dotnet-cli-release-pipeline

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The GitHub Actions workflow pulls and runs external action repositories at runtime (e.g., https://github.com/vedantmgoyal9/winget-releaser referenced as vedantmgoyal9/winget-releaser@main and https://github.com/softprops/action-gh-release referenced as softprops/action-gh-release@v2), which are remote code fetched and executed as required dependencies for the release/publish jobs.