diff --git a/.github/workflows/moda-ci.yaml b/.github/workflows/moda-ci.yaml
deleted file mode 100644
index 43240c6dcdb3..000000000000
--- a/.github/workflows/moda-ci.yaml
+++ /dev/null
@@ -1,103 +0,0 @@
-name: docs-internal Moda CI
-
-# More info on CI actions setup can be found here:
-# https://github.com/github/ops/blob/master/docs/playbooks/build-systems/moving-moda-apps-from-bp-to-actions.md
-
-on:
-  workflow_dispatch:
-  push:
-    branches-ignore:
-      - 'gh-readonly-queue/**'
-  merge_group:
-    types: [checks_requested]
-
-jobs:
-  ##########################
-  # Generate Vault keys
-  ##########################
-  set-vault-keys:
-    runs-on: ubuntu-latest
-    outputs:
-      modified_vault_keys: ${{ steps.modify_vault_keys.outputs.modified }}
-    steps:
-      - name: Set vault-keys output
-        id: modify_vault_keys
-        run: |
-          if [ -z "${{ vars.VAULT_KEYS }}" ]; then
-            # We want to add the DOCS_BOT_PAT_BASE to the list of keys
-            # so that builds fetch the secret from the docs-internal vault
-            # where --environment is "ci"
-            echo "modified=DOCS_BOT_PAT_BASE" >> $GITHUB_OUTPUT
-          else
-            echo "modified=${{ vars.VAULT_KEYS }},DOCS_BOT_PAT_BASE" >> $GITHUB_OUTPUT
-          fi
-
-  #############
-  # Moda jobs
-  #############
-  moda-config-bundle:
-    if: ${{ github.repository == 'github/docs-internal' }}
-    name: ${{ matrix.ci_job.job }}
-    needs: set-vault-keys
-    strategy:
-      fail-fast: false
-      matrix:
-        ci_job: [{ 'job': 'docs-internal-moda-config-bundle' }]
-    uses: github/internal-actions/.github/workflows/moda.yml@main
-    with:
-      ci-formatted-job-name: ${{ matrix.ci_job.job }}
-      vault-keys: ${{ needs.set-vault-keys.outputs.modified_vault_keys }}
-    secrets:
-      dx-bot-token: ${{ secrets.INTERNAL_ACTIONS_DX_BOT_ACCOUNT_TOKEN }}
-      datadog-api-key: ${{ secrets.DATADOG_API_KEY }}
-
-  #############
-  # Docker Image jobs
-  #############
-  docker-image:
-    if: ${{ github.repository == 'github/docs-internal' }}
-    name: ${{ matrix.ci_job.job }}
-    needs: set-vault-keys
-    strategy:
-      fail-fast: false
-      matrix:
-        ci_job: [{ 'job': 'docs-internal-docker-image' }]
-    uses: github/internal-actions/.github/workflows/kube.yml@main
-    with:
-      ci-formatted-job-name: ${{ matrix.ci_job.job }}
-      vault-keys: ${{ needs.set-vault-keys.outputs.modified_vault_keys }}
-      # Passes 'DOCS_BOT_PAT_BASE' secret from Vault to docker as --secret id=DOCS_BOT_PAT_BASE,src=<PAT value>
-      attest: true
-      docker-build-env-secrets: 'DOCS_BOT_PAT_BASE'
-    secrets:
-      dx-bot-token: ${{ secrets.INTERNAL_ACTIONS_DX_BOT_ACCOUNT_TOKEN }}
-      datadog-api-key: ${{ secrets.DATADOG_API_KEY }}
-
-  #############
-  # Docker Security jobs
-  #############
-  docker-security:
-    if: ${{ github.repository == 'github/docs-internal' }}
-    name: ${{ matrix.ci_job.job }}
-    needs: set-vault-keys
-    strategy:
-      fail-fast: false
-      matrix:
-        ci_job: [{ 'job': 'docs-internal-docker-security' }]
-    uses: github/internal-actions/.github/workflows/docker_security.yml@main
-    with:
-      ci-formatted-job-name: ${{ matrix.ci_job.job }}
-      vault-keys: ${{ needs.set-vault-keys.outputs.modified_vault_keys }}
-      # Passes 'DOCS_BOT_PAT_BASE' secret from Vault to docker as --secret id=DOCS_BOT_PAT_BASE,src=<PAT value>
-      docker-build-env-secrets: 'DOCS_BOT_PAT_BASE'
-    secrets:
-      dx-bot-token: ${{ secrets.INTERNAL_ACTIONS_DX_BOT_ACCOUNT_TOKEN }}
