{
  "mode": "synthetic-recorded-fixture",
  "first_pass": {
    "schema": "elenchos.blind-control-review.v1",
    "repository": "example/owned-controls",
    "pull_request": 17,
    "base_sha": "1111111111111111111111111111111111111111",
    "head_sha": "2222222222222222222222222222222222222222",
    "input_ledger": [
      {
        "kind": "pr_diff",
        "repository": "example/owned-controls",
        "pull_request": 17,
        "base_sha": "1111111111111111111111111111111111111111",
        "head_sha": "2222222222222222222222222222222222222222",
        "sha256": "21dc63e6a2c8ccd420087a3c633f1d2fb09b486e461312cc67e6ef6b0b4b65f2",
        "files": [
          ".github/workflows/ci.yml"
        ]
      },
      {
        "kind": "trusted_policy",
        "path": ".elenchos/policy.json",
        "commit": "1111111111111111111111111111111111111111",
        "sha256": "a59e2138f5cf7b65371d4f044f0b8bdd80b03bab1a06534616a7ecb8bb6fb1a2",
        "url": "https://github.com/example/owned-controls/blob/1111111111111111111111111111111111111111/.elenchos/policy.json"
      },
      {
        "kind": "workflow_before",
        "path": ".github/workflows/ci.yml",
        "commit": "1111111111111111111111111111111111111111",
        "sha256": "7c0938f54d358b53df5b707fbf1aca01f9055828bb3feba2d6c44d5fa1446b3f",
        "url": "https://github.com/example/owned-controls/blob/1111111111111111111111111111111111111111/.github/workflows/ci.yml"
      },
      {
        "kind": "workflow_after",
        "path": ".github/workflows/ci.yml",
        "commit": "2222222222222222222222222222222222222222",
        "sha256": "ebe7d67d3bbb1c61a6419f658945b2a858882fa9bf1512b3f610007082af400a",
        "url": "https://github.com/example/owned-controls/blob/2222222222222222222222222222222222222222/.github/workflows/ci.yml"
      }
    ],
    "unassessed_changed_paths": [],
    "excluded_inputs": [
      "pr.title",
      "pr.body",
      "pr.commit_messages"
    ],
    "method": "deterministic static control reading; runtime untested",
    "findings": [
      {
        "workflow": ".github/workflows/ci.yml",
        "job": "build",
        "step": "Run security scan",
        "before": "configured-blocking",
        "after": "not-enforced",
        "weakening": true,
        "line": 9,
        "before_line": 7,
        "reason": "continue-on-error: true, so failure is allowed without blocking the enclosing pipeline",
        "severity": "critical",
        "execution": "UNKNOWN_NOT_TESTED",
        "merge_protection": "UNKNOWN_NOT_QUERIED"
      }
    ],
    "seal_sha256": "f35724863382910e5726c62f4bc17544e0fb9e39e4f3649a4deeee879c67f190"
  }
}