diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index bb3a2105d..1e2f84c06 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -43,6 +43,49 @@ The detector that observes evidence is authoritative for its finding. `scanner/r
 
 External engines retain their own engine/rule/version provenance. AppGuardrail normalizes their output but does not claim their analysis was performed internally.
 
+The proposed
+`github-actions-pull-request-target-untrusted-head-execution` built-in rule
+owns a job-local GitHub Actions trust-boundary signal. A deterministic analyzer
+requires all four causal elements: a `pull_request_target` trigger, repository
+privilege in the same job, explicit materialization of an event-derived PR head,
+and subsequent execution of a local action, script, test, or build from that
+tree. It recognizes equivalent dot/bracket event expressions and one-hop
+workflow-, job-, or same-step block/flow (including multiline flow) `env` bindings used by the same shell command
+segment as Git tree selection. A fetch alone is insufficient; checkout/switch
+must select the revision, or a worktree must select it and execution must bind
+through normalized `cd`, `pushd`, exact step `working-directory`, or an executable/script path.
+The most recent fetch that writes `FETCH_HEAD` owns its provenance; a later trusted
+overwriting fetch clears prior PR-head evidence, while `--no-write-fetch-head` and
+`--append` (including bundled short options) preserve it. A later directly executed
+checkout/switch that selects a different tree invalidates an earlier PR-tree
+selection; path restore, branch creation at current HEAD, inert text, and repeated
+PR-head selection do not. Interpreter options do not break executable-path binding.
+Action checkout materialization is bound
+specifically to its owned `with.ref` input, including flow mappings. It
+does not merge evidence across jobs or treat
+YAML-looking action inputs, comments, heredocs, or run-block data as workflow authority.
+Same-repository author predicates do not change the result because collaborator
+branches remain mutable. Ordinary `pull_request`, metadata-only
+`pull_request_target`, trusted base checkout, authority isolated in another job,
+and a conservatively recognized scalar or block job-level event guard whose
+every disjunct contains a standalone non-PR-target event atom remain
+outside the finding boundary. The canonical prevention boundary remains a
+metadata-only trigger followed by a separately reviewed default-branch
+execution workflow.
+
+The proposed `github-actions-runtime-package-without-integrity` built-in rule owns
+the narrow workflow-source signal where one step binds a versioned registry
+package environment value to the exact package-selector position of that step's
+`npx`/`npm exec` auto-install command. A deterministic line/state analyzer tracks
+step-local field indentation, blank block-scalar lines, exact variable boundaries,
+compact or expanded step mappings, intervening YAML comments, and shell heredoc
+state. Heredoc body text is ignored unless an unquoted body is
+redirected to a target that the same step later makes executable with `chmod`.
+Lexical proximity is therefore not promoted to causal execution. The rule does
+not claim that a download or registry compromise occurred. Central protected workflow prevention, immutable tool
+distribution, consumer configuration, and this repository-local
+detector remain separate controls.
+
 ## Issue-to-detection boundary
 
 ```mermaid
@@ -120,4 +163,4 @@ These modes share normalized contracts but can operate separately.
 
 ## Change control
 
-A new detector engine, persistent schema, tenant authority, arbitrary autofix class, outbound target policy, issue-audit semantics, or automation credential boundary requires ADR and synchronized technical/security/test documentation.
\ No newline at end of file
+A new detector engine, persistent schema, tenant authority, arbitrary autofix class, outbound target policy, issue-audit semantics, or automation credential boundary requires ADR and synchronized technical/security/test documentation.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 110a549d8..abf534c3f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@
 - 대시보드 검색창 커서 유지 — 검색어 중간에서 텍스트를 수정할 때마다 커서가 검색어의 맨 끝으로 점프하는 불편함을 수정했습니다. 이제 입력창의 커서 위치(`selectionStart`/`selectionEnd`)가 동적 렌더링 이후에도 원래 위치에 정확히 유지되어 자연스러운 타이핑 경험을 제공합니다.
 
 ### 보안
+- GitHub Actions `pull_request_target` 신뢰 경계 검출 — 동일 job에서 repository write/OIDC/secret 권한을 가진 채 event-derived PR head를 action-owned `with.ref` 또는 workflow/job/same-step 수준 block/flow(one-line/multiline) one-hop `env` alias로 checkout/switch하거나, 가장 최근 `FETCH_HEAD`-writing PR-head fetch의 worktree를 만들고 normalized `cd`/`pushd`/exact step `working-directory`/interpreter-option-aware executable path로 결합한 뒤 그 트리의 local action·script·test·build를 실행하는 causal chain을 `github-actions-pull-request-target-untrusted-head-execution`(HIGH, CWE-829/CWE-269)으로 탐지합니다. `--no-write-fetch-head`/`--append`(bundled short option 포함)는 기존 provenance를 보존하고, 실제 실행되어 다른 tree를 선택하는 checkout/switch 또는 overwriting fetch만 이를 무효화합니다. path restore, current-HEAD branch 생성, inert command text, 동일 PR-head 재선택은 provenance를 보존합니다. same-repository 조건은 collaborator branch의 가변성을 제거하지 않으므로 예외로 보지 않습니다. metadata-only 처리, fetch-only, later trusted selection, 일반 `pull_request`, trusted-base checkout, 다른 job에 격리된 권한, 모든 disjunct가 standalone non-PR-target event atom을 갖는 보수적 scalar/block job guard는 음성 회귀로 고정했고, unrelated boolean negation, dot/bracket expression, top-level trigger 형식·field 순서·flow mapping·trailing comment는 우회가 되지 않으며 action input/comment/heredoc/run data의 YAML 유사 텍스트는 권한 증거로 승격하지 않습니다.
+- GitHub Actions 공급망 검출 — deterministic step/run analyzer가 compact `- env:`와 expanded `env:`를 포함해 한 step의 버전 고정 registry package `*_PACKAGE` 환경값이 같은 step의 `npx -y/--yes` 또는 `npm exec -y/--yes` package selector에 정확히 결합되는 causal pair를 `github-actions-runtime-package-without-integrity`(HIGH, CWE-829)로 탐지합니다. YAML field 사이 주석, block-scalar 빈 줄과 heredoc 상태를 추적하며, heredoc 본문은 동일 step에서 정확한 출력 target을 `chmod`로 실행 가능하게 만든 경우에만 executable wrapper 증거로 인정합니다. 다른 step 참조, 일반 인자 사용, 변수 prefix 충돌, local tool/tarball, 주석·출력·문서 heredoc은 제외합니다.
 - 리포트 출력 하드닝 — 생성된 markdown 리포트가 HTML로 렌더될 때 악성 finding 내용(예: 외부 엔진이 스캔한 코드의 `<script>`)이 주입되지 않도록, 프로즈 필드(message/remediation/verification)를 HTML 이스케이프하고 snippet의 code-fence 탈출을 무력화합니다(모든 리포트 타입). rule_id/category/context 등 제약된 식별자는 그대로 둡니다.
 - control plane API 하드닝: (1) 요청 본문을 10MiB로 캡하고 음수 Content-Length를 거부합니다(유효 키 소지자의 OOM/EOF-hang 방지). (2) `limit`/`offset` 쿼리 파라미터를 클램프합니다 — sqlite에서 `LIMIT -1`은 무제한이므로 음수를 그대로 전달하면 페이지네이션 캡이 우회됐습니다(list 1..1000, trend 1..365, offset ≥0).
 
diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md
index b9757a957..5be66b89f 100644
--- a/docs/TRACEABILITY.md
+++ b/docs/TRACEABILITY.md
@@ -19,6 +19,8 @@
 | every retained issue claim mapped to executable detector obligation | issue-detection audit | PR #911 active-PR |
 | authenticated workflow-result detector evidence | issue-detection audit workflow evidence | PR #911 active-PR |
 | automatic scanner detection of unsafe stored-webhook SSRF pattern | built-in `python-stored-ssrf-webhook-url` rule | implemented-main through PR #910 for tested Python `set_webhook` direct and one-hop persistence flows; bounded scope |
+| privileged `pull_request_target` execution of mutable PR-head code | built-in `github-actions-pull-request-target-untrusted-head-execution` rule | Proposed: issue #132 / `.github` PR #635 regression, job-local causal analyzer; promote only after protected merge |
+| GitHub Actions versioned registry package bound to npm auto-install | built-in `github-actions-runtime-package-without-integrity` rule | Proposed: bound-package positive and local/unbound/example negative corpus; promote only after protected merge |
 | structural Semgrep-style `pattern:` execution by lightweight engine | built-in scanner | not implemented unless a real structural matcher is added; fixtures are not execution |
 
 ## Promotion rules
@@ -47,10 +49,69 @@ For stored webhook/callback SSRF, trace separately:
 
 Current protected-branch evidence keeps those controls distinct: PR #924 supplies the fail-closed webhook storage boundary, and PR #910 supplies the packaged `python-stored-ssrf-webhook-url` detector plus focused regression corpus. Neither control expands the detector beyond its declared source/sink and flow contract.
 
+## Runtime package integrity boundary
+
+The GitHub Actions detector uses a deterministic step/run analyzer rather than a
+proximity regex. It is intentionally bounded to one step whose `env` mapping
+assigns a versioned registry identity to `*_PACKAGE` and whose immediately
+following `run` field places the exact same variable in a supported `npx` or
+`npm exec` package-selector position with `-y`/`--yes`. Variable-name boundaries
+are exact. Expanded `env:` and compact `- env:` step forms are equivalent, and
+same-indent YAML comments do not terminate the step mapping. Blank block-scalar
+lines do not end analysis. Heredoc bodies are shell
+data and are skipped; analysis resumes after the delimiter. An unquoted heredoc
+body counts only when it is redirected to a target and the same step later makes
+that exact target executable with `chmod`. This is evidence that auto-install is
+admitted, not proof that a download occurred.
+Cross-step references, variables used only as ordinary arguments, prefix-colliding
+names, unbound local tool names, local tarballs, comments, printed/quoted-heredoc
+examples, and non-workflow YAML remain clean. Direct literal package specs, command
+prefixes, quoted YAML `run` keys, wider option/order variants, multiple package
+variables in one environment mapping, other package managers, composite actions,
+reusable workflows, chaining, and indirect expansion remain outside this bounded
+analyzer.
+The current repository incident remains open until a canonical protected workflow
+or immutable released tool contract can scan PR source without trusting PR-owned
+bootstrap files.
+
+## Privileged PR-head execution boundary
+
+The GitHub Actions trust-boundary analyzer requires a `pull_request_target`
+workflow and evaluates each direct child job independently. A job is in scope
+when explicit write authority or a referenced repository secret is present, the
+job checks out or shell-materializes
+`github.event.pull_request.head.sha`/`ref` or `github.head_ref`, and a later step
+executes a repository-local action, script, test, or build command from the
+selected tree. One-hop workflow-, job-, and same-step block/flow (including multiline
+flow) `env` bindings of the
+event head are followed into the same shell command segment as checkout/switch,
+or from the most recent `FETCH_HEAD`-writing PR-head fetch into `FETCH_HEAD`
+worktree creation and execution linked by normalized `cd`, `pushd`, exact step
+`working-directory`, or executable/script path
+commands so the retained fixture reproduces the issue #132 CodeGraph execution
+shape after the prevention fix merged in ContextualWisdomLab/.github PR #635.
