Issues

• [feature] Control that would enforce match between tag and digest

  Feature

  getplumber/plumber#534 · Filter by author p1-dta opened on Oct 10, 2026

• ISSUE-705 assumes caches are shared across branches, but GitHub isolates them by ref: fire only when an untrusted writer exists in the release scope

  clicontrols
  getplumber/plumber#533 · Filter by author Totara-thib opened on Oct 9, 2026

• Attack path reports CRIT 'anyone who opens a pull request' on jobs gated by a non-forgeable PR author check

  Bug

  getplumber/plumber#532 · Filter by author thomasboni opened on Oct 8, 2026

• Add option for custom CA

  Feature

  getplumber/plumber#525 · Filter by author macmenco opened on Oct 7, 2026

• GitHub analysis skips local composite actions under .github/actions

  clicontrols
  getplumber/plumber#523 · Filter by author Totara-thib opened on Oct 6, 2026

• ISSUE-804 ignores the author_association allowlist guards that ISSUE-802 accepts

  clicontrols
  getplumber/plumber#522 · Filter by author Totara-thib opened on Oct 6, 2026

• ISSUE-705: a release step gated by github.event_name == '<event>' && <other condition> is not narrowed to that event

  clicontrols
  getplumber/plumber#521 · Filter by author Totara-thib opened on Oct 6, 2026

• Website install instructions miss the brew trust step required by newer Homebrew

  getplumber/plumber#516 · Filter by author cguy opened on Oct 2, 2026

• [FEAT] Improve grade visibility in CLI score output

  Feature

  getplumber/plumber#507 · Filter by author Karine-Bauch opened on Sep 29, 2026
  1

• Per-image exemption for containerImageMustNotUseForbiddenTags (ISSUE-102 / ISSUE-103)

  Feature

  getplumber/plumber#506 · Filter by author Totara-thib opened on Sep 29, 2026

• ISSUE-705: resolve ref-gated release steps (startsWith(github.ref, 'refs/tags/'), github.ref_type) per run

  getplumber/plumber#502 · Filter by author thomasboni opened on Sep 29, 2026

• [FEAT] Check required locked files and directories

  Feature

  getplumber/plumber#499 · Filter by author Karine-Bauch opened on Sep 28, 2026
  1

• [FEAT] Add controls for GitLab merge request project settings

  Feature

  getplumber/plumber#498 · Filter by author Karine-Bauch opened on Sep 28, 2026
  6

• [FEAT] Detect unused authorized container images

  Feature

  getplumber/plumber#490 · Filter by author Karine-Bauch opened on Sep 25, 2026
  1

• [FEAT] Add a blocking option to controls

  Feature

  getplumber/plumber#488 · Filter by author Karine-Bauch opened on Sep 25, 2026
  1

• [FEAT] Add a cooldown period to component version checks

  Feature

  getplumber/plumber#487 · Filter by author Karine-Bauch opened on Sep 25, 2026
  1

• BUG: ISSUE-707 is never evaluated for job-level reusable workflow uses

  getplumber/plumber#462 · Filter by author SaboniAmine opened on Sep 9, 2026

• BUG: ISSUE-707 goes silent when the upstream lookup fails, and the run is not marked degraded

  getplumber/plumber#461 · Filter by author SaboniAmine opened on Sep 9, 2026

• --score-push reports success but the score is never published (0.4.51; 0.4.22 works)

  getplumber/plumber#445 · Filter by author stephrobert opened on Sep 6, 2026

• Unknown control "containerImageMustBePinnedByDigest"

  Bug

  getplumber/plumber#429 · Filter by author horkko opened on Aug 21, 2026
  1

• [FEAT] ISSUE-701 should treat tags backed by immutable releases as pinned

  Feature

  getplumber/plumber#421 · Filter by author thomasboni opened on Aug 17, 2026
  1

• ISSUE-705 remediation guidance is unactionable for setup-* managed caches

  clicontrols
  Feature

  getplumber/plumber#409 · Filter by author Totara-thib opened on Aug 12, 2026

• identity: give the prose-identified controls structured subject keys (next RecipeVersion bump)

  getplumber/plumber#407 · Filter by author thomasboni opened on Aug 10, 2026

• Declare variable-value provenance in control findings (unblocks two controls whose pushes are rejected today)

  getplumber/plumber#400 · Filter by author thomasboni opened on Aug 7, 2026

• Detect workflows using long-lived cloud keys instead of OIDC

  Feature

  getplumber/plumber#399 · Filter by author thomasboni opened on Aug 5, 2026