Add GitHub Action: Qwiet AI by Harness Static Analysis - #107
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
💡 TipWant to run additional checks on this PR?
|
|
CodeSherlock.AI is currently reviewing the changes in this pull request. ⏳ Smaller PRs typically take 1–2 minutes, medium ones 3–4 minutes, and larger PRs may take up to 5–6 minutes. |
|
Rams skipped this PR — Free reviews one repository at a time, and your active repository is Upgrade to Solo — $39/mo to add this repo, or free the slot by removing Rams from that repo via GitHub app settings. |
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
|
View changes in DiffLens |
|
Review changes with |
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
🧙 Sourcery is reviewing your pull request! Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
🤖 Review complete! 🤖 Reviewed by codereviewbot.ai - Catch bugs before your team does. |
Hard-Coded Secrets (1)
More info on how to fix Hard-Coded Secrets in General. Insecure Processing of Data (2)
More info on how to fix Insecure Processing of Data in JavaScript. 👉 Go to the dashboard for detailed results. 📥 Happy? Share your feedback with us. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v8 | ||
| uses: actions/setup-java@v3 | ||
| with: | ||
| distribution: zulu | ||
| java-version: 8 | ||
|
|
||
| - name: Download Harness SAST and SCA CLI | ||
| run: | | ||
| curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
|
|
||
| - name: Static Analysis | ||
| run: | | ||
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Tools \ | ||
| --tag branch=${{ github.head_ref }} \ | ||
| --js $(pwd) -- --ts | ||
| env: | ||
| SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} | ||
| SHIFTLEFT_API_HOST: www.shiftleft.io | ||
| SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
|
|
||
| # Build-Rules: | ||
| # runs-on: ubuntu-latest | ||
| # permissions: write-all | ||
| # needs: NextGen-Static-Analysis | ||
| # steps: | ||
| # - uses: actions/checkout@v3 | ||
| # - name: Download Harness SAST and SCA CLI | ||
| # run: | | ||
| # curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
| # - name: Validate Build Rules | ||
| # run: | | ||
| # ${GITHUB_WORKSPACE}/sl check-analysis --app Tools \ | ||
| # --github-pr-number=${{github.event.number}} \ | ||
| # --github-pr-user=${{ github.repository_owner }} \ | ||
| # --github-pr-repo=${{ github.event.repository.name }} \ | ||
| # --github-token=${{ secrets.GITHUB_TOKEN }} | ||
| # env: | ||
| # # SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} | ||
| # | ||
| # SHIFTLEFT_API_HOST: www.shiftleft.io | ||
| # SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| # SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
| # |
PR Summary
|
![codescene-delta-analysis[bot]](https://avatars.githubusercontent.com/in/53921?s=60&v=4){kind=small}
There was a problem hiding this comment.
No application code in the PR — skipped Code Health checks.
See analysis details in CodeScene
Quality Gate Profile: Customizable Safeguards
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Scala |  |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Swift | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| JavaScript | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Ruby | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| C & C++ | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| C# | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Rust | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Shell | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Terraform | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Code coverage |  |
Jul 26, 2026 7:53a.m. | Review ↗ |
| SQL | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Secrets | |
Jul 26, 2026 7:23a.m. | Review ↗ |
| Ansible | |
Jul 26, 2026 7:23a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
Dependency ReviewThe following issues were found:
License Issues.github/workflows/shiftleft.yml
OpenSSF Scorecard
Scanned Files
|
❌ 6 blocking issues (6 total)
|
![qltysh[bot]](https://avatars.githubusercontent.com/in/890766?s=60&v=4){kind=small}
| # SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
| # | ||
|
|
||
|
|
| NextGen-Static-Analysis: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 |
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v8 | ||
| uses: actions/setup-java@v3 |
| curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl | ||
|
|
||
| - name: Static Analysis | ||
| run: | |
There was a problem hiding this comment.
"github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs\.github\.com/en/actions/reference/security/secure\-use\#good\-practices\-for\-mitigating\-script\-injection\-attacks for more details [actionlint:expression]
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Tools \ | ||
| --tag branch=${{ github.head_ref }} \ |
|
Warning Review limit reached
Next review available in: 58 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| ErrorProne | 1 medium |
| Security | 2 critical |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
tools | ee700b8 | Jul 26 2026, 07:25 AM |
|
|
View changes in DiffLens |
|
View changes in DiffLens |
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Tools \ | ||
| --tag branch=${{ github.head_ref }} \ |
There was a problem hiding this comment.