-      datadog-api-key: ${{ secrets.DATADOG_API_KEY }}
-
-permissions:
-  actions: read
-  checks: read
-  contents: read
-  statuses: read
-  id-token: write
-  attestations: write
diff --git a/report_full.txt b/report_full.txt
new file mode 100644
index 000000000000..4de7bf4e5a89
--- /dev/null
+++ b/report_full.txt
@@ -0,0 +1,29 @@
+Title: Potential CI Supply-Chain Hardening Weakness in GitHub Actions Node.js Documentation Examples
+
+Summary:
+The GitHub Actions Node.js documentation includes workflow examples that use mutable action version tags such as `actions/checkout@v6` and `actions/setup-node@v7`, and also demonstrates use of third-party actions in certain scenarios. While this is not a direct vulnerability in GitHub Actions itself, these examples may lead maintainers to adopt CI configurations that are not pinned to immutable commits and are therefore more exposed to supply-chain compromise.
+
+Details:
+The documented Node.js CI examples recommend workflow patterns that prioritize ease of setup and broad compatibility. However, from a supply-chain security perspective, some examples may encourage less hardened defaults if copied directly into production repositories.
+
+Observed concerns include:
+1. Use of mutable action tags
+2. Use of third-party actions
+3. Execution of dependency lifecycle scripts
+4. Registry token exposure considerations
+
+Proof of Concept:
+1. Create a repository with a Node.js CI workflow based directly on the documented examples.
+2. Reference actions using mutable tags such as `actions/checkout@v6` and `actions/setup-node@v7`.
+3. Add a malicious dependency lifecycle script or introduce a compromised third-party action.
+4. Trigger the workflow.
+5. Observe that CI executes the referenced action code and dependency lifecycle scripts automatically.
+
+Expected result:
+Security-sensitive examples should strongly encourage immutable pinning, least-privilege permissions, third-party action caution, and secret scoping.
+
+Actual result:
+The examples are easy to adopt as-is, but may be interpreted as secure production defaults even when additional hardening would be appropriate.
+
+Impact:
+This appears to be a documentation-driven security hardening concern rather than a direct exploitable GitHub platform vulnerability.
diff --git a/report_short.txt b/report_short.txt
new file mode 100644
index 000000000000..818821061d1a
--- /dev/null
+++ b/report_short.txt
@@ -0,0 +1,17 @@
+Title: Potential CI supply-chain hardening issue in GitHub Actions Node.js documentation examples
+
+Summary:
+The GitHub Actions Node.js documentation includes examples that use mutable action version tags and, in some cases, third-party actions. While this is not a direct platform vulnerability, users may copy these examples into production workflows without hardening, which can increase CI supply-chain risk.
+
+Details:
+The examples reference actions such as `actions/checkout@v6` and `actions/setup-node@v7`. They also demonstrate package installation steps and, for pnpm, a third-party action.
+
+PoC:
+1. Copy the documented Node.js workflow into a repository.
+2. Use mutable action tags as shown in the examples.
+3. Introduce a malicious dependency lifecycle script or compromised third-party action.
+4. Trigger the workflow.
+5. Observe that CI executes the dependency or action code automatically.
+
+Impact:
+This is best described as a documentation-related CI hardening weakness, not a direct GitHub Actions platform exploit.
diff --git a/reports.zip b/reports.zip
new file mode 100644
index 000000000000..91a188de6034
Binary files /dev/null and b/reports.zip differ