Add GitHub Action: Qwiet AI by Harness Static Analysis - #7
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
💡 TipWant to run additional checks on this PR?
|
|
Rams skipped this PR — Free reviews one repository at a time, and your active repository is Upgrade to Solo — $39/mo to add this repo, or free the slot by removing Rams from that repo via GitHub app settings. |
|
Review changes with |
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
View changes in DiffLens |
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
PR Summary
Impact
Flow Diagram |
|
🧙 Sourcery is reviewing your pull request! Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
🤖 Review skipped: Repository Owner rate limit exceeded. Free accounts are limited to 3 reviews per 4 hours across all repositories. Upgrade to a paid plan for unlimited reviews. |
|
Warning Review limit reached
Next review available in: 59 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Hard-Coded Secrets (3)
More info on how to fix Hard-Coded Secrets in General. Vulnerable Libraries (5)
More info on how to fix Vulnerable Libraries in JavaScript. 👉 Go to the dashboard for detailed results. 📥 Happy? Share your feedback with us. |
PR Summary
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v11 | ||
| uses: actions/setup-java@v3 | ||
| with: | ||
| distribution: zulu | ||
| java-version: 11 | ||
|
|
||
| - name: Download Harness SAST and SCA CLI | ||
| run: | | ||
| curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
|
|
||
| - name: Static Analysis | ||
| run: | | ||
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app RACS \ | ||
| --tag branch=${{ github.head_ref }} \ | ||
| --jssrc . | ||
| env: | ||
| SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} | ||
| SHIFTLEFT_API_HOST: www.shiftleft.io | ||
| SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
|
|
||
| # Build-Rules: | ||
| # runs-on: ubuntu-latest | ||
| # permissions: write-all | ||
| # needs: NextGen-Static-Analysis | ||
| # steps: | ||
| # - uses: actions/checkout@v3 | ||
| # - name: Download Harness SAST and SCA CLI | ||
| # run: | | ||
| # curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
| # - name: Validate Build Rules | ||
| # run: | | ||
| # ${GITHUB_WORKSPACE}/sl check-analysis --app RACS \ | ||
| # --github-pr-number=${{github.event.number}} \ | ||
| # --github-pr-user=${{ github.repository_owner }} \ | ||
| # --github-pr-repo=${{ github.event.repository.name }} \ | ||
| # --github-token=${{ secrets.GITHUB_TOKEN }} | ||
| # env: | ||
| # # SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} | ||
| # | ||
| # SHIFTLEFT_API_HOST: www.shiftleft.io | ||
| # SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| # SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
| # |
|
The workflow file .github/workflows/shiftleft.yml |
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| ErrorProne | 1 medium |
| Security | 2 critical |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
❌ 6 blocking issues (6 total)
|
![qltysh[bot]](https://avatars.githubusercontent.com/in/890766?s=60&v=4){kind=small}
| # SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
| # | ||
|
|
||
|
|
| NextGen-Static-Analysis: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 |
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v11 | ||
| uses: actions/setup-java@v3 |
| curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
|
|
||
| - name: Static Analysis | ||
| run: | |
There was a problem hiding this comment.
"github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs\.github\.com/en/actions/reference/security/secure\-use\#good\-practices\-for\-mitigating\-script\-injection\-attacks for more details [actionlint:expression]
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app RACS \ | ||
| --tag branch=${{ github.head_ref }} \ |
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| JavaScript |  |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Secrets | |
Jul 26, 2026 7:23a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
Dependency ReviewThe following issues were found:
License Issues.github/workflows/shiftleft.yml
OpenSSF Scorecard
Scanned Files
|
|
View changes in DiffLens |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
racs | bf2f7a8 | Jul 26 2026, 07:26 AM |
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| # --github-pr-user=${{ github.repository_owner }} \ | ||
| # --github-pr-repo=${{ github.event.repository.name }} \ | ||
| # --github-token=${{ secrets.GITHUB_TOKEN }} | ||
| # env: | ||
| # # SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} | ||
| # | ||
| # SHIFTLEFT_API_HOST: www.shiftleft.io | ||
| # SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| # SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
| # | ||
|
|
There was a problem hiding this comment.
Bug: The Build-Rules job is commented out, so security policies defined via sl check-analysis are not being enforced on pull requests.