Bug: The github.head_ref variable is used for tagging, but it's empty on workflow_dispatch triggers, which will cause the sl analyze step to fail.
Severity: MEDIUM
Suggested Fix
Use a variable that is available for all trigger types, or provide a fallback. For example, you can use github.ref_name as it is populated for both pull_request and workflow_dispatch triggers. A robust expression would be ${{ github.head_ref || github.ref_name }}.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: .github/workflows/shiftleft.yml#L30
Potential issue: The workflow uses `github.head_ref` to tag the analysis branch. This
variable is only populated during `pull_request` events. Since the workflow can also be
triggered manually via `workflow_dispatch`, `github.head_ref` will be an empty string in
that context. This will cause the `sl analyze` command to be run with an empty branch
tag (`--tag branch=`), which will cause the step to fail because `--strict` mode is
enabled.
Did we get this right? 👍 / 👎 to inform future reviews.
| # --github-pr-number=${{github.event.number}} \ | ||
| # --github-pr-user=${{ github.repository_owner }} \ | ||
| # --github-pr-repo=${{ github.event.repository.name }} \ | ||
| # --github-token=${{ secrets.GITHUB_TOKEN }} | ||
| # env: | ||
| # # SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} | ||
| # | ||
| # SHIFTLEFT_API_HOST: www.shiftleft.io | ||
| # SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| # SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
| # |
There was a problem hiding this comment.
Bug: The Build-Rules job is commented out, which disables all security policy enforcement, allowing PRs with critical vulnerabilities to be merged.
Severity: CRITICAL
Suggested Fix
Uncomment the Build-Rules job (lines 38-60) to re-enable the security policy checks. Additionally, ensure the SHIFTLEFT_ACCESS_TOKEN secret is correctly configured and uncommented within the job's environment variables.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: .github/workflows/shiftleft.yml#L38-L60
Potential issue: The `Build-Rules` job, which is responsible for enforcing security
policies by running `sl check-analysis`, is completely commented out. This means that
security rules defined in the `shiftleft.yml` file, such as blocking critical findings
or reachable OSS vulnerabilities, are never evaluated. As a result, pull requests
containing critical security vulnerabilities will pass CI checks, defeating the purpose
of the security scan.
Did we get this right? 👍 / 👎 to inform future reviews.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
8 issues found across 2 files
Confidence score: 2/5
- In
.github/workflows/shiftleft.yml, the combination of interpolating${{ github.head_ref }}in arun:script and executing an unverified remote binary before/around token use creates the highest-risk path: attacker-controlled command execution and possibleSHIFTLEFT_ACCESS_TOKENtheft — sanitize/quote branch input, pin a specific artifact, and verify checksum/signature before execution. - In
.github/workflows/shiftleft.yml, third-party actions are referenced by mutable tags and no explicitpermissionsblock is set, so workflow behavior can change unexpectedly and a compromised step may get broaderGITHUB_TOKENaccess than needed — pin actions to full commit SHAs and set least-privilege permissions explicitly. - In
.github/workflows/shiftleft.yml,github.head_refis empty forworkflow_dispatchand fork PRs run with empty auth, which can produce empty tagging and failing required scans for external contributors — use event-aware branch variables and gate/authenticate scan steps for forked PRs. - In
.github/workflows/shiftleft.yml, the commented-outBuild-Rulesjob means policy enforcement is effectively disabled, andactions/setup-java@v3adds compatibility risk as runner runtimes evolve — re-enable policy checks and upgrade toactions/setup-java@v4.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/shiftleft.yml">
<violation number="1" location=".github/workflows/shiftleft.yml:11">
P2: The workflow does not define a `permissions` block, so the `GITHUB_TOKEN` will inherit the repository's default permissions, which are often overly broad. Adding an explicit permissions block scoped to only what's needed (e.g., `contents: read`) follows the principle of least privilege and reduces blast radius if the workflow is compromised.</violation>
<violation number="2" location=".github/workflows/shiftleft.yml:14">
