says, not demonstrating an exploit."
        ],
        "complete": true,
        "conformant": false,
        "examined_job_count": 3,
        "finding_count": 10,
        "findings": [
            {
                "code": "REQUIRED_JOB_MISSING",
                "detail": "lint is required and not declared.",
                "job": "lint"
            },
            {
                "code": "PULL_REQUEST_TARGET_TRIGGER",
                "detail": "The workflow triggers on pull_request_target, which runs with repository write context against code from a fork. This reports the trigger, not an exploit."
            },
            {
                "code": "WORKFLOW_PERMISSIONS_NOT_DECLARED",
                "detail": "The workflow declares no permissions block, so it inherits whatever the repository default is rather than stating what it needs."
            }
        ],
        "findings_by_code": {
            "ACTION_NOT_PINNED_TO_COMMIT": 1,
            "JOB_DEPENDENCY_NOT_DECLARED": 1,
            "JOB_PERMISSIONS_NOT_DECLARED": 2,
            "JOB_TIMEOUT_MISSING": 2,
            "PULL_REQUEST_TARGET_TRIGGER": 1,
            "REQUIRED_JOB_MISSING": 1,
            "UNTRUSTED_INTERPOLATION_IN_RUN": 1,
            "WORKFLOW_PERMISSIONS_NOT_DECLARED": 1
        },
        "job_count": 3,
        "jobs": [
            {
                "job": "build",
                "needs": [],
                "permissions_declared": false,
                "runs_on": "ubuntu-latest",
                "steps": 4,
                "timeout_minutes": null,
                "unpinned_actions": [
                    "actions/checkout@v4"
                ]
            },
            {
                "job": "publish",
                "needs": [
                    "build"
                ],
                "permissions_declared": true,
                "runs_on": "ubuntu-latest",
                "steps": 1,
                "timeout_minutes": 15,
                "unpinned_actions": []
            },
            {
                "job": "notify",
                "needs": [
                    "publish",
                    "lint"
                ],
                "permissions_declared": false,
                "runs_on": "ubuntu-latest",
                "steps": 1,
                "timeout_minutes": null,
                "unpinned_actions": []
            }
        ],
        "limitations": [
            "Observable facts about the workflow supplied. Nothing is run, no action is fetched, and this is not a security assessment or a compliance determination.",
            "conformant is true only when every declared rule was evaluated and none failed."
        ],
        "limits": {
            "maxComponents": 5000,
            "maxDependencies": 5000,
            "maxFindings": 500,
            "maxJobs": 200,
            "maxResources": 2000,
            "maxServices": 200,
            "maxVariables": 1000
        },
        "not_examined": [],
        "observed_at": "2026-10-02T00:00:00.000Z",
        "passed": false,
        "request_id": "example-request",
        "service_id": "ci_workflow_contract_audit",
        "service_version": "1.0.0",
        "step_count": 6,
        "trigger_names": [
            "push",
            "pull_request_target"
        ],
        "unpinned_action_count": 1,
        "workflow_permissions_declared": false
    },
    "type": "json"
}

Examples are the provider's own, not a call we made.

Provenance

One row per statement. “Verified” means we checked it ourselves and the finding is quoted. “Provider claim” means we read it in the provider's own record. “Not found” is a statement about our search, not proof of absence.

Endpoint checks

We have not called this endpoint yet. Until we do, everything above is what the source published — no more.

Tags

---