search

guacsec / guac

GUAC aggregates software security metadata into a high fidelity graph database.
https://guac.sh
Apache License 2.0
1.29k stars 176 forks source link

zizmor audit for reusable-local-build workflow #2274

Closed funnelfiasco closed 6 days ago

funnelfiasco commented 2 weeks ago 
🌈 completed reusable-local-build.yaml
warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/reusable-local-build.yaml:34:9
   |
34 |         - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
   |  _________-
35 | |         with:
36 | |           repository: ${{ inputs.repository }}
37 | |           ref: ${{ inputs.ref }}
   | |________________________________- does not set persist-credentials: false
   |
   = note: audit confidence → Low

1 findings (0 ignored): 0 unknown, 0 informational, 0 low, 1 medium, 0 high