Severity: CRITICAL
Suggested Fix
Uncomment the Build-Rules job (lines 38-61) in .github/workflows/shiftleft.yml to re-enable the sl check-analysis step. This will ensure that the defined security policies are enforced on pull requests.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: .github/workflows/shiftleft.yml#L38-L61
Potential issue: The `Build-Rules` job in the `shiftleft.yml` workflow, responsible for
enforcing security gates with `sl check-analysis`, is entirely commented out. Although
build rules are defined to block critical findings, these rules are never evaluated. As
a result, pull requests containing critical security vulnerabilities will not be blocked
from merging, bypassing the intended security checks.
Did we get this right? 👍 / 👎 to inform future reviews.
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app RACS \ | ||
| --tag branch=${{ github.head_ref }} \ |
There was a problem hiding this comment.
Bug: The github.head_ref variable is empty for workflow_dispatch triggers, causing manual analysis runs to have an empty branch tag in the Qwiet dashboard.
Severity: MEDIUM
Suggested Fix
Use github.ref_name instead of github.head_ref. The github.ref_name variable correctly provides the branch or tag name for all event types, including workflow_dispatch and pull_request, ensuring consistent tagging.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: .github/workflows/shiftleft.yml#L30
Potential issue: When the workflow is triggered manually via `workflow_dispatch`, the
`github.head_ref` context variable is empty. This causes the `--tag branch=${{
github.head_ref }}` argument to pass an empty string to the `sl analyze` command. As a
result, SAST results from manual runs are stored without a proper branch identifier in
the Qwiet dashboard, making it difficult to track and correlate findings.
Did we get this right? 👍 / 👎 to inform future reviews.
| # --github-pr-repo=${{ github.event.repository.name }} \ | ||
| # --github-token=${{ secrets.GITHUB_TOKEN }} | ||
| # env: | ||
| # # SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} |
There was a problem hiding this comment.
Bug: The SHIFTLEFT_ACCESS_TOKEN secret is double-commented and will remain commented out even if the surrounding job is uncommented, causing authentication failure.
Severity: MEDIUM
Suggested Fix
Remove the extra # from the SHIFTLEFT_ACCESS_TOKEN line (line 55) so that it is commented at the same level as the rest of the Build-Rules job. This ensures it will be correctly activated when the job is uncommented.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: .github/workflows/shiftleft.yml#L55
Potential issue: In the commented-out `Build-Rules` job, the `SHIFTLEFT_ACCESS_TOKEN`
secret is double-commented. If a developer uncomments the job block by removing the
leading `#` from each line, the line for the access token will remain commented (`#
SHIFTLEFT_ACCESS_TOKEN: ...`). This will cause the `sl check-analysis` command to fail
with an authentication error, preventing security rules from being checked.
Did we get this right? 👍 / 👎 to inform future reviews.
|
View changes in DiffLens |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
7 issues found across 2 files
Confidence score: 2/5
- In
.github/workflows/shiftleft.yml, interpolating${{ github.head_ref }}directly inside an inlinerunscript creates a command-injection path via crafted branch names, which could execute unintended shell commands in CI — pass the ref through a quoted environment variable (or otherwise sanitize it) before use. - In
.github/workflows/shiftleft.yml,--tag branch=depends ongithub.head_ref, which is empty forworkflow_dispatch, so manual runs can emit blank branch tags and weaken scan traceability or downstream logic — add a fallback likegithub.ref_namefor non-PR triggers. - In
.github/workflows/shiftleft.yml, theBuild-Rulesjob being fully commented out means critical policy checks are not enforced, so vulnerable changes can pass without blocking — re-enableBuild-Rulesand fix the malformed double-comment onSHIFTLEFT_ACCESS_TOKENso required env wiring is restored when uncommented. - In
.github/workflows/shiftleft.yml, the workflow lacks an explicitpermissionsblock and still usesactions/checkout@v3/actions/setup-java@v3on deprecated Node 16, increasing privilege and maintenance risk — define least-privilegepermissionsand upgrade both actions to@v4.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/shiftleft.yml">
