Initializes and pins all audit reference submodules after a fresh clone. Use when the user has just cloned the repository and needs to set up the submodules, or when submodules are missing or uninitialized. Do NOT use to update a ref to a new SHA (use update-ref) or to add a new ref (use add-ref).
Adds a new pinned audit reference (git submodule) to this repository. Use when the user wants to add an external repository as an audit reference, provides a GitHub URL to add, or asks to pin a new tool or methodology. Do NOT use for updating an existing ref's SHA (use update-ref) or re-adding a previously removed ref without explicit user confirmation.
Removes a pinned audit reference from this repository. Use when the user explicitly asks to remove, delete, or retire an audit reference. Requires a stated reason before proceeding. Do NOT use for updating a ref's SHA (use update-ref) or temporarily disabling a ref.
Scans an audit reference for dangerous patterns: install hooks, encoded payloads, curl-pipe-bash, symlinks, git hooks, suspicious Makefiles, and other supply-chain threats. Use before adding or updating a ref, or on-demand to audit an existing ref. Does NOT modify any files.
Updates the pinned SHA for an existing audit reference. Use when the user wants to upgrade or downgrade a ref to a different commit, asks to pull in new changes from an upstream repo, or wants to pin a ref to a specific SHA. Do NOT use for adding a brand new ref (use add-ref) or removing a ref entirely (use remove-ref).