Add GitHub Action: Qwiet AI by Harness Static Analysis - #21
Conversation
💡 TipWant to run additional checks on this PR?
|
|
Rams skipped this PR — Free reviews one repository at a time, and your active repository is Upgrade to Solo — $39/mo to add this repo, or free the slot by removing Rams from that repo via GitHub app settings. |
|
Review changes with |
|
View changes in DiffLens |
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
🤖 CodeAnt AI — Review Status
|
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
🧙 Sourcery is reviewing your pull request! Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
PR Summary
Impact
Flow Diagram |
|
Warning Review limit reached
Next review available in: 59 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
🤖 Review skipped: Repository Owner rate limit exceeded. Free accounts are limited to 3 reviews per 4 hours across all repositories. Upgrade to a paid plan for unlimited reviews. |
codeant-ai
Bot
added
the
size:M
PR Summary
|
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Ansible |  |
Jul 26, 2026 7:23a.m. | Review ↗ |
| C# | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| C & C++ | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Ruby | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| JavaScript | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Rust | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Python | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Terraform | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Shell | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Scala | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Swift | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Secrets | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| SQL | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Code coverage |  |
Jul 26, 2026 7:54a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
|
Tick the box to add this pull request to the merge queue (same as
|
❌ 6 blocking issues (6 total)
|
![qltysh[bot]](https://avatars.githubusercontent.com/in/890766?s=60&v=4){kind=small}
| # SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
| # | ||
|
|
||
|
|
| NextGen-Static-Analysis: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 |
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v11 | ||
| uses: actions/setup-java@v3 |
| curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
|
|
||
| - name: Static Analysis | ||
| run: | |
There was a problem hiding this comment.
"github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs\.github\.com/en/actions/reference/security/secure\-use\#good\-practices\-for\-mitigating\-script\-injection\-attacks for more details [actionlint:expression]
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Center \ | ||
| --tag branch=${{ github.head_ref }} \ |
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| ErrorProne | 1 medium |
| Security | 2 critical |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
|
View changes in DiffLens |
✅ Deploy Preview for lcenter ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v11 | ||
| uses: actions/setup-java@v3 | ||
| with: | ||
| distribution: zulu | ||
| java-version: 11 | ||
|
|
||
| - name: Download Harness SAST and SCA CLI | ||
| run: | | ||
| curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
|
|
||
| - name: Static Analysis | ||
| run: | | ||
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Center \ | ||
| --tag branch=${{ github.head_ref }} \ | ||
| --jssrc . | ||
| env: | ||
| SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} | ||
| SHIFTLEFT_API_HOST: www.shiftleft.io | ||
| SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
|
|
||
| # Build-Rules: | ||
| # runs-on: ubuntu-latest | ||
| # permissions: write-all | ||
| # needs: NextGen-Static-Analysis | ||
| # steps: | ||
| # - uses: actions/checkout@v3 | ||
| # - name: Download Harness SAST and SCA CLI | ||
| # run: | | ||
| # curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
| # - name: Validate Build Rules | ||
| # run: | | ||
| # ${GITHUB_WORKSPACE}/sl check-analysis --app Center \ | ||
| # --github-pr-number=${{github.event.number}} \ | ||
| # --github-pr-user=${{ github.repository_owner }} \ | ||
| # --github-pr-repo=${{ github.event.repository.name }} \ | ||
| # --github-token=${{ secrets.GITHUB_TOKEN }} | ||
| # env: | ||
| # # SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} | ||
| # | ||
| # SHIFTLEFT_API_HOST: www.shiftleft.io | ||
| # SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| # SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
| # |
|
View changes in DiffLens |
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Center \ | ||
| --tag branch=${{ github.head_ref }} \ |
There was a problem hiding this comment.
Bug: The github.head_ref variable is empty on workflow_dispatch triggers, resulting in an empty branch tag (--tag branch=) for the ShiftLeft analysis.
