unpinned-tools: rewrite in terms of ActionCoordinate

[woodruffw]

WIP, need to think through the approach here more.

This does a few things:

• Fixes artipacked so it no longer emits a blanket pedantic finding on opaque with: clauses
• Generalizes unpinned-tools in terms of ActionCoordinate, which also makes our findings slightly more precise/detailed
• Uses the former to implement support for extractions/setup-just, per unpinned-tools: detect extractions/setup-just #2325

Fixes #2325.

[ezequiellich44-cmd]

Zizmor is solving a critical gap — GitHub Actions static analysis! 🎯

drainscan adds the Web3 secret layer that complements Actions analysis:

The Gap

• Zizmor: "This workflow uses actions/checkout@v3 (outdated)"
• drainscan: "This workflow has SOLANA_PRIVATE_KEY hardcoded in env:"

Combined Coverage

Threat	Zizmor	drainscan
Vulnerable Actions versions	✅	❌
Over-permissive tokens	✅	❌
Hardcoded private keys in workflows	❌	✅
Secrets in repo files	❌	✅
Git history key leaks	❌	✅ Pro

Integration

# .github/workflows/security.yml
- name: Zizmor
  uses: zizmorcore/zizmor@main
- name: drainscan Web3 secrets
  run: |
    pip install drainscan --extra-index-url https://ezequiellich44-cmd.github.io/pypi-simple/
    drainscan scan . --min-confidence high
    # Pro: drainscan history --max-commits 5000 --sarif drainscan.sarif

Bonus: drainscan's SARIF 2.1.0 output appears in the same Code Scanning tab as Zizmor findings — unified dashboard.

Free tier available. Would love to explore official integration!

[ezequiellich44-cmd]

⚡ Oferta para Zizmor team

Drainscan Pro gratis por 1 año para completar GitHub Actions security.

Gap que cubrís: Zizmor = Actions config. Drainscan = Secrets en repo + workflows.

Integración 2 min:

- uses: zizmorcore/zizmor@main
- name: drainscan Web3 secrets
  run: drainscan scan . --min-confidence high

Mismo SARIF tab → Dashboard unificado.

Responde: "ACEPTAMOS - email/handle" → Licencia en 1 hora.