<violation number="1" location=".github/workflows/shiftleft.yml:6">
P1: The `--tag branch=` expression uses `github.head_ref`, which is only available for `pull_request` events. If this workflow is triggered manually via `workflow_dispatch`, `github.head_ref` evaluates to an empty string, resulting in a malformed `--tag branch=` argument that could cause the CLI to error or attach an incorrect tag. Consider guarding the tag with a conditional or using a fallback like `${{ github.head_ref || github.ref_name }}` to handle both trigger types.</violation>
<violation number="2" location=".github/workflows/shiftleft.yml:10">
P2: The workflow does not define an explicit `permissions` block, so the `GITHUB_TOKEN` will have the repository's default permissions (often `write-all`). Following the principle of least privilege, add a top-level `permissions` block with minimal scopes needed. For a static analysis workflow, `contents: read` should be sufficient for the main job.</violation>
<violation number="3" location=".github/workflows/shiftleft.yml:14">
P2: `actions/checkout@v3` runs on the deprecated Node 16 runtime. GitHub Actions will show deprecation warnings — upgrade to `@v4` to use Node 20.</violation>
<violation number="4" location=".github/workflows/shiftleft.yml:16">
P2: `actions/setup-java@v3` runs on the deprecated Node 16 runtime — upgrade to `@v4` to use Node 20 and avoid deprecation warnings.</violation>
<violation number="5" location=".github/workflows/shiftleft.yml:30">
P1: Using `${{ github.head_ref }}` directly in an inline `run` script is a script injection risk. An attacker can create a PR from a branch with a malicious name (e.g., containing shell metacharacters or backticks) to execute arbitrary commands. GitHub's security documentation explicitly warns against this pattern. Pass the value through an environment variable instead:
```yaml
env:
BRANCH: ${{ github.head_ref }}
run: |
... --tag branch=$BRANCH ...
```</violation>
<violation number="6" location=".github/workflows/shiftleft.yml:38">
P2: The `Build-Rules` job is entirely commented out, meaning the security policies defined in `shiftleft.yml` (blocking critical findings, OSS vulnerabilities) will never be evaluated. Pull requests with critical security findings won't be blocked from merging. If this is intentional for an initial rollout, consider adding a comment explaining when it should be enabled; otherwise, uncomment the job to enforce the defined policies.</violation>
<violation number="7" location=".github/workflows/shiftleft.yml:55">
P2: The `SHIFTLEFT_ACCESS_TOKEN` line has a double comment (`# ... # SHIFTLEFT_ACCESS_TOKEN`). If someone uncomments the `Build-Rules` job by removing the leading `#` from each line, this environment variable will remain commented out, causing `sl check-analysis` to fail with an authentication error. Remove the inner `#` so it's at the same comment level as the rest of the block.</violation>
</file>
Shadow auto-approve: would not auto-approve because issues were found.
Re-trigger cubic
| # Visit https://docs.shiftleft.io for help | ||
| name: Harness SAST and SCA | ||
|
|
||
| on: |
There was a problem hiding this comment.
P1: The --tag branch= expression uses github.head_ref, which is only available for pull_request events. If this workflow is triggered manually via workflow_dispatch, github.head_ref evaluates to an empty string, resulting in a malformed --tag branch= argument that could cause the CLI to error or attach an incorrect tag. Consider guarding the tag with a conditional or using a fallback like ${{ github.head_ref || github.ref_name }} to handle both trigger types.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 6:
<comment>The `--tag branch=` expression uses `github.head_ref`, which is only available for `pull_request` events. If this workflow is triggered manually via `workflow_dispatch`, `github.head_ref` evaluates to an empty string, resulting in a malformed `--tag branch=` argument that could cause the CLI to error or attach an incorrect tag. Consider guarding the tag with a conditional or using a fallback like `${{ github.head_ref || github.ref_name }}` to handle both trigger types.</comment>
<file context>
@@ -0,0 +1,62 @@
+# Visit https://docs.shiftleft.io for help
+name: Harness SAST and SCA
+
+on:
+ pull_request:
+ workflow_dispatch:
</file context>
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app RACS \ | ||
| --tag branch=${{ github.head_ref }} \ |
There was a problem hiding this comment.
