github · awesome-mcp-serversHEAD

Evidence

ref: ${{ github.event.pull_request.base.ref }}

      - name: Validate PR submission

        uses: actions/github-script@v7

        with:

          script: |

            const fs = require('fs');

RemediationAI

The problem is that `actions/github-script@v7` uses a mutable tag reference instead of a pinned commit SHA, allowing a compromised maintainer to inject malicious code into your CI pipeline. Replace `uses: actions/github-script@v7` with `uses: actions/github-script@e69ef5462fd455e02edcdb487b6fab5b33fac9ba # v7.0.1` (substitute the actual SHA for v7 from the GitHub Actions repository). This fix ensures that your workflow always executes the exact version you tested and approved, preventing silent code substitution attacks. Verify the fix by running `git log --oneline actions/github-script` in the actions/github-script repository to confirm the SHA corresponds to the intended version tag.

Evidence

runs-on: ubuntu-latest

    steps:

      - name: Post welcome comment

        uses: actions/github-script@v7

        with:

          script: |

            const { owner, repo } = context.repo;

RemediationAI

The problem is that `actions/github-script@v7` uses a mutable tag reference instead of a pinned commit SHA, allowing a compromised maintainer to inject malicious code into your CI pipeline. Replace `uses: actions/github-script@v7` with `uses: actions/github-script@e69ef5462fd455e02edcdb487b6fab5b33fac9ba # v7.0.1` (substitute the actual SHA for v7 from the GitHub Actions repository). This fix ensures that your workflow always executes the exact version you tested and approved, preventing silent code substitution attacks. Verify the fix by running `git log --oneline actions/github-script` in the actions/github-script repository to confirm the SHA corresponds to the intended version tag.

Evidence

runs-on: ubuntu-latest

    steps:

      - name: Checkout base branch

        uses: actions/checkout@v4

        with:

          ref: ${{ github.event.pull_request.base.ref }}

RemediationAI

The problem is that `actions/checkout@v4` uses a mutable tag reference instead of a pinned commit SHA, allowing a compromised maintainer to inject malicious code into your CI pipeline. Replace `uses: actions/checkout@v4` with `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` (substitute the actual current SHA for v4 from the actions/checkout repository). This fix ensures that your workflow always executes the exact version you tested and approved, preventing silent code substitution attacks. Verify the fix by running `git rev-parse v4` in the actions/checkout repository to confirm the SHA corresponds to the v4 tag.