Severity: MEDIUM
Suggested Fix
Provide a fallback value for the branch tag when github.head_ref is empty. For example, you can use github.ref_name, which is available on workflow_dispatch events. The expression could be branch=${{ github.head_ref || github.ref_name }}.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: .github/workflows/shiftleft.yml#L30
Potential issue: When the GitHub Actions workflow is triggered manually via
`workflow_dispatch`, the `github.head_ref` context variable is an empty string. This
causes the command on line 30 to pass an empty value to the `--tag branch=` argument.
This will either cause the workflow to fail due to the `--strict` flag, or it will
upload the analysis with an empty branch tag, making it difficult to identify and track
in the ShiftLeft dashboard.
Did we get this right? 👍 / 👎 to inform future reviews.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
center | 4b42fd2 | Jul 26 2026, 07:26 AM |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
5 issues found across 2 files
Confidence score: 2/5
- In
.github/workflows/shiftleft.yml, interpolating${{ github.head_ref }}directly inside arunscript creates a command-injection path via crafted branch names, which could execute unintended commands in CI — pass the ref through a safely quoted env var or avoid shell interpolation entirely. - In
.github/workflows/shiftleft.yml, the missing top-levelpermissionsblock meansGITHUB_TOKENmay get broader write scopes than needed, increasing blast radius if any step is compromised — declare least-privilege permissions explicitly at workflow/job scope. - In
.github/workflows/shiftleft.yml,github.head_refis empty onworkflow_dispatch, so--tag branch=may be blank and produce incorrect tagging/metadata behavior in manual runs — add an event-aware fallback (for examplegithub.ref_name) before building the tag argument. - In
.github/workflows/shiftleft.yml, usingactions/checkout@v3andactions/setup-java@v3keeps this workflow on deprecated Node 16 and out of sync with other workflows, which risks warnings and future runner breakage — upgrade both actions to@v4.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/shiftleft.yml">
<violation number="1" location=".github/workflows/shiftleft.yml:6">
P2: This workflow does not declare a `permissions` block, so the `GITHUB_TOKEN` receives the repository's default permissions (often broad write access). Add a top-level `permissions` block to follow the principle of least privilege. A minimal starting point for this workflow would be:
```yaml
permissions:
contents: read
```</violation>
<violation number="2" location=".github/workflows/shiftleft.yml:14">
P2: actions/checkout@v3 is inconsistent with the rest of the repo — all other workflows use @v4. The v3 tag runs on Node 16 (deprecated by GitHub Actions) and will produce deprecation warnings. Upgrade to actions/checkout@v4 for consistency and to avoid runtime warnings.</violation>
<violation number="3" location=".github/workflows/shiftleft.yml:16">
P2: actions/setup-java@v3 runs on Node 16 which is deprecated by GitHub Actions. Upgrade to @v4 to use Node 20 and avoid deprecation warnings. The distribution and java-version parameters remain the same.</violation>
<violation number="4" location=".github/workflows/shiftleft.yml:30">
P1: Using `${{ github.head_ref }}` directly in a `run` block is a script injection risk. An attacker can craft a branch name containing shell metacharacters (e.g., `'; malicious-command #`) that will be interpolated into the script before execution. Pass it through an environment variable instead:
```yaml
env:
BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
run: |
... --tag branch=${BRANCH_NAME} ...
```</violation>
<violation number="5" location=".github/workflows/shiftleft.yml:30">
P2: `github.head_ref` is only populated for `pull_request` and `pull_request_target` events. Since this workflow also triggers on `workflow_dispatch`, the `--tag branch=` argument will receive an empty string, which may cause the `--strict` flag to fail or produce an untagged analysis. Use a fallback like `${{ github.head_ref || github.ref_name }}` to handle non-PR triggers.</violation>
</file>
Shadow auto-approve: would not auto-approve because issues were found.
