{
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "zizmor",
          "version": "1.0.0",
          "rules": [
            {
              "id": "unpinned-uses",
              "name": "Unpinned uses",
              "shortDescription": {"text": "Action ref is not pinned to a SHA digest"},
              "properties": {"tags": ["CWE-829"]}
            },
            {
              "id": "excessive-permissions",
              "name": "Excessive permissions",
              "shortDescription": {"text": "Workflow grants write-all permissions"},
              "properties": {"tags": []}
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "unpinned-uses",
          "level": "warning",
          "message": {"text": "uses: actions/checkout@v4 is not pinned by digest"},
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {"uri": ".github/workflows/ci.yml"},
                "region": {
                  "startLine": 12,
                  "startColumn": 9,
                  "endLine": 12,
                  "endColumn": 38
                }
              }
            }
          ]
        },
        {
          "ruleId": "excessive-permissions",
          "level": "error",
          "message": {"text": "Workflow uses write-all permissions; scope to minimum required"},
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {"uri": ".github/workflows/ci.yml"},
                "region": {
                  "startLine": 5,
                  "startColumn": 1,
                  "endLine": 5,
                  "endColumn": 30
                }
              }
            }
          ]
        }
      ]
    }
  ]
}