rules-cicd

GitHub Actions workflow is using curl or wget to download and pipe external scripts into a shell interpreter (curl | bash). This is a supply chain risk — the remote script can change at any time. Download the script, verify its SHA-256 checksum against a pinned value, then execute it.

GitHub Actions expression injection: user-controlled data (issue title, PR title, PR branch name, comment body) interpolated directly into a run: shell command. An attacker can craft a malicious title or branch name containing shell metacharacters to achieve arbitrary code execution in the CI runner (CWE-78). Use an intermediate environment variable: set env.SAFE_VAR with the expression, then reference $SAFE_VAR in the run: step.

Detected 'pull_request_target' trigger with potential checkout of PR head. This is a well-documented RCE vector in CI: the workflow runs with write permissions and secrets in the context of the base repo, but checks out untrusted PR code. Avoid combining pull_request_target with actions/checkout of the PR head ref. See GitHub Security Lab advisory GHSL-2021-1013.

Detected potential logging of secrets in GitHub Actions. This could leak credentials.

Detected unpinned action version using '@main', '@master', or a floating major tag (e.g. @v3). This is a supply chain risk — the action owner can push malicious code at any time. Pin to a full commit SHA (e.g. uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683).