Skip to content

TEST: Some test to check CLI v2 upload#8

Open
machadoit wants to merge 16 commits into
mainfrom
test-cli-upload-v2
Open

TEST: Some test to check CLI v2 upload#8
machadoit wants to merge 16 commits into
mainfrom
test-cli-upload-v2

Conversation

@machadoit

Copy link
Copy Markdown

No description provided.

@machadoit machadoit changed the title TEST: Some test to check CLI v1 upload TEST: Some test to check CLI v2 upload Sep 4, 2025
codacy/codacy-analysis-cli \
analyze --tool eslint --upload --project-token ${{ secrets.CODACY_PROJECT_TOKEN }} --max-allowed-issues 99999 --commit-uuid $GITHUB_SHA
- name: Run Codacy CLI
uses: codacy/codacy-cli-v2-action@main

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 Codacy found a high Security issue: An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.

The issue identified by the Semgrep linter is that the GitHub Action codacy/codacy-cli-v2-action@main is being referenced using a branch name (main). This practice can lead to unpredictability, as the action may change if new commits are pushed to the branch. Instead, it's recommended to pin the action to a specific commit SHA to ensure that the action remains immutable and consistent across builds.

To fix this issue, you should replace main with the full-length commit SHA of the specific version of the action you want to use. You can find the commit SHA from the repository's commit history on GitHub.

Here’s the code suggestion to implement this change:

Suggested change
uses: codacy/codacy-cli-v2-action@main
uses: codacy/codacy-cli-v2-action@<full-length-commit-SHA>

Make sure to replace <full-length-commit-SHA> with the actual SHA you want to pin to.


This comment was generated by an experimental AI tool.

@codacy-development codacy-development Bot deleted a comment from codacy-production Bot Jul 21, 2026
@codacy-development

codacy-development Bot commented Jul 21, 2026

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric Results
Complexity 0

View in Codacy

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants