Skip to content

maint-86: prepare (not auto-apply) verifier model promotions (#2819 move 3) - #2834

Merged
stranske merged 1 commit into
mainfrom
model-promotion-prepare
Jul 26, 2026
Merged

maint-86: prepare (not auto-apply) verifier model promotions (#2819 move 3)#2834
stranske merged 1 commit into
mainfrom
model-promotion-prepare

maint-86: prepare (not auto-apply) verifier model promotions (#2819 m…

44d1d27
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / Semgrep OSS succeeded Jul 26, 2026 in 6s

3 new alerts

New alerts in code changed by this pull request

  • 3 warnings

See annotations below for details.

View all branch alerts.

Annotations

Check warning on line 39 in .github/workflows/maint-86-model-promotion-prepare.yml

See this annotation in the file changed.

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Check warning on line 42 in .github/workflows/maint-86-model-promotion-prepare.yml

See this annotation in the file changed.

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Check warning on line 71 in .github/workflows/maint-86-model-promotion-prepare.yml

See this annotation in the file changed.

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag Warning

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.