+Non-overwriting `--no-write-fetch-head`/`--append` fetches (including bundled short
+options) preserve that provenance; a later directly executed checkout/switch that
+selects a different tree, or an overwriting fetch, invalidates it. Path restore,
+current-HEAD branch creation, inert command text, repeated PR-head selection, and
+interpreter options retain their actual provenance semantics.
+
+Metadata-only `pull_request_target` handling, ordinary `pull_request`, trusted
+base-SHA checkout, inert output, privilege located only in another job, and a
+conservatively recognized scalar or block job-level guard whose every disjunct
+contains a standalone atom excluding PR-target execution are negative fixtures.
+Top-level mapping, sequence, inline trigger forms, field ordering, and trailing
+YAML comments are equivalent; YAML-looking action inputs, comments, heredocs, and run
+data are not promoted to authority. A same-repository head predicate is
+deliberately not an exclusion. The first bounded analyzer does not claim
+complete coverage of reusable/composite action internals, cross-job artifacts,
+API-downloaded source archives, cross-step or multi-hop environment aliases, container
+entrypoints, or third-party actions that fetch contributor content internally.
+
 ## Standards/research
 
 Existing repository docs/doctoring/security evidence remain the bibliography/source-of-truth for standards such as SARIF, CycloneDX, GitHub security interfaces, and applicable OWASP/CWE classes. Material new detector classes should add authoritative standard/CWE/OWASP references and APA 7 citations in doctoring where research/standards materially drive implementation.
 
 ## Change rule
 
-Every new issue-class detector or product security boundary should add/update a row and its concrete test/evidence path. Stale/queued/cancelled/rate-limited/predecessor checks cannot promote evidence maturity.
\ No newline at end of file
+Every new issue-class detector or product security boundary should add/update a row and its concrete test/evidence path. Stale/queued/cancelled/rate-limited/predecessor checks cannot promote evidence maturity.
diff --git a/scanner/cli/appguardrail.py b/scanner/cli/appguardrail.py
index 0d853d644..82ddd82f2 100644
--- a/scanner/cli/appguardrail.py
+++ b/scanner/cli/appguardrail.py
@@ -944,6 +944,1031 @@ def _extensions_for_languages(languages):
     return sorted(set(extensions)) or None
 
 
+class _SourceMatch:
+    """Minimal match object for deterministic source analyzers."""
+
+    def __init__(self, start_index: int):
+        self._start_index = start_index
+
+    def start(self) -> int:
+        """Return the source offset used by the shared finding builder."""
+        return self._start_index
+
+
+class _GitHubActionsPullRequestTargetPattern:
+    """Find privileged PR-target jobs that execute materialized PR code."""
+
+    _FIELD = re.compile(
+        r"^(?P<indent>[ \t]*)(?:[\"']?(?P<name>[A-Za-z0-9_-]+)[\"']?)"
+        r"[ \t]*:[ \t]*(?P<value>.*)$"
+    )
+    _PERMISSION_SCOPES = frozenset(
+        {
+            "actions",
+            "attestations",
+            "checks",
+            "contents",
+            "deployments",
+            "discussions",
+            "id-token",
+            "issues",
+            "models",
+            "packages",
+            "pages",
+            "pull-requests",
+            "security-events",
+            "statuses",
+        }
+    )
+    _INLINE_WRITE_PERMISSION = re.compile(
+        r"(?:actions|attestations|checks|contents|deployments|discussions|"
+        r"id-token|issues|models|packages|pages|pull-requests|security-events|"
+        r"statuses)[\"']?[ \t]*:[ \t]*[\"']?write\b"
+    )
+    _SECRET = re.compile(
+        r"\$\{\{[ \t]*secrets(?:\.[A-Za-z_][A-Za-z0-9_]*|"
+        r"\[['\"][A-Za-z_][A-Za-z0-9_]*['\"]\])"
+    )
+    _CHECKOUT = re.compile(
+        r"^[ \t]*(?:-[ \t]*)?(?:[\"']?uses[\"']?)[ \t]*:[ \t]*"
+        r"[\"']?actions/checkout@",
+        re.IGNORECASE,
+    )
+    _PR_HEAD = re.compile(
+        r"github\.(?:event\.pull_request\.head\.(?:sha|ref)|head_ref)"
+    )
+    _BRACKET_KEY = re.compile(r"\[['\"]([A-Za-z_][A-Za-z0-9_]*)['\"]\]")
+    _GIT_FETCH = re.compile(r"\bgit[ \t]+fetch\b")
+    _GIT_TREE_SELECTION = re.compile(
+        r"\bgit[ \t]+(?:checkout|switch|worktree\b[^\n]*\badd)\b"
+    )
+    _FLOW_REF = re.compile(
+        r"(?:^|[{,])[ \t]*['\"]?ref['\"]?[ \t]*:[ \t]*"
+        r"(?P<value>.*?)(?=,[ \t]*['\"]?[A-Za-z0-9_-]+['\"]?[ \t]*:|}[ \t]*$)"
+    )
+    _LOCAL_ACTION = re.compile(
+        r"^[ \t]*(?:-[ \t]*)?(?:[\"']?uses[\"']?)[ \t]*:[ \t]*[\"']?\./"
+    )
+    _COMPACT_RUN = re.compile(
+        r"^(?P<indent>[ \t]*)-[ \t]*(?:[\"']?run[\"']?)[ \t]*:[ \t]*"
+        r"(?P<value>.*)$"
+    )
+    _LOCAL_COMMAND = re.compile(
+        r"(?:^|[;&|][ \t]*)"
+        r"(?:\./[A-Za-z0-9_.-]|"
+        r"(?:bash|sh|zsh|python3?|node|ruby|perl)[ \t]+"
+        r"(?:-[A-Za-z0-9-]+[ \t]+)*(?:\./|/|[A-Za-z0-9_.-]+/)|"
+        r"(?:npm[ \t]+exec|npx|pnpm[ \t]+(?:dlx|test|run)|"
+        r"yarn[ \t]+(?:dlx|test|run))|"
+        r"(?:cargo|go|make|pytest|tox|gradle|mvn)\b)"
+    )
+
+    @staticmethod
+    def _indent_width(line: str) -> int:
+        """Count leading YAML indentation characters."""
+        return len(line) - len(line.lstrip(" \t"))
+
+    @staticmethod
+    def _yaml_value(value: str) -> str:
+        """Remove a trailing YAML comment from the controlled scalar subset."""
+        value = re.sub(r"[ \t]+#.*$", "", value).strip()
+        if len(value) >= 2 and value[0] == value[-1] and value[0] in {"\"", "'"}:
+            return value[1:-1]
+        return value
+
+    def _has_pr_head(self, value: str) -> bool:
+        """Recognize equivalent dot and bracket GitHub context paths."""
+        normalized = self._BRACKET_KEY.sub(r".\1", value)
+        return bool(self._PR_HEAD.search(normalized))
+
+    def _has_pull_request_target(self, content: str) -> bool:
+        """Return whether the workflow has a top-level PR-target trigger."""
+        lines = content.splitlines()
+        for index, line in enumerate(lines):
+            field = self._FIELD.match(line)
+            if (
+                not field
+                or field.group("name") != "on"
+                or field.group("indent")
+            ):
+                continue
+            value = self._yaml_value(field.group("value"))
+            if re.search(r"\bpull_request_target\b", value):
+                return True
+            for nested in lines[index + 1 :]:
+                if not nested.strip() or nested.lstrip().startswith("#"):
+                    continue
+                if self._indent_width(nested) == 0:
+                    break
+                stripped = nested.strip()
+                if stripped.startswith("-"):
+                    event = self._yaml_value(stripped[1:])
+                    if event == "pull_request_target":
+                        return True
+                nested_field = self._FIELD.match(nested)
+                if (
+                    nested_field
+                    and nested_field.group("name") == "pull_request_target"
+                ):
+                    return True
+            break
+        return False
+
+    def _has_write_permission(
+        self, lines, start: int, end: int, permission_indent: int
+    ) -> bool:
+        """Recognize write authority only inside a permissions mapping."""
+        for index in range(start, end):
+            line = lines[index].rstrip("\r\n")
+            if not line.strip() or line.lstrip().startswith("#"):
+                continue
+            field = self._FIELD.match(line)
+            if (
+                not field
+                or field.group("name") != "permissions"
+                or len(field.group("indent")) != permission_indent
+            ):
+                continue
+            value = self._yaml_value(field.group("value"))
+            if value == "write-all" or self._INLINE_WRITE_PERMISSION.search(value):
+                return True
+            for nested in lines[index + 1 : end]:
+                if not nested.strip() or nested.lstrip().startswith("#"):
+                    continue
+                if self._indent_width(nested) <= permission_indent:
+                    break
+                nested_field = self._FIELD.match(nested.rstrip("\r\n"))
+                if not nested_field:
+                    continue
+                nested_value = self._yaml_value(nested_field.group("value"))
+                if (
+                    nested_field.group("name") in self._PERMISSION_SCOPES
+                    and nested_value == "write"
+                ):
+                    return True
+        return False
+
+    def _has_secret(self, lines, start: int, end: int) -> bool:
+        """Return whether executable job YAML references a repository secret."""
+        return any(
+            self._SECRET.search(lines[index])
+            for index in range(start, end)
+            if not lines[index].lstrip().startswith("#")
+        )
+
+    def _job_excludes_pull_request_target(self, lines, start: int, end: int) -> bool:
+        """Recognize job guards that make PR-target execution unreachable."""
+        job_indent = self._indent_width(lines[start])
+        for index in range(start + 1, end):
+            field = self._FIELD.match(lines[index].rstrip("\r\n"))
+            if (
+                not field
+                or field.group("name") != "if"
+                or len(field.group("indent")) != job_indent + 2
+            ):
+                continue
+            guard = self._yaml_value(field.group("value"))
+            if guard[:1] in {"|", ">"}:
+                guard_lines = []
+                for nested in lines[index + 1 : end]:
+                    if not nested.strip() or nested.lstrip().startswith("#"):
+                        continue
+                    if self._indent_width(nested) <= job_indent + 2:
+                        break
+                    guard_lines.append(nested.strip())
+                guard = " ".join(guard_lines)
+            if guard.startswith("${{") and guard.endswith("}}"):
+                guard = guard[3:-2].strip()
+            branches = guard.split("||")
+            return all(
+                any(
+                    bool(
+                        re.fullmatch(
+                            r"github\.event_name[ \t]*!=[ \t]*"
+                            r"['\"]pull_request_target['\"]",
+                            atom.strip(" ()\t"),
+                        )
+                        or re.fullmatch(
+                            r"github\.event_name[ \t]*==[ \t]*['\"]"
+                            r"(?!pull_request_target['\"])[A-Za-z_]+['\"]",
+                            atom.strip(" ()\t"),
+                        )
+                    )
+                    for atom in branch.split("&&")
+                )
+                for branch in branches
+            )
+        return False
+
+    def _job_ranges(self, lines):
+        """Yield direct child job ranges without merging authority across jobs."""