P1: The workflow executes mutable action tags in a job that handles the SAST access token. Pin both third-party action references to full commit SHAs (with version comments) to make reviewed workflow execution reproducible.</violation>
<violation number="3" location=".github/workflows/shiftleft.yml:16">
P2: `actions/setup-java@v3` uses a deprecated Node.js runtime version on GitHub-hosted runners. Update to `actions/setup-java@v4` to ensure continued compatibility.</violation>
<violation number="4" location=".github/workflows/shiftleft.yml:23">
P1: This step executes an unpinned, unverified remote binary with `SHIFTLEFT_ACCESS_TOKEN` available to the next step. Pin a release artifact and verify its published checksum/signature before making it executable.</violation>
<violation number="5" location=".github/workflows/shiftleft.yml:30">
P1: When this workflow is triggered manually via `workflow_dispatch`, the branch tag will be empty because `github.head_ref` is only available for `pull_request` events. This means `--tag branch=` will be passed with no value, which can produce untagged/mislabeled analysis results in the Harness platform. Consider using `${{ github.head_ref || github.ref_name }}` or splitting the tag assignment into a conditional step to handle both trigger types correctly.</violation>
<violation number="6" location=".github/workflows/shiftleft.yml:30">
P1: Using `${{ github.head_ref }}` directly in a `run:` step is a script injection vulnerability. An attacker can craft a branch name containing shell metacharacters or injected commands (e.g., `'; malicious-command #`) which will be interpolated directly into the shell script before execution.
Pass the value through an environment variable instead:
```yaml
env:
BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
run: |
... --tag branch=${BRANCH_NAME} ...
```</violation>
<violation number="7" location=".github/workflows/shiftleft.yml:33">
P2: Fork-originated PRs run `sl analyze` with an empty access token, so this required scan/status check will fail for external contributors. Gate this authenticated step for non-fork PRs, or configure a supported unauthenticated fork-scanning path.</violation>
<violation number="8" location=".github/workflows/shiftleft.yml:38">
P2: The `Build-Rules` job is entirely commented out, which means the security policies defined in `shiftleft.yml` (blocking critical findings, reachable OSS vulnerabilities) will never be enforced. PRs with critical vulnerabilities can pass CI without any security gate. If this is intentional for initial setup, consider adding a TODO or timeline for enabling it.</violation>
</file>
Shadow auto-approve: would not auto-approve because issues were found.
Re-trigger cubic
| NextGen-Static-Analysis: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 |
There was a problem hiding this comment.
P1: The workflow executes mutable action tags in a job that handles the SAST access token. Pin both third-party action references to full commit SHAs (with version comments) to make reviewed workflow execution reproducible.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 14:
<comment>The workflow executes mutable action tags in a job that handles the SAST access token. Pin both third-party action references to full commit SHAs (with version comments) to make reviewed workflow execution reproducible.</comment>
<file context>
@@ -0,0 +1,62 @@
+ NextGen-Static-Analysis:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v3
+ - name: Setup Java JDK v8
+ uses: actions/setup-java@v3
</file context>
|
|
||
| - name: Download Harness SAST and SCA CLI | ||
| run: | | ||
| curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl |
There was a problem hiding this comment.
P1: This step executes an unpinned, unverified remote binary with SHIFTLEFT_ACCESS_TOKEN available to the next step. Pin a release artifact and verify its published checksum/signature before making it executable.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 23:
<comment>This step executes an unpinned, unverified remote binary with `SHIFTLEFT_ACCESS_TOKEN` available to the next step. Pin a release artifact and verify its published checksum/signature before making it executable.</comment>
<file context>
@@ -0,0 +1,62 @@
+
+ - name: Download Harness SAST and SCA CLI
+ run: |
+ curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl
+
+ - name: Static Analysis
</file context>
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Tools \ | ||
| --tag branch=${{ github.head_ref }} \ |
There was a problem hiding this comment.
