Issues

• [BUG] GitLab findings point at the job header (or nowhere) instead of the offending line

  Bug

  getplumber/plumber#573 · Filter by author Exypte opened on Oct 23, 2026

• [BUG] Findings point at the job header (or nowhere) instead of the offending line, on GitHub and GitLab

  Bug

  getplumber/plumber#572 · Filter by author Exypte opened on Oct 23, 2026
  2

  

• GitHub: uses: docker://image:tag steps are not judged by ISSUE-102/103

  Bug

  getplumber/plumber#571 · Filter by author Exypte opened on Oct 22, 2026

• GitLab component release notes duplicate the full CLI changelog

  Pipeline
  Feature

  getplumber/plumber#569 · Filter by author Exypte opened on Oct 22, 2026
  1

  

• Adopt and enforce workflow lockfiles on this repository

  Pipeline
  Feature

  getplumber/plumber#568 · Filter by author Exypte opened on Oct 22, 2026
  1

  

• Update pull_request_target detection following GitHub update

  Feature

  getplumber/plumber#558 · Filter by author thomasboni opened on Oct 16, 2026
  

• nested workflows: a self-call by the repository's old canonical name is read as another repository

  Bug

  getplumber/plumber#556 · Filter by author thomasboni opened on Oct 16, 2026

• ISSUE-705 follow-ups: cache-mode edge cases after the #533 rework

  controls
  Task

  getplumber/plumber#554 · Filter by author Exypte opened on Oct 16, 2026

• analyze --help says --fail-warnings exits 2, the run exits 3

  Task

  getplumber/plumber#550 · Filter by author thomasboni opened on Oct 16, 2026

• Workflow lockfile follow-ups: transitive dependencies (702, 703, 713), staleness check, require-lockfile policy as a positive signal

  controls
  Feature

  getplumber/plumber#545 · Filter by author Totara-thib opened on Oct 15, 2026

• [feature] Control that would enforce match between tag and digest

  Feature

  getplumber/plumber#534 · Filter by author p1-dta opened on Oct 10, 2026

• Attack path reports CRIT 'anyone who opens a pull request' on jobs gated by a non-forgeable PR author check

  Bug

  getplumber/plumber#532 · Filter by author thomasboni opened on Oct 8, 2026

• Add option for custom CA

  Feature

  getplumber/plumber#525 · Filter by author macmenco opened on Oct 7, 2026

• ISSUE-804 ignores the author_association allowlist guards that ISSUE-802 accepts

  controls
  Task

  getplumber/plumber#522 · Filter by author Totara-thib opened on Oct 6, 2026

• ISSUE-705: a release step gated by github.event_name == '<event>' && <other condition> is not narrowed to that event

  controls
  Task

  getplumber/plumber#521 · Filter by author Totara-thib opened on Oct 6, 2026

• Website install instructions miss the brew trust step required by newer Homebrew

  getplumber/plumber#516 · Filter by author cguy opened on Oct 2, 2026

• [FEAT] Improve grade visibility in CLI score output

  Feature

  getplumber/plumber#507 · Filter by author Karine-Bauch opened on Sep 29, 2026
  1

• ISSUE-705: resolve ref-gated release steps (startsWith(github.ref, 'refs/tags/'), github.ref_type) per run

  getplumber/plumber#502 · Filter by author thomasboni opened on Sep 29, 2026

• [FEAT] Check required locked files and directories

  Feature

  getplumber/plumber#499 · Filter by author Karine-Bauch opened on Sep 28, 2026
  1

• [FEAT] Add controls for GitLab merge request project settings

  Feature

  getplumber/plumber#498 · Filter by author Karine-Bauch opened on Sep 28, 2026
  7

• [FEAT] Detect unused authorized container images

  Feature

  getplumber/plumber#490 · Filter by author Karine-Bauch opened on Sep 25, 2026
  1

• [FEAT] Add a blocking option to controls

  Feature

  getplumber/plumber#488 · Filter by author Karine-Bauch opened on Sep 25, 2026
  1

• [FEAT] Add a cooldown period to component version checks

  Feature

  getplumber/plumber#487 · Filter by author Karine-Bauch opened on Sep 25, 2026
  2

• BUG: ISSUE-707 is never evaluated for job-level reusable workflow uses

  getplumber/plumber#462 · Filter by author SaboniAmine opened on Sep 9, 2026

• BUG: ISSUE-707 goes silent when the upstream lookup fails, and the run is not marked degraded

  getplumber/plumber#461 · Filter by author SaboniAmine opened on Sep 9, 2026