+        jobs_index = None
+        jobs_indent = None
+        for index, line in enumerate(lines):
+            field = self._FIELD.match(line.rstrip("\r\n"))
+            if field and field.group("name") == "jobs":
+                jobs_index = index
+                jobs_indent = len(field.group("indent"))
+                break
+        if jobs_index is None:
+            return
+
+        job_indent = None
+        starts = []
+        jobs_end = len(lines)
+        for index in range(jobs_index + 1, len(lines)):
+            line = lines[index].rstrip("\r\n")
+            if not line.strip() or line.lstrip().startswith("#"):
+                continue
+            width = self._indent_width(line)
+            if width <= jobs_indent:
+                jobs_end = index
+                break
+            field = self._FIELD.match(line)
+            if not field:
+                continue
+            if job_indent is None:
+                job_indent = width
+            if width == job_indent:
+                starts.append(index)
+        for position, start in enumerate(starts):
+            end = starts[position + 1] if position + 1 < len(starts) else jobs_end
+            yield start, end
+
+    def _checkout_materialization(self, lines, start: int, end: int):
+        """Return the source line that checks out an event-derived PR head."""
+        for index in range(start, end):
+            line = lines[index].rstrip("\r\n")
+            if not self._CHECKOUT.match(line):
+                continue
+            step_start = index
+            while step_start > start:
+                candidate = lines[step_start].lstrip(" \t")
+                if candidate.startswith("-"):
+                    break
+                step_start -= 1
+            step_indent = self._indent_width(lines[step_start])
+            uses_indent = self._indent_width(line) + (
+                2 if line.lstrip(" \t").startswith("-") else 0
+            )
+            if uses_indent != step_indent + 2:
+                continue
+            step_end = end
+            for candidate_index in range(step_start + 1, end):
+                candidate = lines[candidate_index]
+                if (
+                    candidate.strip()
+                    and self._indent_width(candidate) == step_indent
+                    and candidate.lstrip(" \t").startswith("-")
+                ):
+                    step_end = candidate_index
+                    break
+            step_key_indent = uses_indent
+            for nested_index in range(step_start, step_end):
+                nested = lines[nested_index].rstrip("\r\n")
+                field = self._FIELD.match(nested)
+                compact_with = re.match(
+                    r"^(?P<indent>[ \t]*)-[ \t]+with[ \t]*:[ \t]*(?P<value>.*)$",
+                    nested,
+                )
+                if field and field.group("name") == "with":
+                    with_indent = len(field.group("indent"))
+                    semantic_indent = with_indent
+                    value = self._yaml_value(field.group("value"))
+                elif compact_with:
+                    with_indent = len(compact_with.group("indent")) + 2
+                    semantic_indent = with_indent
+                    value = self._yaml_value(compact_with.group("value"))
+                else:
+                    continue
+                if semantic_indent != step_key_indent:
+                    continue
+                value = self._flow_mapping_value(
+                    lines, nested_index, step_end, semantic_indent, value
+                )
+                if value.startswith("{"):
+                    flow_ref = self._FLOW_REF.search(value)
+                    if flow_ref and self._has_pr_head(flow_ref.group("value")):
+                        return nested_index
+                    continue
+                for input_index in range(nested_index + 1, step_end):
+                    input_line = lines[input_index].rstrip("\r\n")
+                    if not input_line.strip() or input_line.lstrip().startswith("#"):
+                        continue
+                    if self._indent_width(input_line) <= with_indent:
+                        break
+                    input_field = self._FIELD.match(input_line)
+                    if (
+                        input_field
+                        and input_field.group("name") == "ref"
+                        and self._has_pr_head(input_field.group("value"))
+                    ):
+                        return input_index
+        return None
+
+    def _pr_head_aliases(self, lines, start: int, end: int, env_indent: int):
+        """Return PR-head aliases from env mappings at one exact scope."""
+        aliases = set()
+        for index in range(start, end):
+            field = self._FIELD.match(lines[index].rstrip("\r\n"))
+            if (
+                not field
+                or field.group("name") != "env"
+                or len(field.group("indent")) != env_indent
+            ):
+                continue
+            value = self._flow_mapping_value(
+                lines,
+                index,
+                end,
+                env_indent,
+                self._yaml_value(field.group("value")),
+            )
+            if value.startswith("{"):
+                aliases.update(self._flow_env_aliases(value))
+                continue
+            for nested in lines[index + 1 : end]:
+                if not nested.strip() or nested.lstrip().startswith("#"):
+                    continue
+                if self._indent_width(nested) <= env_indent:
+                    break
+                variable = self._FIELD.match(nested.rstrip("\r\n"))
+                if variable and self._has_pr_head(variable.group("value")):
+                    aliases.add(variable.group("name"))
+        return aliases
+
+    def _flow_env_aliases(self, value: str):
+        """Return PR-head aliases from the supported YAML flow mapping subset."""
+        aliases = set()
+        if not value.startswith("{") or not value.endswith("}"):
+            return aliases
+        for entry in value[1:-1].split(","):
+            if ":" not in entry:
+                continue
+            name, scalar = entry.split(":", 1)
+            name = name.strip(" '\"\t")
+            if re.fullmatch(r"[A-Za-z_][A-Za-z0-9_]*", name) and self._has_pr_head(
+                scalar
+            ):
+                aliases.add(name)
+        return aliases
+
+    def _flow_mapping_value(
+        self, lines, index: int, end: int, owner_indent: int, value: str
+    ) -> str:
+        """Join a bounded multiline YAML flow mapping for deterministic parsing."""
+        if not value.startswith("{") or value.endswith("}"):
+            return value
+        parts = [value]
+        for nested in lines[index + 1 : end]:
+            stripped = nested.strip()
+            if not stripped or stripped.startswith("#"):
+                continue
+            if self._indent_width(nested) <= owner_indent and stripped != "}":
+                break
+            parts.append(stripped)
+            if stripped.endswith("}"):
+                break
+        return " ".join(parts)
+
+    def _step_range(self, lines, start: int, end: int, index: int):
+        """Return the YAML sequence item containing one run-block line."""
+        step_start = None
+        step_indent = None
+        for candidate in range(index, start - 1, -1):
+            line = lines[candidate]
+            if re.match(r"^[ \t]*-[ \t]+", line):
+                step_start = candidate
+                step_indent = self._indent_width(line)
+                break
+        if step_start is None:
+            return start, end, None
+        step_end = end
+        for candidate in range(step_start + 1, end):
+            line = lines[candidate]
+            if (
+                line.strip()
+                and self._indent_width(line) == step_indent
+                and re.match(r"^[ \t]*-[ \t]+", line)
+            ):
+                step_end = candidate
+                break
+        return step_start, step_end, step_indent
+
+    def _step_pr_head_aliases(self, lines, start: int, end: int, index: int):
+        """Return event-head env aliases live in the containing step only."""
+        step_start, step_end, step_indent = self._step_range(
+            lines, start, end, index
+        )
+        if step_indent is None:
+            return set()
+        step_key_indent = step_indent + 2
+        aliases = set()
+        env_pattern = re.compile(
+            r"^(?P<indent>[ \t]*)(?P<compact>-[ \t]+)?env[ \t]*:[ \t]*"
+            r"(?P<value>.*)$"
+        )
+        for env_index in range(step_start, step_end):
+            env_match = env_pattern.match(lines[env_index].rstrip("\r\n"))
+            if not env_match:
+                continue
+            env_indent = len(env_match.group("indent")) + (
+                2 if env_match.group("compact") else 0
+            )
+            if env_indent != step_key_indent:
+                continue
+            value = self._flow_mapping_value(
+                lines,
+                env_index,
+                step_end,
+                env_indent,
+                self._yaml_value(env_match.group("value")),
+            )
+            if value.startswith("{"):
+                aliases.update(self._flow_env_aliases(value))
+                continue
+            for nested in lines[env_index + 1 : step_end]:
+                if not nested.strip() or nested.lstrip().startswith("#"):
+                    continue
+                if self._indent_width(nested) <= env_indent:
+                    break
+                variable = self._FIELD.match(nested.rstrip("\r\n"))
+                if variable and self._has_pr_head(variable.group("value")):
+                    aliases.add(variable.group("name"))
+        return aliases
+
+    def _step_working_directory(self, lines, start: int, end: int, index: int):
+        """Return a step-owned working-directory scalar when present."""
+        step_start, step_end, step_indent = self._step_range(
+            lines, start, end, index
+        )
+        if step_indent is None:
+            return None
+        step_key_indent = step_indent + 2
+        compact_pattern = re.compile(
+            r"^(?P<indent>[ \t]*)-[ \t]+working-directory[ \t]*:[ \t]*(?P<value>.*)$"
+        )
+        for field_index in range(step_start, step_end):
+            line = lines[field_index].rstrip("\r\n")
+            field = self._FIELD.match(line)
+            compact = compact_pattern.match(line)
+            if (
+                field
+                and field.group("name") == "working-directory"
+                and len(field.group("indent")) == step_key_indent
+            ):
+                return self._yaml_value(field.group("value"))
+            if compact and len(compact.group("indent")) + 2 == step_key_indent:
+                return self._yaml_value(compact.group("value"))
+        return None
+
+    @staticmethod
+    def _shell_code(line: str) -> str:
+        """Remove a trailing shell comment before causal command matching."""
+        return re.split(r"[ \t]+#", line, maxsplit=1)[0]
+
+    @staticmethod
+    def _interpreter_script(tokens):
+        """Return the script operand after bounded interpreter options."""
+        interpreter = os.path.basename(tokens[0]) if tokens else ""
+        value_options = {
+            "bash": {"-O", "--rcfile", "--init-file"},
+            "sh": {"-O"},
+            "zsh": {"-O"},
+            "python": {"-W", "-X"},
+            "python3": {"-W", "-X"},
+        }.get(interpreter, set())
+        terminal_options = {
+            "bash": {"-c", "--command"},
+            "sh": {"-c"},
+            "zsh": {"-c"},
+            "python": {"-c", "-m"},
+            "python3": {"-c", "-m"},
+            "node": {"-e", "--eval"},
+            "ruby": {"-e"},
+            "perl": {"-e"},
+        }.get(interpreter, set())
+        if not value_options and not terminal_options and interpreter not in {
+            "node",
+            "ruby",
+            "perl",
+        }:
+            return None
+        index = 1
+        while index < len(tokens):
+            option = tokens[index]
+            if option == "--":
+                index += 1
+                break
+            if option in terminal_options:
+                return None
+            if option in value_options:
+                index += 2
+                continue
+            if option.startswith(("-", "+")):
+                index += 1
+                continue
+            break
+        return tokens[index] if index < len(tokens) else None
+
+    @classmethod
+    def _executes_from_directory(cls, command_line: str, directory: str) -> bool:
+        """Bind an executable or interpreter script path to one worktree."""
+        directory_prefix = f"{os.path.normpath(directory).rstrip('/')}/"
+        for segment in re.split(r"(?:&&|\|\||;)", command_line):
+            try:
+                tokens = shlex.split(segment)
+            except ValueError:
+                continue
+            if not tokens:
+                continue
+            executable = os.path.normpath(tokens[0])
+            if executable.startswith(directory_prefix):
+                return True
+            script_operand = cls._interpreter_script(tokens)
+            if script_operand:
+                script = os.path.normpath(script_operand)
+                if script.startswith(directory_prefix):
+                    return True
+        return False
+
+    def _trusted_tree_selection(self, command: str, aliases) -> bool:
+        """Return whether an executed direct git command selects another tree."""