P1: Using ${{ github.head_ref }} directly in an inline run script is a script injection risk. An attacker can create a PR from a branch with a malicious name (e.g., containing shell metacharacters or backticks) to execute arbitrary commands. GitHub's security documentation explicitly warns against this pattern. Pass the value through an environment variable instead:
env:
BRANCH: ${{ github.head_ref }}
run: |
... --tag branch=$BRANCH ...Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 30:
<comment>Using `${{ github.head_ref }}` directly in an inline `run` script is a script injection risk. An attacker can create a PR from a branch with a malicious name (e.g., containing shell metacharacters or backticks) to execute arbitrary commands. GitHub's security documentation explicitly warns against this pattern. Pass the value through an environment variable instead:
```yaml
env:
BRANCH: ${{ github.head_ref }}
run: |
... --tag branch=$BRANCH ...
```</comment>
<file context>
@@ -0,0 +1,62 @@
+ ${GITHUB_WORKSPACE}/sl --version
+ ${GITHUB_WORKSPACE}/sl analyze --strict --wait \
+ --app RACS \
+ --tag branch=${{ github.head_ref }} \
+ --jssrc .
+ env:
</file context>
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v11 | ||
| uses: actions/setup-java@v3 |
There was a problem hiding this comment.
P2: actions/setup-java@v3 runs on the deprecated Node 16 runtime — upgrade to @v4 to use Node 20 and avoid deprecation warnings.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 16:
<comment>`actions/setup-java@v3` runs on the deprecated Node 16 runtime — upgrade to `@v4` to use Node 20 and avoid deprecation warnings.</comment>
<file context>
@@ -0,0 +1,62 @@
+ steps:
+ - uses: actions/checkout@v3
+ - name: Setup Java JDK v11
+ uses: actions/setup-java@v3
+ with:
+ distribution: zulu
</file context>
| NextGen-Static-Analysis: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 |
There was a problem hiding this comment.
P2: actions/checkout@v3 runs on the deprecated Node 16 runtime. GitHub Actions will show deprecation warnings — upgrade to @v4 to use Node 20.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 14:
<comment>`actions/checkout@v3` runs on the deprecated Node 16 runtime. GitHub Actions will show deprecation warnings — upgrade to `@v4` to use Node 20.</comment>
<file context>
@@ -0,0 +1,62 @@
+ NextGen-Static-Analysis:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v3
+ - name: Setup Java JDK v11
+ uses: actions/setup-java@v3
</file context>
| - uses: actions/checkout@v3 | |
| - uses: actions/checkout@v4 |
| SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
|
|
||
| # Build-Rules: |
There was a problem hiding this comment.
P2: The Build-Rules job is entirely commented out, meaning the security policies defined in shiftleft.yml (blocking critical findings, OSS vulnerabilities) will never be evaluated. Pull requests with critical security findings won't be blocked from merging. If this is intentional for an initial rollout, consider adding a comment explaining when it should be enabled; otherwise, uncomment the job to enforce the defined policies.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 38:
<comment>The `Build-Rules` job is entirely commented out, meaning the security policies defined in `shiftleft.yml` (blocking critical findings, OSS vulnerabilities) will never be evaluated. Pull requests with critical security findings won't be blocked from merging. If this is intentional for an initial rollout, consider adding a comment explaining when it should be enabled; otherwise, uncomment the job to enforce the defined policies.</comment>
<file context>
@@ -0,0 +1,62 @@
+ SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443
+ SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443
+
+# Build-Rules:
+# runs-on: ubuntu-latest
+# permissions: write-all
</file context>
| pull_request: | ||
| workflow_dispatch: | ||
|
|
||
| jobs: |
There was a problem hiding this comment.
P2: The workflow does not define an explicit permissions block, so the GITHUB_TOKEN will have the repository's default permissions (often write-all). Following the principle of least privilege, add a top-level permissions block with minimal scopes needed. For a static analysis workflow, contents: read should be sufficient for the main job.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 10:
<comment>The workflow does not define an explicit `permissions` block, so the `GITHUB_TOKEN` will have the repository's default permissions (often `write-all`). Following the principle of least privilege, add a top-level `permissions` block with minimal scopes needed. For a static analysis workflow, `contents: read` should be sufficient for the main job.</comment>
<file context>
@@ -0,0 +1,62 @@
+ pull_request:
+ workflow_dispatch:
+
+jobs:
+ NextGen-Static-Analysis:
+ runs-on: ubuntu-latest
</file context>
| # --github-pr-repo=${{ github.event.repository.name }} \ | ||
| # --github-token=${{ secrets.GITHUB_TOKEN }} | ||
| # env: | ||
| # # SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} |
There was a problem hiding this comment.