Re-trigger cubic
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Center \ | ||
| --tag branch=${{ github.head_ref }} \ |
There was a problem hiding this comment.
P1: Using ${{ github.head_ref }} directly in a run block is a script injection risk. An attacker can craft a branch name containing shell metacharacters (e.g., '; malicious-command #) that will be interpolated into the script before execution. Pass it through an environment variable instead:
env:
BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
run: |
... --tag branch=${BRANCH_NAME} ...Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 30:
<comment>Using `${{ github.head_ref }}` directly in a `run` block is a script injection risk. An attacker can craft a branch name containing shell metacharacters (e.g., `'; malicious-command #`) that will be interpolated into the script before execution. Pass it through an environment variable instead:
```yaml
env:
BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
run: |
... --tag branch=${BRANCH_NAME} ...
```</comment>
<file context>
@@ -0,0 +1,62 @@
+ ${GITHUB_WORKSPACE}/sl --version
+ ${GITHUB_WORKSPACE}/sl analyze --strict --wait \
+ --app Center \
+ --tag branch=${{ github.head_ref }} \
+ --jssrc .
+ env:
</file context>
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v11 | ||
| uses: actions/setup-java@v3 |
There was a problem hiding this comment.
P2: actions/setup-java@v3 runs on Node 16 which is deprecated by GitHub Actions. Upgrade to @v4 to use Node 20 and avoid deprecation warnings. The distribution and java-version parameters remain the same.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 16:
<comment>actions/setup-java@v3 runs on Node 16 which is deprecated by GitHub Actions. Upgrade to @v4 to use Node 20 and avoid deprecation warnings. The distribution and java-version parameters remain the same.</comment>
<file context>
@@ -0,0 +1,62 @@
+ steps:
+ - uses: actions/checkout@v3
+ - name: Setup Java JDK v11
+ uses: actions/setup-java@v3
+ with:
+ distribution: zulu
</file context>
| NextGen-Static-Analysis: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 |
There was a problem hiding this comment.
P2: actions/checkout@v3 is inconsistent with the rest of the repo — all other workflows use @v4. The v3 tag runs on Node 16 (deprecated by GitHub Actions) and will produce deprecation warnings. Upgrade to actions/checkout@v4 for consistency and to avoid runtime warnings.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 14:
<comment>actions/checkout@v3 is inconsistent with the rest of the repo — all other workflows use @v4. The v3 tag runs on Node 16 (deprecated by GitHub Actions) and will produce deprecation warnings. Upgrade to actions/checkout@v4 for consistency and to avoid runtime warnings.</comment>
<file context>
@@ -0,0 +1,62 @@
+ NextGen-Static-Analysis:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v3
+ - name: Setup Java JDK v11
+ uses: actions/setup-java@v3
</file context>
| - uses: actions/checkout@v3 | |
| - uses: actions/checkout@v4 |
| @@ -0,0 +1,62 @@ | |||
| --- | |||
There was a problem hiding this comment.
P2: This workflow does not declare a permissions block, so the GITHUB_TOKEN receives the repository's default permissions (often broad write access). Add a top-level permissions block to follow the principle of least privilege. A minimal starting point for this workflow would be:
permissions:
contents: readPrompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 6:
<comment>This workflow does not declare a `permissions` block, so the `GITHUB_TOKEN` receives the repository's default permissions (often broad write access). Add a top-level `permissions` block to follow the principle of least privilege. A minimal starting point for this workflow would be:
```yaml
permissions:
contents: read
```</comment>
<file context>
@@ -0,0 +1,62 @@
+# Visit https://docs.shiftleft.io for help
+name: Harness SAST and SCA
+
+on:
+ pull_request:
+ workflow_dispatch:
</file context>
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Center \ | ||
| --tag branch=${{ github.head_ref }} \ |
There was a problem hiding this comment.
