.github/workflows/deploy-to-azure.yml (3)

47-51: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Template expansion into shell (template-injection).

zizmor flags ${{ vars.ENV_CONFIG }} expanded directly into the run: script; if this value ever contains shell metacharacters it could break out of the quoting. Prefer passing it via env: and referencing the environment variable inside the script.

🛡️ Suggested fix

             - name: Ingest Environment Variables
+              env:
+                ENV_CONFIG: ${{ vars.ENV_CONFIG }}
               run: |
                 touch .env
-                echo '${{ vars.ENV_CONFIG }}' | jq -r 'to_entries | map("\(.key)=\(.value)") | .[]' > .env
+                echo "$ENV_CONFIG" | jq -r 'to_entries | map("\(.key)=\(.value)") | .[]' > .env
                 echo CI=false >> .env

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-to-azure.yml around lines 47 - 51, The Ingest
Environment Variables step is expanding vars.ENV_CONFIG directly inside the run
script, which risks template-injection if the value contains shell
metacharacters. Update the workflow to pass ENV_CONFIG through env: on the step
and reference that variable inside the script instead of embedding ${{
vars.ENV_CONFIG }} in the shell command; keep the existing jq-based .env
generation logic in place.

Source: Linters/SAST tools

---

38-44: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Bump actions/checkout and actions/setup-node versions.

actionlint reports the runners for actions/checkout@v3 and actions/setup-node@v3 are too old for GitHub Actions. Per the retrieved learning, mutable tag usage itself isn't a concern in this repo, but this flags an actual deprecation, not a SHA-pinning preference.

♻️ Suggested fix

-              uses: actions/checkout@v3
+              uses: actions/checkout@v4

-              uses: actions/setup-node@v3
+              uses: actions/setup-node@v4

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-to-azure.yml around lines 38 - 44, Bump the GitHub
Actions used in the deploy workflow: update the `actions/checkout` and
`actions/setup-node` steps in the workflow to newer supported major versions,
keeping the existing `ref` and `node-version` settings intact. Locate the
changes in the deploy workflow’s `checkout` and `Setup Node.js` steps and
replace the old action versions with current ones that satisfy actionlint’s
runner requirements.

Source: Linters/SAST tools

---

1-66: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Add explicit least-privilege permissions: block.

zizmor flags excessive-permissions at the workflow and both job levels since no permissions: block is defined, defaulting to broad token scope. Given this workflow only checks out code and deploys, contents: read (plus nothing else needed by Azure/static-web-apps-deploy) should suffice.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-to-azure.yml around lines 1 - 66, Add an explicit
least-privilege permissions block to the workflow and jobs because the default
GITHUB_TOKEN scope is too broad. Update the workflow definition in
deploy-to-azure.yml so the top-level and both jobs set only the minimal token
access needed, and ensure the checkout/deploy flow in set-github-environment and
build-and-deploy uses contents: read unless Azure/static-web-apps-deploy
requires any additional specific permission.

Source: Linters/SAST tools

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes