chore(deps): update github actions #532
Triggered via pull request
July 31, 2026 18:42
renovate-bot
renovate-bot
synchronize
#4186
Status
Failure
Total duration
3m 44s
Artifacts
2
github_actions_scan.yml Required
on: pull_request_target
Annotations
20 errors and 12 warnings
|
zizmor/template-injection:
.github/workflows/custard-ci.yaml#L168
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/custard-ci.yaml#L142
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/custard-ci.yaml#L86
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/custard-ci-dev.yaml#L117
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/custard-ci-dev.yaml#L116
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/custard-ci-dev.yaml#L107
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/custard-ci-dev.yaml#L81
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/ai-platform-snippets.yaml#L61
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/ai-platform-snippets.yaml#L60
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor-output
Found 17 findings for mandatory checks that must always succeed.
|
|
template-injection:
.github/workflows/test.yaml#L65
test.yaml:65: code injection via template expansion: may expand into attacker-controllable code
|
|
template-injection:
.github/workflows/test.yaml#L62
test.yaml:62: code injection via template expansion: may expand into attacker-controllable code
|
|
template-injection:
.github/workflows/custard-run.yaml#L159
custard-run.yaml:159: code injection via template expansion: may expand into attacker-controllable code
|
|
dangerous-triggers:
.github/workflows/custard-run.yaml#L17
custard-run.yaml:17: use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely
|
|
template-injection:
.github/workflows/custard-run-dev.yaml#L113
custard-run-dev.yaml:113: code injection via template expansion: may expand into attacker-controllable code
|
|
dangerous-triggers:
.github/workflows/custard-run-dev.yaml#L17
custard-run-dev.yaml:17: use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely
|
|
template-injection:
.github/workflows/custard-ci.yaml#L178
custard-ci.yaml:178: code injection via template expansion: may expand into attacker-controllable code
|
|
template-injection:
.github/workflows/custard-ci.yaml#L142
custard-ci.yaml:142: code injection via template expansion: may expand into attacker-controllable code
|
|
template-injection:
.github/workflows/custard-ci-dev.yaml#L117
custard-ci-dev.yaml:117: code injection via template expansion: may expand into attacker-controllable code
|
|
template-injection:
.github/workflows/custard-ci-dev.yaml#L81
custard-ci-dev.yaml:81: code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor-config
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
zizmor-upload
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
excessive-permissions:
.github/workflows/custard-ci.yaml#L67
custard-ci.yaml:67: overly broad permissions: default permissions used due to no permissions: block
|
|
excessive-permissions:
.github/workflows/custard-ci.yaml#L33
custard-ci.yaml:33: overly broad permissions: default permissions used due to no permissions: block
|
|
excessive-permissions:
.github/workflows/custard-ci.yaml#L18
custard-ci.yaml:18: overly broad permissions: default permissions used due to no permissions: block
|
|
ref-version-mismatch:
.github/workflows/custard-ci-dev.yaml#L82
custard-ci-dev.yaml:82: action's hash pin has mismatched or missing version comment: points to commit 3d3c42e5aac5
|
|
ref-version-mismatch:
.github/workflows/custard-ci-dev.yaml#L40
custard-ci-dev.yaml:40: action's hash pin has mismatched or missing version comment: points to commit 3d3c42e5aac5
|
|
ref-version-mismatch:
.github/workflows/custard-ci-dev.yaml#L37
custard-ci-dev.yaml:37: action's hash pin has mismatched or missing version comment: points to commit 3d3c42e5aac5
|
|
excessive-permissions:
.github/workflows/custard-ci-dev.yaml#L29
custard-ci-dev.yaml:29: overly broad permissions: default permissions used due to no permissions: block
|
|
excessive-permissions:
.github/workflows/custard-ci-dev.yaml#L15
custard-ci-dev.yaml:15: overly broad permissions: default permissions used due to no permissions: block
|
|
ref-version-mismatch:
.github/workflows/ci-scripts.yaml#L33
ci-scripts.yaml:33: action's hash pin has mismatched or missing version comment: points to commit 3d3c42e5aac5
|
|
excessive-permissions:
.github/workflows/ci-scripts.yaml#L27
ci-scripts.yaml:27: overly broad permissions: default permissions used due to no permissions: block
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
zizmor
Expired
|
17.5 KB |
sha256:a168174bd5dfd0b68b0e5e22ecb38ceb757bbca9b0b2f7cd21b5a4f4cd829272
|
|
|
zizmor-config
Expired
|
295 Bytes |
sha256:324a9158b7394aecee159373aca3ef04a657987ff6022111e5ed2e063c398091
|
|