Will It Vibe?Action reference has no version
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
A remote action is referenced with no @ref at all. GitHub resolves this to the action default branch, which is mutable, and the reference is not reproducible across runs.
Why it matters
An action referenced with no @ref resolves to the action default branch, which is mutable and not reproducible. Two runs a week apart can execute different code, and you have no record of what version actually ran.
How to fix it
Add an explicit ref to every remote action, ideally a full commit SHA with the version in a comment, or at minimum a version tag. Local actions referenced as ./path do not need a ref.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo