chore(deps): update github actions #484
Triggered via pull request
July 24, 2026 17:31
renovate-bot
renovate-bot
synchronize
#4186
Status
Failure
Total duration
59s
Artifacts
2
github_actions_scan.yml Required
on: pull_request_target
Annotations
20 errors and 12 warnings
|
zizmor/template-injection:
.github/workflows/custard-ci.yaml#L168
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/custard-ci.yaml#L142
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/custard-ci.yaml#L86
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/custard-ci-dev.yaml#L117
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/custard-ci-dev.yaml#L116
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/custard-ci-dev.yaml#L107
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/custard-ci-dev.yaml#L81
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/ai-platform-snippets.yaml#L61
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor/template-injection:
.github/workflows/ai-platform-snippets.yaml#L60
code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor-output
Found 17 findings for mandatory checks that must always succeed.
|
|
template-injection:
.github/workflows/test.yaml#L65
test.yaml:65: code injection via template expansion: may expand into attacker-controllable code
|
|
template-injection:
.github/workflows/test.yaml#L62
test.yaml:62: code injection via template expansion: may expand into attacker-controllable code
|
|
template-injection:
.github/workflows/custard-run.yaml#L159
custard-run.yaml:159: code injection via template expansion: may expand into attacker-controllable code
|
|
dangerous-triggers:
.github/workflows/custard-run.yaml#L17
custard-run.yaml:17: use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely
|
|
template-injection:
.github/workflows/custard-run-dev.yaml#L113
custard-run-dev.yaml:113: code injection via template expansion: may expand into attacker-controllable code
|
|
dangerous-triggers:
.github/workflows/custard-run-dev.yaml#L17
custard-run-dev.yaml:17: use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely
|
|
template-injection:
.github/workflows/custard-ci.yaml#L178
custard-ci.yaml:178: code injection via template expansion: may expand into attacker-controllable code
|
|
template-injection:
.github/workflows/custard-ci.yaml#L142
custard-ci.yaml:142: code injection via template expansion: may expand into attacker-controllable code
|
|
template-injection:
.github/workflows/custard-ci-dev.yaml#L117
custard-ci-dev.yaml:117: code injection via template expansion: may expand into attacker-controllable code
|
|
template-injection:
.github/workflows/custard-ci-dev.yaml#L81
custard-ci-dev.yaml:81: code injection via template expansion: may expand into attacker-controllable code
|
|
zizmor-config
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
zizmor-upload
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
excessive-permissions:
.github/workflows/custard-ci.yaml#L18
custard-ci.yaml:18: overly broad permissions: default permissions used due to no permissions: block
|
|
ref-version-mismatch:
.github/workflows/custard-ci-dev.yaml#L85
custard-ci-dev.yaml:85: action's hash pin has mismatched or missing version comment: points to commit 249970729cb0
|
|
ref-version-mismatch:
.github/workflows/custard-ci-dev.yaml#L82
custard-ci-dev.yaml:82: action's hash pin has mismatched or missing version comment: points to commit 3d3c42e5aac5
|
|
ref-version-mismatch:
.github/workflows/custard-ci-dev.yaml#L40
custard-ci-dev.yaml:40: action's hash pin has mismatched or missing version comment: points to commit 3d3c42e5aac5
|
|
ref-version-mismatch:
.github/workflows/custard-ci-dev.yaml#L37
custard-ci-dev.yaml:37: action's hash pin has mismatched or missing version comment: points to commit 3d3c42e5aac5
|
|
excessive-permissions:
.github/workflows/custard-ci-dev.yaml#L29
custard-ci-dev.yaml:29: overly broad permissions: default permissions used due to no permissions: block
|
|
excessive-permissions:
.github/workflows/custard-ci-dev.yaml#L15
custard-ci-dev.yaml:15: overly broad permissions: default permissions used due to no permissions: block
|
|
ref-version-mismatch:
.github/workflows/ci-scripts.yaml#L34
ci-scripts.yaml:34: action's hash pin has mismatched or missing version comment: points to commit 249970729cb0
|
|
ref-version-mismatch:
.github/workflows/ci-scripts.yaml#L33
ci-scripts.yaml:33: action's hash pin has mismatched or missing version comment: points to commit 3d3c42e5aac5
|
|
excessive-permissions:
.github/workflows/ci-scripts.yaml#L27
ci-scripts.yaml:27: overly broad permissions: default permissions used due to no permissions: block
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
zizmor
Expired
|
18.6 KB |
sha256:5f7f534588dd55e67a4ea1cd9e72d53d476c8bf5b9d918b042009ec98d8cfdbc
|
|
|
zizmor-config
Expired
|
295 Bytes |
sha256:36540ad3460bc10a1ec25a8b5f83b42cb261cad12c52f5c2c613b730a3d5db32
|
|