+        try:
+            tokens = shlex.split(command)
+        except ValueError:
+            return False
+        if len(tokens) < 3 or tokens[0] != "git":
+            return False
+        operation = tokens[1]
+        if operation not in {"checkout", "switch"}:
+            return False
+        if self._has_pr_head(command) or "FETCH_HEAD" in command:
+            return False
+        if any(
+            re.search(rf"\$(?:\{{{re.escape(alias)}\}}|{re.escape(alias)})\b", command)
+            for alias in aliases
+        ):
+            return False
+        arguments = tokens[2:]
+        non_option_arguments = [
+            argument
+            for argument in arguments
+            if not argument.startswith("-")
+        ]
+        if not non_option_arguments or non_option_arguments == ["HEAD"]:
+            return False
+        if operation == "checkout":
+            if arguments[:1] == ["--"]:
+                return False
+            if arguments[:1] in (["-b"], ["-B"]) and len(arguments) == 2:
+                return False
+        if operation == "switch":
+            if arguments[:1] in (["-c"], ["-C"], ["--create"], ["--force-create"]):
+                return len(arguments) > 2
+        return True
+
+    @staticmethod
+    def _worktree_target(command: str):
+        """Return the destination argument from a simple git worktree add."""
+        try:
+            tokens = shlex.split(command)
+        except ValueError:
+            return None
+        try:
+            add_index = next(
+                index
+                for index in range(len(tokens) - 2)
+                if tokens[index : index + 3] == ["git", "worktree", "add"]
+            )
+        except StopIteration:
+            return None
+        index = add_index + 3
+        while index < len(tokens) and tokens[index].startswith("-"):
+            if tokens[index] in {"-b", "-B"}:
+                index += 2
+            else:
+                index += 1
+        return tokens[index] if index < len(tokens) else None
+
+    def _git_materialization(self, lines, start: int, end: int, aliases):
+        """Return a run-block line that materializes the event PR head."""
+        fetched_pr_head = False
+        for index in range(start, end):
+            line = self._shell_code(lines[index])
+            step_aliases = aliases | self._step_pr_head_aliases(
+                lines, start, end, index
+            )
+            selected_tree = False
+            worktree_target = None
+            for command in re.split(r"(?:&&|\|\||;)", line):
+                alias_match = any(
+                    re.search(
+                        rf"\$(?:\{{{re.escape(alias)}\}}|{re.escape(alias)})\b",
+                        command,
+                    )
+                    for alias in step_aliases
+                )
+                references_pr_head = self._has_pr_head(command) or alias_match
+                if self._GIT_FETCH.search(command) and not re.search(
+                    r"(?:--no-write-fetch-head|--append|"
+                    r"(?:^|[ \t])-[A-Za-z]*a[A-Za-z]*(?=[ \t]|$))",
+                    command,
+                ):
+                    fetched_pr_head = references_pr_head
+                if not self._GIT_TREE_SELECTION.search(command):
+                    continue
+                if references_pr_head or (
+                    fetched_pr_head and re.search(r"\bFETCH_HEAD\b", command)
+                ):
+                    selected_tree = True
+                    worktree_target = self._worktree_target(command)
+                    break
+            if not selected_tree:
+                continue
+            command_indent = self._indent_width(line)
+            for prior in range(index - 1, start - 1, -1):
+                compact_run = self._COMPACT_RUN.match(
+                    lines[prior].rstrip("\r\n")
+                )
+                if compact_run:
+                    block_value = compact_run.group("value").strip()[:1]
+                    if block_value in {"|", ">"}:
+                        return (
+                            index,
+                            len(compact_run.group("indent")),
+                            worktree_target,
+                        )
+                    break
+                field = self._FIELD.match(lines[prior].rstrip("\r\n"))
+                if not field:
+                    continue
+                field_indent = len(field.group("indent"))
+                if field_indent >= command_indent:
+                    continue
+                block_value = field.group("value").strip()[:1]
+                if field.group("name") == "run" and block_value in {"|", ">"}:
+                    return index, field_indent, worktree_target
+                break
+        return None
+
+    def _execution_line(
+        self,
+        lines,
+        start: int,
+        end: int,
+        active_run_indent=None,
+        required_directory=None,
+        selection_index=None,
+        aliases=None,
+    ):
+        """Return subsequent local action, script, test, or build execution."""
+        if required_directory:
+            required_directory = os.path.normpath(required_directory)
+        selection_step_start = None
+        if selection_index is not None:
+            selection_step_start, _, _ = self._step_range(
+                lines, 0, end, selection_index
+            )
+        in_run_block = active_run_indent is not None
+        aliases = aliases or set()
+        run_indent = active_run_indent or 0
+        in_materialized_directory = required_directory is None
+        for index in range(start, end):
+            line = lines[index].rstrip("\r\n")
+            stripped = line.strip()
+            if not stripped or stripped.startswith("#"):
+                continue
+            if self._CHECKOUT.match(line):
+                step_start, step_end, _ = self._step_range(
+                    lines, 0, end, index
+                )
+                step_indent = self._indent_width(lines[step_start])
+                uses_indent = self._indent_width(line) + (
+                    2 if line.lstrip(" \t").startswith("-") else 0
+                )
+                if (
+                    uses_indent == step_indent + 2
+                    and step_start != selection_step_start
+                    and self._checkout_materialization(lines, step_start, step_end)
+                    is None
+                ):
+                    return None
+            if index != selection_index:
+                step_aliases = aliases | self._step_pr_head_aliases(
+                    lines, 0, end, index
+                )
+                for command in re.split(
+                    r"(?:&&|\|\||;)", self._shell_code(stripped)
+                ):
+                    if self._trusted_tree_selection(command.strip(), step_aliases):
+                        return None
+            step_directory = self._step_working_directory(
+                lines, start, end, index
+            )
+            if step_directory:
+                step_directory = os.path.normpath(step_directory)
+            executes_target_path = bool(
+                required_directory
+                and self._executes_from_directory(
+                    self._shell_code(stripped), required_directory
+                )
+            )
+            if self._LOCAL_ACTION.match(line) and required_directory is None:
+                return index
+            compact_run = self._COMPACT_RUN.match(line)
+            if compact_run:
+                value = compact_run.group("value").strip()
+                in_run_block = value[:1] in {"|", ">"}
+                run_indent = len(compact_run.group("indent"))
+                in_materialized_directory = required_directory is None or (
+                    step_directory == required_directory
+                )
+                value_executes_target = bool(
+                    required_directory
+                    and self._executes_from_directory(value, required_directory)
+                )
+                if (
+                    not in_run_block
+                    and self._is_local_command(value)
+                    and (in_materialized_directory or value_executes_target)
+                ):
+                    return index
+                continue
+            field = self._FIELD.match(line)
+            if field and field.group("name") == "run":
+                value = field.group("value").strip()
+                in_run_block = value[:1] in {"|", ">"}
+                run_indent = len(field.group("indent"))
+                in_materialized_directory = required_directory is None or (
+                    step_directory == required_directory
+                )
+                value_executes_target = bool(
+                    required_directory
+                    and self._executes_from_directory(value, required_directory)
+                )
+                if (
+                    not in_run_block
+                    and self._is_local_command(value)
+                    and (in_materialized_directory or value_executes_target)
+                ):
+                    return index
+                continue
+            if in_run_block:
+                if self._indent_width(line) <= run_indent:
+                    in_run_block = False
+                    in_materialized_directory = required_directory is None
+                else:
+                    if required_directory:
+                        try:
+                            commands = [
+                                shlex.split(command)
+                                for command in re.split(
+                                    r"(?:&&|\|\||;)", self._shell_code(stripped)
+                                )
+                            ]
+                        except ValueError:
+                            commands = []
+                        for command in commands:
+                            if command[:1] in (["cd"], ["pushd"]):
+                                destination = (
+                                    os.path.normpath(command[-1])
+                                    if command[-1:]
+                                    else None
+                                )
+                                in_materialized_directory = (
+                                    destination == required_directory
+                                )
+                            elif command[:1] == ["popd"]:
+                                in_materialized_directory = False
+                    if (
+                        (in_materialized_directory or executes_target_path)
+                        and self._is_local_command(stripped)
+                    ):
+                        return index
+        return None
+
+    def _is_local_command(self, command: str) -> bool:
+        """Exclude inert printing while recognizing direct local execution."""
+        command = command.strip()
+        if re.match(r"^(?:echo|printf|cat)\b", command):
+            return False
+        for segment in re.split(r"(?:&&|\|\||;)", command):
+            try:
+                tokens = shlex.split(segment)
+            except ValueError:
+                continue
+            script = self._interpreter_script(tokens)
+            if script and (script.startswith(("./", "/")) or "/" in script):
+                return True
+        return bool(self._LOCAL_COMMAND.search(command))
+
+    def finditer(self, content: str):
+        """Yield one match for each causally complete privileged job."""
+        if not self._has_pull_request_target(content):
+            return
+        lines = content.splitlines(keepends=True)
+        offsets = []
+        offset = 0
+        for line in lines:
+            offsets.append(offset)
+            offset += len(line)
+
+        global_privilege = self._has_write_permission(lines, 0, len(lines), 0)
+        workflow_aliases = self._pr_head_aliases(lines, 0, len(lines), 0)
+
+        for start, end in self._job_ranges(lines):
+            if self._job_excludes_pull_request_target(lines, start, end):
+                continue
+            job_indent = self._indent_width(lines[start])
+            privileged = global_privilege or bool(
+                self._has_write_permission(lines, start, end, job_indent + 2)
+                or self._has_secret(lines, start, end)
+            )
+            if not privileged:
+                continue
+            aliases = workflow_aliases | self._pr_head_aliases(
+                lines, start, end, job_indent + 2
+            )
+            materialized = self._checkout_materialization(lines, start, end)
+            active_run_indent = None
+            if materialized is None:
+                shell_materialization = self._git_materialization(
+                    lines, start, end, aliases
+                )
+                if shell_materialization is None:
+                    continue
+                materialized, active_run_indent, required_directory = (
+                    shell_materialization
+                )
+                execution_start = materialized
+            else:
+                required_directory = None
+                execution_start = materialized + 1
+            if materialized is None:
+                continue
+            execution = self._execution_line(
+                lines,
+                execution_start,
+                end,
+                active_run_indent,
+                required_directory,
+                materialized,
+                aliases,
+            )
+            if execution is not None:
+                yield _SourceMatch(offsets[execution])
+
+
+class _GitHubActionsRuntimePackagePattern:
+    """Find step-local registry package execution without trusting proximity."""