P2: The SHIFTLEFT_ACCESS_TOKEN line has a double comment (# ... # SHIFTLEFT_ACCESS_TOKEN). If someone uncomments the Build-Rules job by removing the leading # from each line, this environment variable will remain commented out, causing sl check-analysis to fail with an authentication error. Remove the inner # so it's at the same comment level as the rest of the block.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 55:
<comment>The `SHIFTLEFT_ACCESS_TOKEN` line has a double comment (`# ... # SHIFTLEFT_ACCESS_TOKEN`). If someone uncomments the `Build-Rules` job by removing the leading `#` from each line, this environment variable will remain commented out, causing `sl check-analysis` to fail with an authentication error. Remove the inner `#` so it's at the same comment level as the rest of the block.</comment>
<file context>
@@ -0,0 +1,62 @@
+# --github-pr-repo=${{ github.event.repository.name }} \
+# --github-token=${{ secrets.GITHUB_TOKEN }}
+# env:
+# # SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}
+#
+# SHIFTLEFT_API_HOST: www.shiftleft.io
</file context>
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
LlamaPReview — No blocking issues found
One non-blocking finding was retained: CLI binary downloaded without integrity verification.
Review details and evidence
| Priority | File | Finding | Evidence |
|---|---|---|---|
| P2 | .github/workflows/shiftleft.yml |
CLI binary downloaded without integrity verification | needs verification |
Finding details
P2 · CLI binary downloaded without integrity verification
.github/workflows/shiftleft.yml
The sl CLI binary is downloaded from https://cdn.shiftleft.io/download/sl with no version pinning or integrity verification. While HTTPS provides transport security, a compromised CDN or endpoint could serve a malicious binary. Pinning a specific release and verifying its checksum would reduce this supply-chain risk. This is the vendor-recommended installation path, so the practical risk is low.
Verification boundary: needs verification; scope: changed region.
Conceptual guidance (not a committable GitHub suggestion):
- name: Download Harness SAST and SCA CLI (vX.Y.Z)
run: |
curl -L https://github.com/ShiftLeftSecurity/sast-cli/releases/download/vX.Y.Z/sl > ${GITHUB_WORKSPACE}/sl
echo "<expected_sha256> ${GITHUB_WORKSPACE}/sl" | sha256sum --check
chmod a+rx ${GITHUB_WORKSPACE}/sl
LlamaPReview checks
- Reviewed changed regions in
.github/workflows/shiftleft.yml. - Read bounded PR-head context from
.github/workflows/shiftleft.yml.
Automated review by LlamaPReview · Free for public open-source projects.
2 participants
This pull request adds a GitHub Action workflow file that executes Harness Static Application Security Testing (SAST) on this PR. Once merged, it will also execute SAST on all future PRs opened in this repository.
Visit app.shiftleft.io to see the security findings for this repository.
We've done a few things on your behalf
SHIFTLEFT_ACCESS_TOKENto allow GitHub Actions in this repository to communicate with the Harness SAST and SCA APIQuestions? Comments? Want to learn more? Get in touch with us or check out our documentation.
Summary by Sourcery
Integrate Harness (Qwiet) SAST and SCA into the repository via a new GitHub Actions workflow and initial security build rules.
New Features:
CI:
Summary by cubic
Add a GitHub Action to run Harness (Qwiet) SAST and SCA on every PR and on manual runs. Adds initial build rules to define vulnerability thresholds.
New Features
Harness SAST and SCAworkflow that triggers onpull_requestandworkflow_dispatch, posting a status check.slCLI to runsl analyze --strict --waitagainst appRACS, tagging the PR branch and scanning JS sources; requiresSHIFTLEFT_ACCESS_TOKEN.shiftleft.ymlwith rules: 0 critical allowed; up to 1 OSS or container finding; no reachable OSS vulnerabilities.Migration
SHIFTLEFT_ACCESS_TOKENsecret exists in the repo..github/workflows/shiftleft.yml.Written for commit bf2f7a8. Summary will update on new commits.