P2: github.head_ref is only populated for pull_request and pull_request_target events. Since this workflow also triggers on workflow_dispatch, the --tag branch= argument will receive an empty string, which may cause the --strict flag to fail or produce an untagged analysis. Use a fallback like ${{ github.head_ref || github.ref_name }} to handle non-PR triggers.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 30:
<comment>`github.head_ref` is only populated for `pull_request` and `pull_request_target` events. Since this workflow also triggers on `workflow_dispatch`, the `--tag branch=` argument will receive an empty string, which may cause the `--strict` flag to fail or produce an untagged analysis. Use a fallback like `${{ github.head_ref || github.ref_name }}` to handle non-PR triggers.</comment>
<file context>
@@ -0,0 +1,62 @@
+ ${GITHUB_WORKSPACE}/sl --version
+ ${GITHUB_WORKSPACE}/sl analyze --strict --wait \
+ --app Center \
+ --tag branch=${{ github.head_ref }} \
+ --jssrc .
+ env:
</file context>
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
LlamaPReview — No blocking issues found
One non-blocking finding was retained: No integrity verification for downloaded SAST CLI binary.
Review details and evidence
| Priority | File | Finding | Evidence |
|---|---|---|---|
| P2 | .github/workflows/shiftleft.yml |
No integrity verification for downloaded SAST CLI binary | confirmed |
Finding details
P2 · No integrity verification for downloaded SAST CLI binary
.github/workflows/shiftleft.yml
The sl binary is downloaded from a remote CDN over HTTPS and immediately executed without any integrity check (no pinned version, checksum, or signature verification). Later steps run the binary with SHIFTLEFT_ACCESS_TOKEN in the environment. A compromise of the CDN or a man-in-the-middle attack could substitute a malicious binary that exfiltrates secrets or tampers with the build. This is a supply-chain hardening gap; the attack requires CDN compromise, which is credible but not trivial.
Verification boundary: confirmed; scope: changed region.
Conceptual guidance (not a committable GitHub suggestion):
- name: Download Harness SAST and SCA CLI
run: |
curl -sL https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl
echo "EXPECTED_SHA256 ${GITHUB_WORKSPACE}/sl" | sha256sum -c -
chmod a+rx ${GITHUB_WORKSPACE}/sl
LlamaPReview checks
- Read the complete PR-head file
.github/workflows/shiftleft.yml.
Automated review by LlamaPReview · Free for public open-source projects.
2 participants
User description
This pull request adds a GitHub Action workflow file that executes Harness Static Application Security Testing (SAST) on this PR. Once merged, it will also execute SAST on all future PRs opened in this repository.
Visit app.shiftleft.io to see the security findings for this repository.
We've done a few things on your behalf
SHIFTLEFT_ACCESS_TOKENto allow GitHub Actions in this repository to communicate with the Harness SAST and SCA APIQuestions? Comments? Want to learn more? Get in touch with us or check out our documentation.
Summary by Sourcery
Add a GitHub Actions workflow to run Harness SAST/SCA on pull requests and optionally enforce build rules based on analysis results.
New Features:
Enhancements:
CodeAnt-AI Description
Add automated Harness security analysis to pull requests
What Changed
Impact
✅ Earlier detection of critical security findings✅ Fewer vulnerable dependencies reaching review✅ Security checks available on every pull request💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by cubic
Adds a GitHub Action to run Harness SAST and SCA on every PR with a status check. Includes build rules to block critical issues and limit OSS/container findings.
New Features
.github/workflows/shiftleft.ymlto run onpull_requestandworkflow_dispatch.actions/checkout@v3,actions/setup-java@v3, downloadssl, and runssl analyze --strict --wait --app Center --jssrc ..shiftleft.ymlrules: no critical findings, max 1oss_vulnorcontainerfinding, and no reachableoss_vuln.Migration
SHIFTLEFT_ACCESS_TOKENrepo secret exists.Centeris correct; update if needed.Build-Rulesjob to enforce checks in CI.Written for commit 4b42fd2. Summary will update on new commits.