Reviews / replicatedhq/embedded-cluster / PR #3917
replicatedhq/embedded-cluster #3917 · head 446bd94f · review complete · 6 findings · read only
Review findings and their code anchors.
Finding ID: finding-5070f192
`actions/checkout@v4` style mutable tags let the action author silently swap the code your CI runs. Pin to a full 40-char commit SHA (with a version comment if you like).
Resolve conversation on GitHubFinding ID: finding-54350ac3
This action is pinned to a mutable tag — it can silently run different code on the next push upstream. Pin it to a full 40-character commit SHA (with a version comment if you like). High severity: a compromised action here gets your workflow's credentials.
Finding ID: finding-75cac27a
Pinning this external action to a mutable ref means a tag repoint can run arbitrary code in CI. Pin to the full 40-char commit SHA (version comment optional).
Resolve conversation on GitHubFinding ID: code-review.dr-fixture-manifest-nondeterministic-key-collision
Manifest bytes are nondeterministic, but its S3 key is payload-derived — rerunning the DR fixture publish collides with an immutable object. Base the immutability check on semantics rather than byte equality.
Resolve conversation on GitHubFinding ID: code-review.airgap-baseline-concurrency-collision
e2e-airgap-bundles shares the baseline workflow's concurrency group, so PR runs queue behind baseline production. Add github.run_id or github.head_ref to the group, or drop the concurrency block — assembly reads immutable published releases now, so there's no shared state to protect.
Resolve conversation on GitHubFinding ID: finding-bc49b562
This assertion helper never calls t.Helper(), so failures get attributed to line 886 instead of the actual call site. Add t.Helper() at the top.
Resolve conversation on GitHub