Is it transitive? > The check works by looking for unpinned dependencies in Dockerfiles, shell scripts, and GitHub workflows which are used during the build an

Is it transitive? > The check works by looking for unpinned dependencies in Dockerfiles, shell scripts, and GitHub workflows which are used during the build and release process of a project. Does it detect an unpinned (eg a Docker tag) of a pinned dependency.