P1: When this workflow is triggered manually via workflow_dispatch, the branch tag will be empty because github.head_ref is only available for pull_request events. This means --tag branch= will be passed with no value, which can produce untagged/mislabeled analysis results in the Harness platform. Consider using ${{ github.head_ref || github.ref_name }} or splitting the tag assignment into a conditional step to handle both trigger types correctly.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 30:
<comment>When this workflow is triggered manually via `workflow_dispatch`, the branch tag will be empty because `github.head_ref` is only available for `pull_request` events. This means `--tag branch=` will be passed with no value, which can produce untagged/mislabeled analysis results in the Harness platform. Consider using `${{ github.head_ref || github.ref_name }}` or splitting the tag assignment into a conditional step to handle both trigger types correctly.</comment>
<file context>
@@ -0,0 +1,62 @@
+ ${GITHUB_WORKSPACE}/sl --version
+ ${GITHUB_WORKSPACE}/sl analyze --strict --wait \
+ --app Tools \
+ --tag branch=${{ github.head_ref }} \
+ --js $(pwd) -- --ts
+ env:
</file context>
| ${GITHUB_WORKSPACE}/sl --version | ||
| ${GITHUB_WORKSPACE}/sl analyze --strict --wait \ | ||
| --app Tools \ | ||
| --tag branch=${{ github.head_ref }} \ |
There was a problem hiding this comment.
P1: Using ${{ github.head_ref }} directly in a run: step is a script injection vulnerability. An attacker can craft a branch name containing shell metacharacters or injected commands (e.g., '; malicious-command #) which will be interpolated directly into the shell script before execution.
Pass the value through an environment variable instead:
env:
BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
run: |
... --tag branch=${BRANCH_NAME} ...Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 30:
<comment>Using `${{ github.head_ref }}` directly in a `run:` step is a script injection vulnerability. An attacker can craft a branch name containing shell metacharacters or injected commands (e.g., `'; malicious-command #`) which will be interpolated directly into the shell script before execution.
Pass the value through an environment variable instead:
```yaml
env:
BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
run: |
... --tag branch=${BRANCH_NAME} ...
```</comment>
<file context>
@@ -0,0 +1,62 @@
+ ${GITHUB_WORKSPACE}/sl --version
+ ${GITHUB_WORKSPACE}/sl analyze --strict --wait \
+ --app Tools \
+ --tag branch=${{ github.head_ref }} \
+ --js $(pwd) -- --ts
+ env:
</file context>
| --tag branch=${{ github.head_ref }} \ | ||
| --js $(pwd) -- --ts | ||
| env: | ||
| SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} |
There was a problem hiding this comment.
P2: Fork-originated PRs run sl analyze with an empty access token, so this required scan/status check will fail for external contributors. Gate this authenticated step for non-fork PRs, or configure a supported unauthenticated fork-scanning path.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 33:
<comment>Fork-originated PRs run `sl analyze` with an empty access token, so this required scan/status check will fail for external contributors. Gate this authenticated step for non-fork PRs, or configure a supported unauthenticated fork-scanning path.</comment>
<file context>
@@ -0,0 +1,62 @@
+ --tag branch=${{ github.head_ref }} \
+ --js $(pwd) -- --ts
+ env:
+ SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}
+ SHIFTLEFT_API_HOST: www.shiftleft.io
+ SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443
</file context>
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Setup Java JDK v8 | ||
| uses: actions/setup-java@v3 |
There was a problem hiding this comment.
P2: actions/setup-java@v3 uses a deprecated Node.js runtime version on GitHub-hosted runners. Update to actions/setup-java@v4 to ensure continued compatibility.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 16:
<comment>`actions/setup-java@v3` uses a deprecated Node.js runtime version on GitHub-hosted runners. Update to `actions/setup-java@v4` to ensure continued compatibility.</comment>
<file context>
@@ -0,0 +1,62 @@
+ steps:
+ - uses: actions/checkout@v3
+ - name: Setup Java JDK v8
+ uses: actions/setup-java@v3
+ with:
+ distribution: zulu
</file context>
| uses: actions/setup-java@v3 | |
| uses: actions/setup-java@v4 |
| SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443 | ||
| SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443 | ||
|
|
||
| # Build-Rules: |
There was a problem hiding this comment.