+
+    _ENV = re.compile(
+        r"^(?P<indent>[ \t]+)(?P<compact>-[ \t]+)?env"
+        r"[ \t]*:[ \t]*(?:#.*)?$"
+    )
+    _PACKAGE = re.compile(
+        r"^(?P<indent>[ \t]+)(?P<name>[A-Z][A-Z0-9_]*_PACKAGE)"
+        r"[ \t]*:[ \t]*[\"']?(?![./])"
+        r"(?:@[A-Za-z0-9_.-]+/)?[A-Za-z0-9_.-]+@[0-9][A-Za-z0-9_.+-]*"
+        r"[\"']?[ \t]*(?:#.*)?$"
+    )
+    _RUN = re.compile(r"^(?P<indent>[ \t]+)run[ \t]*:[ \t]*(?P<value>.*)$")
+    _HEREDOC = re.compile(
+        r"(?:(?:>{1,2}[ \t]*(?P<target>\"[^\"]+\"|'[^']+'|[^ \t]+)"
+        r"[ \t]+))?<<-?[ \t]*(?P<quote>[\"']?)(?P<delimiter>[A-Za-z_][A-Za-z0-9_]*)"
+        r"(?P=quote)"
+    )
+
+    @staticmethod
+    def _indent_width(line: str) -> int:
+        """Count leading YAML indentation characters."""
+        return len(line) - len(line.lstrip(" \t"))
+
+    @staticmethod
+    def _uses_package(command: str, variable: str) -> bool:
+        """Return whether a shell command uses variable as the package selector."""
+        token = rf'[\"\']?\$(?:\{{{re.escape(variable)}\}}|{re.escape(variable)})(?![A-Za-z0-9_])[\"\']?'
+        npx = rf"(?:^|[;&|][ \t]*)(?:exec[ \t]+)?npx[ \t]+(?:-y|--yes)[ \t]+{token}(?=[ \t]|$)"
+        npm = (
+            rf"(?:^|[;&|][ \t]*)npm[ \t]+exec[ \t]+(?:"
+            rf"(?:-y|--yes)[ \t]+(?:--[ \t]+)?{token}(?=[ \t]|$)|"
+            rf"--package(?:=|[ \t]+){token}[ \t]+(?:-y|--yes)(?=[ \t]|$))"
+        )
+        return bool(re.search(rf"(?:{npx}|{npm})", command))
+
+    @staticmethod
+    def _makes_executable(command: str, target: str) -> bool:
+        """Return whether a direct chmod command adds execution to target."""
+        try:
+            command_tokens = shlex.split(command, comments=True, posix=True)
+            target_tokens = shlex.split(target, comments=False, posix=True)
+        except ValueError:
+            return False
+        if len(command_tokens) < 3 or command_tokens[0] != "chmod":
+            return False
+        mode = command_tokens[1]
+        executable_mode = "+x" in mode
+        if mode.isdigit() and all(character in "01234567" for character in mode):
+            executable_mode = bool(int(mode, 8) & 0o111)
+        return bool(
+            executable_mode
+            and target_tokens
+            and target_tokens[0] in command_tokens[2:]
+        )
+
+    def _block_match(self, lines, offsets, start: int, end: int, variable: str):
+        """Find direct execution or a materialized executable heredoc wrapper."""
+        heredoc = None
+        for index in range(start, end):
+            command = lines[index].strip()
+            if heredoc is not None:
+                if command == heredoc["delimiter"]:
+                    if heredoc["candidate"] is not None and not heredoc["quoted"]:
+                        target = heredoc["target"]
+                        if target is not None and any(
+                            self._makes_executable(lines[later].strip(), target)
+                            for later in range(index + 1, end)
+                        ):
+                            return _SourceMatch(heredoc["candidate"])
+                    heredoc = None
+                elif self._uses_package(command, variable):
+                    heredoc["candidate"] = offsets[index]
+                continue
+
+            opener = self._HEREDOC.search(command)
+            if opener:
+                heredoc = {
+                    "delimiter": opener.group("delimiter"),
+                    "quoted": bool(opener.group("quote")),
+                    "target": opener.group("target"),
+                    "candidate": None,
+                }
+                continue
+            if self._uses_package(command, variable):
+                return _SourceMatch(offsets[index])
+        return None
+
+    def finditer(self, content: str):
+        """Yield step-local package execution matches in source order."""
+        lines = content.splitlines(keepends=True)
+        offsets = []
+        offset = 0
+        for line in lines:
+            offsets.append(offset)
+            offset += len(line)
+
+        for index, raw_line in enumerate(lines):
+            env_match = self._ENV.match(raw_line.rstrip("\r\n"))
+            if not env_match:
+                continue
+            field_width = len(env_match.group("indent")) + len(
+                env_match.group("compact") or ""
+            )
+            package = None
+            cursor = index + 1
+            while cursor < len(lines):
+                plain = lines[cursor].rstrip("\r\n")
+                if not plain.strip():
+                    cursor += 1
+                    continue
+                if self._indent_width(plain) <= field_width:
+                    break
+                package_match = self._PACKAGE.match(plain)
+                if package_match:
+                    package = package_match.group("name")
+                cursor += 1
+            while cursor < len(lines) and (
+                not lines[cursor].strip()
+                or lines[cursor].lstrip(" \t").startswith("#")
+            ):
+                cursor += 1
+            if package is None or cursor >= len(lines):
+                continue
+            run_match = self._RUN.match(lines[cursor].rstrip("\r\n"))
+            if not run_match or len(run_match.group("indent")) != field_width:
+                continue
+
+            run_value = run_match.group("value")
+            if run_value and run_value[0] not in "|>":
+                if self._uses_package(run_value, package):
+                    yield _SourceMatch(offsets[cursor])
+                continue
+
+            block_start = cursor + 1
+            block_end = block_start
+            while block_end < len(lines):
+                plain = lines[block_end].rstrip("\r\n")
+                if plain.strip() and self._indent_width(plain) <= field_width:
+                    break
+                block_end += 1
+            match = self._block_match(
+                lines, offsets, block_start, block_end, package
+            )
+            if match is not None:
+                yield match
+
+
 def _parse_yaml_regex_rules(text: str, origin: str = "<rules>"):
     """Parse the supported pattern-regex subset of AppGuardrail rule YAML."""
     parsed_rules = []
@@ -971,6 +1996,7 @@ def finish_rule():
                 "exclude_paths": [],
                 "required_substrings": [],
                 "severity": "WARNING",
+                "analyzer": None,
             }
             in_message = False
             path_mode = None
@@ -998,6 +2024,12 @@ def finish_rule():
             ).upper()
             path_mode = None
             continue
+        if raw_line.startswith("    analyzer: "):
+            current["analyzer"] = _unquote_rule_scalar(
+                raw_line.split(":", 1)[1]
+            )
+            path_mode = None
+            continue
         if raw_line.startswith("    languages: "):
             current["languages"] = _parse_inline_list(raw_line.split(":", 1)[1])
             path_mode = None
@@ -1031,6 +2063,36 @@ def _compile_yaml_regex_rule(rule):
     """Build runtime regex scanner rules from one parsed YAML rule."""
     compiled_rules = []
     extensions = _extensions_for_languages(rule.get("languages") or [])
+    if rule.get("analyzer") == "github-actions-pull-request-target-execution":
+        return [
+            {
+                "id": rule["id"],
+                "pattern": _GitHubActionsPullRequestTargetPattern(),
+                "severity": rule.get("severity", "WARNING"),
+                "message": rule.get("message") or f"Rule {rule['id']} matched.",
+                "extensions": extensions,
+                "include_paths": rule.get("include_paths") or [],
+                "exclude_paths": rule.get("exclude_paths") or [],
+                "required_substrings": tuple(
+                    rule.get("required_substrings") or ()
+                ),
+            }
+        ]
+    if rule.get("analyzer") == "github-actions-runtime-package-integrity":
+        return [
+            {
+                "id": rule["id"],
+                "pattern": _GitHubActionsRuntimePackagePattern(),
+                "severity": rule.get("severity", "WARNING"),
+                "message": rule.get("message") or f"Rule {rule['id']} matched.",
+                "extensions": extensions,
+                "include_paths": rule.get("include_paths") or [],
+                "exclude_paths": rule.get("exclude_paths") or [],
+                "required_substrings": tuple(
+                    rule.get("required_substrings") or ()
+                ),
+            }
+        ]
     for regex in rule.get("regexes") or []:
         try:
             pattern = re.compile(regex, re.MULTILINE)
diff --git a/scanner/rules/github_actions.yml b/scanner/rules/github_actions.yml
index c405808d3..4502eb52a 100644
--- a/scanner/rules/github_actions.yml
+++ b/scanner/rules/github_actions.yml
@@ -1,4 +1,48 @@
 rules:
+  # `pull_request_target` runs trusted-base workflow YAML with access to base
+  # repository authority. That authority must never cross into mutable PR-head
+  # code, even when the branch belongs to the same repository.
+  - id: github-actions-pull-request-target-untrusted-head-execution
+    analyzer: github-actions-pull-request-target-execution
+    message: |
+      This pull_request_target job combines repository privilege with an
+      event-derived PR-head checkout or git materialization and then executes
+      code from that mutable tree. A same-repository author predicate is not a
+      trust boundary because collaborator branches remain contributor-writable.
+      Keep pull_request_target metadata-only, or dispatch a separately reviewed
+      default-branch workflow that never loads PR-controlled executable content.
+      [CWE-829 - Inclusion of Functionality from Untrusted Control Sphere;
+      CWE-269 - Improper Privilege Management; OWASP A08:2021 - Software and
+      Data Integrity Failures]
+    severity: HIGH
+    languages: [generic]
+    prefilter: [pull_request_target, head]
+    paths:
+      include:
+        - .github/workflows/*.yml
+        - .github/workflows/*.yaml
+
+  # Bind a step-local versioned registry-package environment value to the
+  # package-selector position of that step's run command. Quoted heredocs are
+  # excluded because their body is literal data, not shell execution.
+  - id: github-actions-runtime-package-without-integrity
+    analyzer: github-actions-runtime-package-integrity
+    message: |
+      This GitHub Actions workflow binds a versioned npm registry package to
+      an npx/npm-exec auto-install path. The version constrains resolution but
+      does not bind package bytes to repository-reviewed integrity evidence.
+      Use a canonical protected workflow or immutable released tool contract;
+      install its committed lock with `npm ci --ignore-scripts`, execute the
+      verified local binary, and disable tool self-download where supported.
+      [CWE-829 - Inclusion of Functionality from Untrusted Control Sphere;
+      OWASP A08:2021 - Software and Data Integrity Failures]
+    severity: HIGH
+    languages: [generic]
+    paths:
+      include:
+        - .github/workflows/*.yml
+        - .github/workflows/*.yaml
+
   # A write token plus an explicit push back to contributor-controlled branch
   # state is materially different from a reviewed release publisher. Match the
   # structure, not temporary-looking names such as `once` or `repair`.
diff --git a/tests/test_github_actions_runtime_package_integrity.py b/tests/test_github_actions_runtime_package_integrity.py
new file mode 100644
index 000000000..e77938ff9
--- /dev/null
+++ b/tests/test_github_actions_runtime_package_integrity.py
@@ -0,0 +1,354 @@
+"""Regression tests for runtime npm package execution in GitHub Actions."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from scanner.cli.appguardrail import SCAN_RULES, _scan_file
+
+
+_RULE_ID = "github-actions-runtime-package-without-integrity"
+
+
+def _scan_workflow(tmp_path: Path, workflow: str) -> list[dict]:
+    """Scan one repository-local workflow with production path filtering."""
+    workflow_path = tmp_path / ".github" / "workflows" / "security.yml"
+    workflow_path.parent.mkdir(parents=True)
+    workflow_path.write_text(workflow, encoding="utf-8")
+    return _scan_file(workflow_path, tmp_path)
+
+
+def test_runtime_package_rule_is_packaged_and_path_scoped() -> None:
+    """The detector must load once and apply only to workflow YAML files."""
+    matches = [rule for rule in SCAN_RULES if rule["id"] == _RULE_ID]
+
+    assert len(matches) == 1
+    assert matches[0]["severity"] == "HIGH"
+    assert matches[0]["include_paths"] == [
+        ".github/workflows/*.yml",
+        ".github/workflows/*.yaml",
+    ]
+    assert "CWE-829" in matches[0]["message"]
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        'exec npx -y "$CODEGRAPH_PACKAGE" "$@"',
+        'npx --yes "$CODEGRAPH_PACKAGE" scan .',
+        'npm exec --package="$CODEGRAPH_PACKAGE" --yes -- scan .',
+        'npm exec -y -- "$CODEGRAPH_PACKAGE" scan .',
+    ],
+)
+def test_runtime_registry_package_execution_is_reported(
+    tmp_path: Path, command: str
+) -> None:
+    """Versioned registry packages still lack committed byte integrity."""
+    workflow = f"""
+name: Security process
+on: pull_request
+jobs:
+  scan:
+    steps:
+      - name: Prepare CodeGraph CLI
+        env:
+          CODEGRAPH_PACKAGE: "@colbymchenry/codegraph@0.9.9"
+        run: |
+          {command}
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(_RULE_ID) == 1
+
+
+def test_lock_verified_local_binary_is_not_reported(tmp_path: Path) -> None:
+    """A committed lock plus npm ci and local binary execution is safe here."""
+    workflow = """
+name: Security process
+on: pull_request
+jobs:
+  scan:
+    steps:
+      - name: Install CodeGraph CLI
+        env:
+          CODEGRAPH_NO_DOWNLOAD: "1"
+        run: |
+          npm ci --ignore-scripts --omit=dev --no-audit --no-fund
+          node_modules/.bin/codegraph scan .
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _RULE_ID not in {finding["rule_id"] for finding in findings}
+
+
+@pytest.mark.parametrize(
+    "package_value, command",
+    [
+        (None, "npx -y eslint ."),
+        (None, "npm exec --yes -- eslint ."),
+        ("./tools/local-cli.tgz", 'npx -y "$TOOL_PACKAGE" scan .'),
+    ],
+)
+def test_local_or_unbound_package_execution_is_not_reported(
+    tmp_path: Path, package_value: str | None, command: str
+) -> None:
+    """Local tools without a versioned registry binding stay outside scope."""
+    env = (
+        f'        env:\n          TOOL_PACKAGE: "{package_value}"\n'
+        if package_value
+        else ""
+    )
+    workflow = f"""
+name: Local tool
+on: pull_request
+jobs:
+  scan:
+    steps:
+      - name: Run local tool
+{env}        run: |
+          npm ci --ignore-scripts
+          {command}
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _RULE_ID not in {finding["rule_id"] for finding in findings}
+
+
+def test_runtime_package_text_outside_workflow_is_not_reported(tmp_path: Path) -> None:
+    """Documentation and non-workflow YAML must stay outside the rule boundary."""
+    example = tmp_path / "docs" / "example.yaml"
+    example.parent.mkdir()
+    example.write_text("command: npx -y example@1.0.0\n", encoding="utf-8")
+
+    findings = _scan_file(example, tmp_path)
+
+    assert _RULE_ID not in {finding["rule_id"] for finding in findings}
+
+
+def test_commented_or_echoed_examples_are_not_reported(tmp_path: Path) -> None:
+    """Disabled or printed examples must not masquerade as executed commands."""
+    workflow = """
+name: Documentation example
+on: pull_request
+jobs:
+  docs:
+    steps:
+      - run: |
+          # npx -y example@1.0.0
+          echo "npx -y example@1.0.0"
+          printf '%s\\n' 'npm exec --yes example@1.0.0'
+          cat <<'EXAMPLE'
+          npx -y example@1.0.0
+          EXAMPLE
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _RULE_ID not in {finding["rule_id"] for finding in findings}
+
+
+@pytest.mark.parametrize(
+    "workflow",
+    [
+        """
+name: Cross-step variable
+on: pull_request
+jobs:
+  scan:
+    steps:
+      - name: Declare package
+        env:
+          TOOL_PACKAGE: "example-tool@1.0.0"
+        run: echo "declaration only"
+      - name: Undefined variable in another step
+        run: npx -y "$TOOL_PACKAGE"
+""",
+        """
+name: Quoted heredoc documentation
+on: pull_request
+jobs:
+  scan:
+    steps:
+      - name: Print documentation
+        env:
+          TOOL_PACKAGE: "example-tool@1.0.0"
+        run: |
+          cat <<'EXAMPLE'
+          npx -y "$TOOL_PACKAGE"
+          EXAMPLE
+""",
+        """
+name: Variable is not the package selector
+on: pull_request
+jobs:
+  scan:
+    steps:
+      - name: Label a local report
+        env:
+          TOOL_PACKAGE: "example-tool@1.0.0"
+        run: npx -y local-report --label "$TOOL_PACKAGE"
+""",
+        """
+name: Variable prefix collision
+on: pull_request
+jobs:
+  scan:
+    steps:
+      - name: Run a different package variable
+        env:
+          TOOL_PACKAGE: "example-tool@1.0.0"
+        run: npx -y "$TOOL_PACKAGE_SUFFIX"
+""",
+    ],
+)
+def test_noncausal_runtime_package_text_is_not_reported(
+    tmp_path: Path, workflow: str
+) -> None:
+    """Lexical proximity must not replace step-local package binding."""
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _RULE_ID not in {finding["rule_id"] for finding in findings}
+
+
+def test_blank_line_before_runtime_command_does_not_bypass_rule(tmp_path: Path) -> None:
+    """Blank block-scalar lines must not hide an executed package selector."""
+    workflow = """
+name: Blank line
+on: pull_request
+jobs:
+  scan:
+    steps:
+      - name: Run package
+        env:
+          TOOL_PACKAGE: "example-tool@1.0.0"
+        run: |
+
+          npx -y "$TOOL_PACKAGE"
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(_RULE_ID) == 1
+
+
+def test_command_after_quoted_heredoc_is_still_reported(tmp_path: Path) -> None:
+    """A literal heredoc must not hide a later executed command in the step."""
+    workflow = """
+name: Documentation then execution
+on: pull_request
+jobs:
+  scan:
+    steps:
+      - name: Run package
+        env:
+          TOOL_PACKAGE: "example-tool@1.0.0"
+        run: |
+          cat <<'EXAMPLE'
+          npx -y "$TOOL_PACKAGE"
+          EXAMPLE
+          npx -y "$TOOL_PACKAGE"
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(_RULE_ID) == 1
+
+
+@pytest.mark.parametrize(
+    "postlude",
+    ["", 'echo \'chmod 0755 "$wrapper"\'', 'chmod 0644 "$wrapper"'],
+)
+def test_unquoted_heredoc_without_executable_wrapper_is_not_reported(
+    tmp_path: Path, postlude: str
+) -> None:
+    """Unexecuted generated text is not a runtime package finding by itself."""
+    workflow = f"""
+name: Generated documentation
+on: pull_request
+jobs:
+  scan:
+    steps:
+      - name: Write example
+        env:
+          TOOL_PACKAGE: "example-tool@1.0.0"
+        run: |
+          wrapper="${{RUNNER_TEMP}}/example.txt"
+          cat >"$wrapper" <<EXAMPLE
+          npx -y "$TOOL_PACKAGE"
+          EXAMPLE
+          {postlude}
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _RULE_ID not in {finding["rule_id"] for finding in findings}
+
+
+def test_materialized_executable_wrapper_is_reported(tmp_path: Path) -> None:
+    """An unquoted heredoc made executable retains runtime-path evidence."""
+    workflow = """
+name: Generated executable
+on: pull_request
+jobs:
+  scan:
+    steps:
+      - name: Write wrapper
+        env:
+          TOOL_PACKAGE: "example-tool@1.0.0"
+        run: |
+          wrapper="${RUNNER_TEMP}/tool"
+          cat >"$wrapper" <<SCRIPT
+          exec npx -y "$TOOL_PACKAGE" "$@"
+          SCRIPT
+          chmod 0755 "$wrapper"
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(_RULE_ID) == 1
+
+
+@pytest.mark.parametrize(
+    "step",
+    [
+        '      - env:\n'
+        '          TOOL_PACKAGE: "example-tool@1.0.0"\n'
+        '        run: npx -y "$TOOL_PACKAGE"',
+        '      - name: Comment between fields\n'
+        '        env:\n'
+        '          TOOL_PACKAGE: "example-tool@1.0.0"\n'
+        '        # The comment does not end the step mapping.\n'
+        '        run: npx -y "$TOOL_PACKAGE"',
+    ],
+)
+def test_compact_or_commented_step_mapping_is_reported(
+    tmp_path: Path, step: str
+) -> None:
+    """Valid step mapping forms must preserve the env-to-run causal pair."""
+    workflow = f"""
+name: Valid step mapping
+on: pull_request
+jobs:
+  scan:
+    steps:
+{step}
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(_RULE_ID) == 1
+
+
+def test_repository_workflow_remains_a_positive_incident_fixture() -> None:
+    """The protected incident remains detected until canonical consumption exists."""
+    repository_root = Path(__file__).parents[1]
+    workflow_path = repository_root / ".github/workflows/security-process.yml"
+
+    findings = _scan_file(workflow_path, repository_root)
+
+    assert [finding["rule_id"] for finding in findings].count(_RULE_ID) == 1
diff --git a/tests/test_github_actions_writer_rules.py b/tests/test_github_actions_writer_rules.py
index 2d6d0080b..de2cc93e1 100644
--- a/tests/test_github_actions_writer_rules.py
+++ b/tests/test_github_actions_writer_rules.py
@@ -7,12 +7,1143 @@
 from scanner.cli.appguardrail import SCAN_RULES, _scan_file
 
 
+_PR_TARGET_EXECUTION_RULE_ID = (
+    "github-actions-pull-request-target-untrusted-head-execution"
+)
+
+
 def _matches(rule_id: str, workflow: str) -> bool:
     matches = [rule for rule in SCAN_RULES if rule["id"] == rule_id]
     assert len(matches) == 1
     return bool(matches[0]["pattern"].search(workflow))
 
 
+def _scan_workflow(tmp_path, workflow: str) -> list[dict]:
+    """Scan one repository-local workflow through production path filters."""
+    workflow_path = tmp_path / ".github" / "workflows" / "review.yml"
+    workflow_path.parent.mkdir(parents=True, exist_ok=True)
+    workflow_path.write_text(workflow, encoding="utf-8")
+    return _scan_file(workflow_path, tmp_path)
+
+
+def test_pr_target_execution_rule_is_packaged_and_path_scoped() -> None:
+    """The detector must load once as a HIGH workflow-only rule."""
