feat: sync linked issue labels to pull requests - #1876
Closed
cheese-cakee wants to merge 2 commits into
Closed
cheese-cakee wants to merge 2 commits into
cheese-cakee wants to merge 2 commits into
StepSecurity Actions Security / StepSecurity Required Checks
failed
Feb 26, 2026 in 7s
StepSecurity Required Checks
Finished StepSecurity Required Checks
- NPM Compromised Packages Check - Checks for compromised npm package versions in the PR
- NPM Package Cooldown Check - Fails if any package version in the PR was released within the configured cooldown period, helping to avoid brand-new (and potentially unreviewed or malicious) releases
- Pwn Request Vulnerabilities Check - Checks for Pwn Request vulnerabilities in the PR via risky triggers
- Script Injection Check - Checks for script injection vulnerabilities in the PR
Details
✅ NPM Compromised Packages Check
No Compromised npm packages are added in current PR.
✅ NPM Package Cooldown Check
No npm package upgrades to recent releases found in current PR.
❌ Script Injection Vulnerabilities Check
What are Script Injection vulnerabilities?
Script Injection occurs when GitHub Actions workflows execute untrusted input without proper sanitization, allowing attackers to:
- Execute arbitrary commands on workflow runners
- Access and exfiltrate repository secrets and tokens
- Modify repository content and inject backdoors
- Perform supply chain attacks on users
The following vulnerabilities were found:
| Workflow | Job | Step | Risky Triggers |
|---|---|---|---|
| sync-issue-labels-compute.yml | compute-labels | Upload labels as artifact_3#L59 | pull_request_target |
⚡ Immediate Action Required
These vulnerabilities expose your CI/CD pipeline to:
- Secret theft: Access to AWS keys, Docker Hub tokens, deployment credentials
- Code tampering: Malicious commits, backdoor injections
- Supply chain attacks: Compromised artifacts and packages
- Runner compromise: Full control over workflow execution environment
📚 Learn More
✅ Pwn Request Vulnerabilities Check
No Pwn Request vulnerabilities found in this PR.
⏲️ History
Previous invocation results of same check:
Loading