Artifact Release for “Runtime Trust Cascades in GitHub Actions”

This artifact release accompanies our paper on runtime trust cascades in GitHub Actions. It provides the core analysis code, processed data, and plotting scripts needed to inspect the study pipeline and reproduce the main figures and tables.

Contents:

• code for workflow/dependency reconstruction and signal extraction
• processed datasets used in the empirical analysis
• scripts for generating figures, tables, and summary statistics
• manuscript-aligned derived artifacts

The artifact supports reproduction of results for:

• hidden transitive execution
• mutable reference exposure
• mixed-trust runtime and sensitive capability coupling
• cross-context propagation
• downstream amplification through concentrated reuse

This snapshot corresponds to the current submission version of the paper.