+    matches = [
+        rule for rule in SCAN_RULES if rule["id"] == _PR_TARGET_EXECUTION_RULE_ID
+    ]
+
+    assert len(matches) == 1
+    assert matches[0]["severity"] == "HIGH"
+    assert matches[0]["include_paths"] == [
+        ".github/workflows/*.yml",
+        ".github/workflows/*.yaml",
+    ]
+    assert "CWE-829" in matches[0]["message"]
+
+
+def test_privileged_pull_request_target_pr_head_execution_is_reported(
+    tmp_path,
+) -> None:
+    """Same-repository PR heads remain mutable despite an author predicate."""
+    workflow = """
+name: Privileged review
+on: pull_request_target
+permissions:
+  contents: read
+jobs:
+  review:
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    steps:
+      - name: Materialize mutable PR head
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - env:
+          REVIEW_TOKEN: ${{ secrets.REVIEW_TOKEN }}
+        run: bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+def test_metadata_only_pull_request_target_is_not_reported(tmp_path) -> None:
+    """Privileged base-code metadata handling does not execute the PR tree."""
+    workflow = """
+name: Label trusted metadata
+on: pull_request_target
+permissions:
+  pull-requests: write
+jobs:
+  label:
+    steps:
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
+        with:
+          script: |
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              labels: ["triage"]
+            })
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+def test_pr_head_git_worktree_execution_is_reported(tmp_path) -> None:
+    """The retained corpus incident used a shell-created PR-head worktree."""
+    workflow = """
+name: Review in worktree
+on: pull_request_target
+permissions: {id-token: write}
+jobs:
+  review:
+    env:
+      PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+    steps:
+      - run: |
+          git fetch origin "$PR_HEAD_SHA"
+          git worktree add /tmp/review FETCH_HEAD
+          cd /tmp/review
+          npx -y @colbymchenry/codegraph@0.9.9 scan .
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+@pytest.mark.parametrize(
+    "job_guard",
+    [
+        "github.event_name == 'repository_dispatch'",
+        "github.event_name != 'pull_request_target'",
+        "github.event_name == 'repository_dispatch' && github.event.action == 'review'",
+    ],
+)
+def test_job_guard_excluding_pr_target_is_not_reported(
+    tmp_path, job_guard: str
+) -> None:
+    """A shared workflow may isolate execution to a trusted dispatch event."""
+    workflow = f"""
+on: [pull_request_target, repository_dispatch]
+permissions: {{id-token: write}}
+jobs:
+  review:
+    if: {job_guard}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{{{ github.event.client_payload.head_sha || github.event.pull_request.head.sha }}}}
+      - run: bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+def test_block_job_guard_excluding_pr_target_is_not_reported(tmp_path) -> None:
+    """Folded job guards retain the same event-reachability semantics."""
+    workflow = """
+on: [pull_request_target, repository_dispatch]
+permissions: {id-token: write}
+jobs:
+  review:
+    if: >-
+      always()
+      && github.event_name == 'repository_dispatch'
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - run: bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+def test_negated_other_event_guard_does_not_exclude_pr_target(tmp_path) -> None:
+    """Negating a trusted-event equality admits PR-target execution."""
+    workflow = """
+on: [pull_request_target, repository_dispatch]
+permissions: {id-token: write}
+jobs:
+  review:
+    if: ${{ !(github.event_name == 'repository_dispatch') }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - run: bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+def test_boolean_inverted_other_event_guard_does_not_exclude_pr_target(
+    tmp_path,
+) -> None:
+    """Comparing a trusted-event predicate to false admits PR-target."""
+    workflow = """
+on: [pull_request_target, repository_dispatch]
+permissions: {id-token: write}
+jobs:
+  review:
+    if: (github.event_name == 'repository_dispatch') == false
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - run: bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+def test_or_of_non_pr_target_events_is_not_reported(tmp_path) -> None:
+    """Every disjunct excludes PR-target, so the job is unreachable there."""
+    workflow = """
+on: [pull_request_target, repository_dispatch, workflow_dispatch]
+permissions: {id-token: write}
+jobs:
+  review:
+    if: github.event_name == 'repository_dispatch' || github.event_name == 'workflow_dispatch'
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - run: bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+def test_safe_event_guard_with_unrelated_negation_is_not_reported(tmp_path) -> None:
+    """An independent cancelled predicate cannot reopen PR-target reachability."""
+    workflow = """
+on: [pull_request_target, repository_dispatch]
+permissions: {id-token: write}
+jobs:
+  review:
+    if: github.event_name != 'pull_request_target' && !cancelled()
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - run: bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+@pytest.mark.parametrize(
+    "head_expression",
+    [
+        "github['event']['pull_request']['head']['sha']",
+        "github.event.pull_request.head['sha']",
+        "github['head_ref']",
+    ],
+)
+def test_bracket_pr_head_expression_is_reported(
+    tmp_path, head_expression: str
+) -> None:
+    """GitHub expression index and dot paths have identical trust semantics."""
+    workflow = f"""
+on: pull_request_target
+permissions: {{id-token: write}}
+jobs:
+  review:
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{{{ {head_expression} }}}}
+      - run: bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+@pytest.mark.parametrize("global_field", ["permissions: write-all", "env:\n  PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}"])
+def test_top_level_authority_after_jobs_is_reported(
+    tmp_path, global_field: str
+) -> None:
+    """Top-level YAML field order does not change authority or aliases."""
+    privilege = "" if global_field.startswith("permissions") else "permissions: write-all\n"
+    ref = (
+        "${{ github.event.pull_request.head.sha }}"
+        if global_field.startswith("permissions")
+        else '"$PR_HEAD_SHA"'
+    )
+    workflow = f"""
+on: pull_request_target
+{privilege}jobs:
+  review:
+    steps:
+      - run: |
+          git checkout {ref}
+          bash ./ci/review.sh
+{global_field}
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+@pytest.mark.parametrize(
+    "step",
+    [
+        """      - env:
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          git checkout \"$PR_HEAD_SHA\"
+          bash ./ci/review.sh""",
+        """      - name: Review
+        env:
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          git checkout \"$PR_HEAD_SHA\"
+          bash ./ci/review.sh""",
+    ],
+)
+def test_same_step_pr_head_env_alias_is_reported(tmp_path, step: str) -> None:
+    """A step-local alias is live in that same step's shell."""
+    workflow = f"""
+on: pull_request_target
+permissions: {{id-token: write}}
+jobs:
+  review:
+    steps:
+{step}
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+@pytest.mark.parametrize(
+    "env_location",
+    [
+        "env: {PR_HEAD_SHA: \"${{ github.event.pull_request.head.sha }}\"}\n",
+        """jobs:
+  review:
+    env: {PR_HEAD_SHA: "${{ github.event.pull_request.head.sha }}"}
+    steps:
+      - run: |
+          git checkout "$PR_HEAD_SHA"
+          bash ./ci/review.sh
+""",
+        """jobs:
+  review:
+    steps:
+      - env: {PR_HEAD_SHA: "${{ github.event.pull_request.head.sha }}"}
+        run: |
+          git checkout "$PR_HEAD_SHA"
+          bash ./ci/review.sh
+""",
+    ],
+)
+def test_flow_env_pr_head_alias_is_reported(tmp_path, env_location: str) -> None:
+    """Flow and block env mappings have the same one-hop alias semantics."""
+    if env_location.startswith("env:"):
+        body = f"""{env_location}jobs:
+  review:
+    steps:
+      - run: |
+          git checkout "$PR_HEAD_SHA"
+          bash ./ci/review.sh
+"""
+    else:
+        body = env_location
+    workflow = f"""
+on: pull_request_target
+permissions: {{id-token: write}}
+{body}"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+def test_inline_checkout_ref_is_reported(tmp_path) -> None:
+    """A flow-style with.ref still selects the mutable PR revision."""
+    workflow = """
+on: pull_request_target
+permissions: {id-token: write}
+jobs:
+  review:
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with: {ref: "${{ github.event.pull_request.head.sha }}"}
+      - run: bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+@pytest.mark.parametrize(
+    "mapping",
+    [
+        """env: {
+  PR_HEAD_SHA: "${{ github.event.pull_request.head.sha }}"
+}
+jobs:
+  review:
+    steps:
+      - run: |
+          git checkout "$PR_HEAD_SHA"
+          bash ./ci/review.sh
+""",
+        """jobs:
+  review:
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with: {
+          ref: "${{ github.event.pull_request.head.sha }}"
+        }
+      - run: bash ./ci/review.sh
+""",
+    ],
+)
+def test_multiline_flow_mapping_is_reported(tmp_path, mapping: str) -> None:
+    """Multiline and single-line flow mappings have equivalent semantics."""
+    workflow = f"""
+on: pull_request_target
+permissions: {{id-token: write}}
+{mapping}"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+def test_top_level_pr_head_env_alias_is_reported(tmp_path) -> None:
+    """Workflow env values are available to the shell materialization step."""
+    workflow = """
+on: pull_request_target
+permissions: {id-token: write}
+env:
+  PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+jobs:
+  review:
+    steps:
+      - run: |
+          git fetch origin "$PR_HEAD_SHA"
+          git worktree add /tmp/review FETCH_HEAD
+          cd /tmp/review
+          npx -y @colbymchenry/codegraph@0.9.9 scan .
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+@pytest.mark.parametrize(
+    "workflow",
+    [
+        """
+on: pull_request_target
+permissions: {id-token: write}
+jobs:
+  review:
+    steps:
+      - uses: example/action@0123456789abcdef0123456789abcdef01234567
+        with:
+          env:
+            PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+      - run: |
+          git fetch origin "$PR_HEAD_SHA"
+          bash ./ci/review.sh
+""",
+        """
+on: pull_request_target
+permissions: {id-token: write}
+jobs:
+  review:
+    steps:
+      - env:
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: echo scoped declaration
+      - run: |
+          git fetch origin "$PR_HEAD_SHA"
+          bash ./ci/review.sh
+""",
+    ],
+)
+def test_non_job_env_alias_does_not_cross_step_scope(
+    tmp_path, workflow: str
+) -> None:
+    """Action inputs and step-local env do not bind a later shell step."""
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+def test_checkout_non_ref_pr_expression_is_not_reported(tmp_path) -> None:
+    """Only the checkout ref input selects materialized source revision."""
+    workflow = """
+on: pull_request_target
+permissions: {id-token: write}
+jobs:
+  review:
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: main
+          path: ${{ github.head_ref }}
+      - run: bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+def test_checkout_sibling_ref_is_not_reported(tmp_path) -> None:
+    """Only with.ref, not an env key named ref, controls checkout revision."""
+    workflow = """
+on: pull_request_target
+permissions: {id-token: write}
+jobs:
+  review:
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        env:
+          ref: ${{ github.event.pull_request.head.sha }}
+        with:
+          ref: main
+      - run: bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+@pytest.mark.parametrize(
+    "materialization",
+    [
+        'git fetch origin "$PR_HEAD_SHA"',
+        'git fetch origin main # "$PR_HEAD_SHA" is retained for logs',
+    ],
+)
+def test_fetch_without_pr_tree_selection_is_not_reported(
+    tmp_path, materialization: str
+) -> None:
+    """Fetching alone does not make a later trusted-base script PR code."""
