Skip to content

Conversation

oleg-kozlyuk-grafana
Copy link
Contributor

No description provided.

Copy link
Contributor

github-actions bot commented Oct 2, 2025

😢 zizmor failed with exit code 14.

Expand for full output
error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/release.yml:35:9
   |
 3 | / on:
 4 | |   push:
 5 | |     # run only against tags
 6 | |     tags:
 7 | |       - "v*"
 8 | |       # do not run for weekly release tags
 9 | |       - "!v0.0.0-weekly*"
   | |_________________________- generally used when publishing artifacts generated at runtime
...
35 |         - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
   |
   = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/weekly-release.yml:55:9
   |
55 |       - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
...
59 |       - uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6
   |         --------------------------------------------------------------------------- runtime artifacts usually published here
   |
   = note: audit confidence → Low

43 findings (1 ignored, 40 suppressed): 0 informational, 0 low, 0 medium, 2 high

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant