/**
 * Mutable action-reference checks for release-path readiness.
 * @module cli/doctor-readiness-action-pins
 */
import type { ParsedWorkflow, ParsedWorkflowJob } from "./doctor-readiness-workflows.js";
/**
 * Report mutable action references in jobs that publish release artifacts or
 * provide the validation those publishing jobs rely on.
 * A release job has deployment authority, so an action tag such as `@v4` or
 * `@main` is supply-chain authority handed to whoever can move that ref. The
 * same is true for the validating ancestors in the publishing job's `needs:`
 * closure: their output is what makes the artifact trusted.
 * @param workflow - The workflow declaring the job
 * @param job - The job to assess
 * @param allWorkflows - Every parsed workflow in the repository
 * @returns B2 evidence lines for unpinned action refs
 */
export declare function unpinnedPublishingActionViolations(workflow: ParsedWorkflow, job: ParsedWorkflowJob, allWorkflows?: readonly ParsedWorkflow[]): readonly string[];
//# sourceMappingURL=doctor-readiness-action-pins.d.ts.map