+    workflow = f"""
+on: pull_request_target
+permissions: {{id-token: write}}
+env:
+  PR_HEAD_SHA: ${{{{ github.event.pull_request.head.sha }}}}
+jobs:
+  review:
+    steps:
+      - run: |
+          {materialization}
+          bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+def test_worktree_without_execution_link_is_not_reported(tmp_path) -> None:
+    """A later scalar command still runs in the trusted base workspace."""
+    workflow = """
+on: pull_request_target
+permissions: {id-token: write}
+env:
+  PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+jobs:
+  review:
+    steps:
+      - run: |
+          git fetch origin "$PR_HEAD_SHA"
+          git worktree add /tmp/review FETCH_HEAD
+      - run: bash ./ci/base.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+@pytest.mark.parametrize(
+    "execution",
+    [
+        "bash /tmp/review/ci/review.sh",
+        "bash -e /tmp/review/ci/review.sh",
+        "python3 -u /tmp/review/ci/review.py",
+        "python3 -W ignore /tmp/review/ci/review.py",
+        "bash -O extglob /tmp/review/ci/review.sh",
+        "pushd /tmp/review\nbash ./ci/review.sh",
+    ],
+)
+def test_worktree_linked_block_execution_is_reported(
+    tmp_path, execution: str
+) -> None:
+    """Absolute paths and pushd both bind execution to the PR worktree."""
+    indented_execution = execution.replace("\n", "\n          ")
+    workflow = f"""
+on: pull_request_target
+permissions: {{id-token: write}}
+env:
+  PR_HEAD_SHA: ${{{{ github.event.pull_request.head.sha }}}}
+jobs:
+  review:
+    steps:
+      - run: |
+          git fetch origin "$PR_HEAD_SHA"
+          git worktree add /tmp/review FETCH_HEAD
+          {indented_execution}
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+def test_worktree_working_directory_execution_is_reported(tmp_path) -> None:
+    """A later step may explicitly run inside the selected PR worktree."""
+    workflow = """
+on: pull_request_target
+permissions: {id-token: write}
+env:
+  PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+jobs:
+  review:
+    steps:
+      - run: |
+          git fetch origin "$PR_HEAD_SHA"
+          git worktree add /tmp/review FETCH_HEAD
+      - working-directory: /tmp/review
+        run: bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+def test_trusted_fetch_overwrites_pr_fetch_head(tmp_path) -> None:
+    """The most recent ordinary fetch determines FETCH_HEAD selection."""
+    workflow = """
+on: pull_request_target
+permissions: {id-token: write}
+env:
+  PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+jobs:
+  review:
+    steps:
+      - run: |
+          git fetch origin "$PR_HEAD_SHA"
+          git fetch origin main
+          git worktree add /tmp/review FETCH_HEAD
+          cd /tmp/review
+          bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+@pytest.mark.parametrize(
+    "option", ["--no-write-fetch-head", "--append", "-ap", "-pa"]
+)
+def test_non_overwriting_fetch_preserves_pr_fetch_head(
+    tmp_path, option: str
+) -> None:
+    """Fetch modes that do not replace FETCH_HEAD preserve PR provenance."""
+    workflow = f"""
+on: pull_request_target
+permissions: {{id-token: write}}
+env:
+  PR_HEAD_SHA: ${{{{ github.event.pull_request.head.sha }}}}
+jobs:
+  review:
+    steps:
+      - run: |
+          git fetch origin "$PR_HEAD_SHA"
+          git fetch {option} origin main
+          git worktree add /tmp/review FETCH_HEAD
+          cd /tmp/review
+          bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+@pytest.mark.parametrize(
+    "selection",
+    [
+        """      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: main
+      - run: bash ./ci/base.sh""",
+        """      - run: |
+          git checkout "${{ github.event.pull_request.head.sha }}"
+          git checkout main
+          bash ./ci/base.sh""",
+    ],
+)
+def test_later_trusted_selection_invalidates_pr_tree(
+    tmp_path, selection: str
+) -> None:
+    """Execution provenance follows the most recent selected workspace tree."""
+    workflow = f"""
+on: pull_request_target
+permissions: {{id-token: write}}
+jobs:
+  review:
+    steps:
+{selection}
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        "git checkout -- README.md",
+        "git switch -c review",
+        'echo "git checkout main"',
+        "if false; then git checkout main; fi",
+        'git checkout "$PR_HEAD_SHA"',
+        "git checkout HEAD",
+        "git switch --detach",
+        "git checkout --detach HEAD",
+        "git checkout -f HEAD",
+    ],
+)
+def test_non_tree_changing_or_pr_selection_preserves_pr_tree(
+    tmp_path, command: str
+) -> None:
+    """Only an executed selection of a different tree clears PR provenance."""
+    workflow = f"""
+on: pull_request_target
+permissions: {{id-token: write}}
+env:
+  PR_HEAD_SHA: ${{{{ github.event.pull_request.head.sha }}}}
+jobs:
+  review:
+    steps:
+      - run: |
+          git checkout "$PR_HEAD_SHA"
+          {command}
+          bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+def test_run_block_checkout_document_is_not_authority(tmp_path) -> None:
+    """YAML-looking heredoc data cannot materialize a PR tree."""
+    workflow = """
+on: pull_request_target
+permissions: {id-token: write}
+jobs:
+  review:
+    steps:
+      - run: |
+          cat <<'EOF'
+          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+          with:
+            ref: ${{ github.event.pull_request.head.sha }}
+          EOF
+          bash ./ci/base.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+def test_run_block_checkout_document_does_not_clear_pr_tree(tmp_path) -> None:
+    """YAML-looking heredoc data cannot invalidate a real PR checkout."""
+    workflow = """
+on: pull_request_target
+permissions: {id-token: write}
+jobs:
+  review:
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - run: |
+          cat <<'EOF'
+          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+          EOF
+          bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+@pytest.mark.parametrize(
+    "execution",
+    [
+        "bash ./ci/base.sh --output /tmp/review/results.json",
+        "cd /tmp/review\ncd \"$GITHUB_WORKSPACE\"\nbash ./ci/base.sh",
+    ],
+)
+def test_worktree_path_mention_or_exit_is_not_reported(
+    tmp_path, execution: str
+) -> None:
+    """Arguments and exited directories do not prove PR-tree execution."""
+    body = execution.replace("\n", "\n          ")
+    workflow = f"""
+on: pull_request_target
+permissions: {{id-token: write}}
+env:
+  PR_HEAD_SHA: ${{{{ github.event.pull_request.head.sha }}}}
+jobs:
+  review:
+    steps:
+      - run: |
+          git fetch origin "$PR_HEAD_SHA"
+          git worktree add /tmp/review FETCH_HEAD
+          {body}
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+def test_normalized_relative_worktree_entry_is_reported(tmp_path) -> None:
+    """Equivalent relative path spellings bind the same worktree."""
+    workflow = """
+on: pull_request_target
+permissions: {id-token: write}
+env:
+  PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+jobs:
+  review:
+    steps:
+      - run: |
+          git fetch origin "$PR_HEAD_SHA"
+          git worktree add ./review FETCH_HEAD
+          cd review
+          bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+def test_pr_alias_must_select_git_materialization_revision(tmp_path) -> None:
+    """Nearby output cannot bind a trusted git fetch to the PR revision."""
+    workflow = """
+on: pull_request_target
+permissions: {id-token: write}
+env:
+  PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+jobs:
+  review:
+    steps:
+      - run: |
+          echo "$PR_HEAD_SHA"; git fetch origin main
+          bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+def test_bracket_secret_context_grants_job_privilege(tmp_path) -> None:
+    """GitHub's bracket context syntax is equivalent to dot syntax."""
+    workflow = """
+on: pull_request_target
+permissions: {contents: read}
+jobs:
+  review:
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - env:
+          REVIEW_TOKEN: ${{ secrets['REVIEW_TOKEN'] }}
+        run: bash ./ci/review.sh
+"""
+
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+@pytest.mark.parametrize(
+    "workflow",
+    [
+        """
+on: pull_request
+permissions: {id-token: write}
+jobs:
+  review:
+    steps:
+      - uses: example/action@0123456789abcdef0123456789abcdef01234567
+        with:
+          on: pull_request_target
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - run: bash ./ci/review.sh
+""",
+        """
+on: pull_request_target
+permissions: {contents: read}
+jobs:
+  review:
+    steps:
+      # REVIEW_TOKEN: ${{ secrets.REVIEW_TOKEN }}
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - run: bash ./ci/review.sh
+""",
+        """
+on: pull_request_target
+permissions: {contents: read}
+jobs:
+  review:
+    steps:
+      - run: |
+          cat <<'EXAMPLE'
+          permissions: write-all
+          EXAMPLE
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - run: bash ./ci/review.sh
+""",
+    ],
+)
+def test_yaml_like_inert_text_is_not_causal_privilege_or_trigger(
+    tmp_path, workflow: str
+) -> None:
+    """Action inputs, comments, and run data cannot supply causal authority."""
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
+@pytest.mark.parametrize(
+    "workflow",
+    [
+        """
+on:
+  - pull_request_target
+permissions:
+  id-token: write # OIDC exchange
+jobs:
+  review:
+    steps:
+      - with:
+          ref: ${{ github.event.pull_request.head.sha }}
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - run: bash ./ci/review.sh
+""",
+        """
+'on':
+  pull_request_target:
+permissions: {id-token: write} # trusted-base authority
+jobs:
+  review:
+    steps:
+      - name: Checkout
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - run: ./ci/review.sh
+""",
+    ],
+)
+def test_valid_yaml_order_comments_and_trigger_forms_are_reported(
+    tmp_path, workflow: str
+) -> None:
+    """Equivalent YAML syntax must not bypass a HIGH trust-boundary rule."""
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert [finding["rule_id"] for finding in findings].count(
+        _PR_TARGET_EXECUTION_RULE_ID
+    ) == 1
+
+
+@pytest.mark.parametrize(
+    "workflow",
+    [
+        """
+on: pull_request
+permissions:
+  id-token: write
+jobs:
+  review:
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - run: bash ./ci/review.sh
+""",
+        """
+on: pull_request_target
+permissions:
+  id-token: write
+jobs:
+  review:
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.sha }}
+      - run: bash ./ci/review.sh
+""",
+        """
+on: pull_request_target
+jobs:
+  checkout:
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+  publish:
+    permissions:
+      id-token: write
+    steps:
+      - run: echo metadata-only
+""",
+        """
+on: pull_request_target
+permissions:
+  contents: read
+jobs:
+  review:
+    env:
+      id-token: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - run: bash ./ci/review.sh
+""",
+    ],
+)
+def test_incomplete_pr_target_causal_chains_are_not_reported(
+    tmp_path, workflow: str
+) -> None:
+    """Trigger, trust source, privilege, and execution must share one chain."""
+    findings = _scan_workflow(tmp_path, workflow)
+
+    assert _PR_TARGET_EXECUTION_RULE_ID not in {
+        finding["rule_id"] for finding in findings
+    }
+
+
 def test_mutable_contributor_branch_writer_is_reported() -> None:
     workflow = """
 on: pull_request_target