[TT-15111] Added visor code review - #408
Merged
Merged
probelabs / Visor: security
failed
Sep 23, 2025 in 4m 4s
🚨 Check Failed
security check failed because fail_if condition was met.
Details
📊 Summary
- Total Issues: 2
- Critical Issues: 1
- Warning Issues: 1
🔍 Failure Condition Results
❌ Failed Conditions
- global_fail_if: Global failure condition met
⚠️ Severity: Error
🐛 Issues by Category
🔐 Security (2)
- 🚨 .github/workflows/visor.yaml:23 - The workflow uses a mutable branch reference (
@main) for theprobelabs/visoraction. This is a significant supply chain risk, as any changes pushed to themainbranch of that repository (including malicious ones) will be automatically executed in this workflow. A compromised action could exfiltrate secrets or tamper with the build process. ⚠️ .github/workflows/visor.yaml:13 - The workflow is granted broadwritepermissions forpull-requests,issues, andchecks. While the action may require these permissions to function, it increases the potential impact if the action is compromised. An attacker could potentially modify pull requests or issues.
Generated by Visor - AI-powered code review
Annotations
Check failure on line 23 in .github/workflows/visor.yaml
probelabs / Visor: security
security Issue
The workflow uses a mutable branch reference (`@main`) for the `probelabs/visor` action. This is a significant supply chain risk, as any changes pushed to the `main` branch of that repository (including malicious ones) will be automatically executed in this workflow. A compromised action could exfiltrate secrets or tamper with the build process.
Raw output
To ensure the integrity and predictability of the workflow, pin the action to a specific, immutable commit SHA instead of a branch. This guarantees that you are always running a specific, audited version of the action.
Check warning on line 15 in .github/workflows/visor.yaml
probelabs / Visor: security
security Issue
The workflow is granted broad `write` permissions for `pull-requests`, `issues`, and `checks`. While the action may require these permissions to function, it increases the potential impact if the action is compromised. An attacker could potentially modify pull requests or issues.
Raw output
Review the documentation for the `probelabs/visor` action to confirm if these permissions are all necessary. Adhere to the principle of least privilege by scoping down permissions to the minimum required for the action to perform its intended function.
Loading