P2: The Build-Rules job is entirely commented out, which means the security policies defined in shiftleft.yml (blocking critical findings, reachable OSS vulnerabilities) will never be enforced. PRs with critical vulnerabilities can pass CI without any security gate. If this is intentional for initial setup, consider adding a TODO or timeline for enabling it.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 38:
<comment>The `Build-Rules` job is entirely commented out, which means the security policies defined in `shiftleft.yml` (blocking critical findings, reachable OSS vulnerabilities) will never be enforced. PRs with critical vulnerabilities can pass CI without any security gate. If this is intentional for initial setup, consider adding a TODO or timeline for enabling it.</comment>
<file context>
@@ -0,0 +1,62 @@
+ SHIFTLEFT_GRPC_TELEMETRY_HOST: telemetry.shiftleft.io:443
+ SHIFTLEFT_GRPC_API_HOST: api.shiftleft.io:443
+
+# Build-Rules:
+# runs-on: ubuntu-latest
+# permissions: write-all
</file context>
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| NextGen-Static-Analysis: |
There was a problem hiding this comment.
P2: The workflow does not define a permissions block, so the GITHUB_TOKEN will inherit the repository's default permissions, which are often overly broad. Adding an explicit permissions block scoped to only what's needed (e.g., contents: read) follows the principle of least privilege and reduces blast radius if the workflow is compromised.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/shiftleft.yml, line 11:
<comment>The workflow does not define a `permissions` block, so the `GITHUB_TOKEN` will inherit the repository's default permissions, which are often overly broad. Adding an explicit permissions block scoped to only what's needed (e.g., `contents: read`) follows the principle of least privilege and reduces blast radius if the workflow is compromised.</comment>
<file context>
@@ -0,0 +1,62 @@
+ workflow_dispatch:
+
+jobs:
+ NextGen-Static-Analysis:
+ runs-on: ubuntu-latest
+ steps:
</file context>
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
LlamaPReview — No blocking issues found
One non-blocking finding was retained: Workflow pins deprecated action versions targeting end-of-life Node.js 20 runtime.
Review details and evidence
| Priority | File | Finding | Evidence |
|---|---|---|---|
| P2 | .github/workflows/shiftleft.yml |
Workflow pins deprecated action versions targeting end-of-life Node.js 20 runtime | confirmed |
Finding details
P2 · Workflow pins deprecated action versions targeting end-of-life Node.js 20 runtime
.github/workflows/shiftleft.yml
actions/checkout@v3 and actions/setup-java@v3 target the deprecated Node.js 20 runner. GitHub currently force-runs them on Node.js 24 with warnings, but eventual removal of Node.js 20 support will cause hard CI failures that mask real analysis results. The CI annotation on the NextGen-Static-Analysis check confirms the deprecation is already triggering.
Verification boundary: confirmed; scope: changed region.
Conceptual guidance (not a committable GitHub suggestion):
Update `actions/checkout` to v4 and `actions/setup-java` to v4 (or the latest supported major version).
Material unknowns
- The repository's default GITHUB_TOKEN permissions may already be restricted to read-only, in which case the omitted explicit permissions block does not grant excessive access.
- Check: Check the repository's Actions settings under Settings > Actions > General > Workflow permissions, or inspect the GITHUB_TOKEN permissions in a recent workflow run log.
Automated review by LlamaPReview · Free for public open-source projects.
2 participants
This pull request adds a GitHub Action workflow file that executes Harness Static Application Security Testing (SAST) on this PR. Once merged, it will also execute SAST on all future PRs opened in this repository.
Visit app.shiftleft.io to see the security findings for this repository.
We've done a few things on your behalf
SHIFTLEFT_ACCESS_TOKENto allow GitHub Actions in this repository to communicate with the Harness SAST and SCA APIQuestions? Comments? Want to learn more? Get in touch with us or check out our documentation.
Summary by Sourcery
Add GitHub Actions workflow and configuration to run Harness SAST/SCA on pull requests with defined security build rules.
New Features:
Summary by cubic
Add a GitHub Action to run Harness SAST and SCA on every PR, plus baseline build rules to gate risk. This adds a status check and blocks critical findings.
.github/workflows/shiftleft.ymlto run analysis onpull_requestandworkflow_dispatch.actions/checkout@v3andactions/setup-java@v3(Zulu JDK 8), downloads theslCLI, and runssl analyze --strict --waitfor JS/TS.SHIFTLEFT_ACCESS_TOKENand posts results as a PR status check.shiftleft.ymlbuild rules: block critical findings; allow up to 1 OSS or container finding; block reachable OSS vulnerabilities.Written for commit ee700b8. Summary will update on new commits.