Preserve window bounds during macOS updates #11497
pierremtbsecurity-pr.yml Required
on: pull_request
semgrep-oss/scan
2m 53s
zizmor
48s
Annotations
10 errors, 16 warnings, and 1 notice
|
github-app:
.github/workflows/e2e-tests.yml#L78
e2e-tests.yml:78: dangerous use of GitHub App tokens: token granted access to all repositories for this owner's app installation
|
|
excessive-permissions:
.github/workflows/e2e-tests.yml#L19
e2e-tests.yml:19: overly broad permissions: pull-requests: write is overly broad at the workflow level
|
|
excessive-permissions:
.github/workflows/e2e-tests.yml#L18
e2e-tests.yml:18: overly broad permissions: contents: write is overly broad at the workflow level
|
|
github-app:
.github/workflows/cargo-test.yml#L189
cargo-test.yml:189: dangerous use of GitHub App tokens: app token inherits blanket installation permissions
|
|
github-app:
.github/workflows/cargo-test.yml#L194
cargo-test.yml:194: dangerous use of GitHub App tokens: token granted access to all repositories for this owner's app installation
|
|
github-app:
.github/workflows/cargo-test.yml#L27
cargo-test.yml:27: dangerous use of GitHub App tokens: app token inherits blanket installation permissions
|
|
github-app:
.github/workflows/cargo-test.yml#L32
cargo-test.yml:32: dangerous use of GitHub App tokens: token granted access to all repositories for this owner's app installation
|
|
excessive-permissions:
.github/workflows/cargo-test.yml#L14
cargo-test.yml:14: overly broad permissions: pull-requests: write is overly broad at the workflow level
|
|
cache-poisoning:
.github/workflows/build-apps.yml#L151
build-apps.yml:151: runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `package-manager-cache` enables caching
|
|
cache-poisoning:
.github/workflows/build-apps.yml#L33
build-apps.yml:33: runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `package-manager-cache` enables caching
|
|
template-injection:
.github/workflows/build-apps.yml#L284
build-apps.yml:284: code injection via template expansion: may expand into attacker-controllable code
|
|
template-injection:
.github/workflows/build-apps.yml#L283
build-apps.yml:283: code injection via template expansion: may expand into attacker-controllable code
|
|
template-injection:
.github/workflows/build-apps.yml#L282
build-apps.yml:282: code injection via template expansion: may expand into attacker-controllable code
|
|
excessive-permissions:
.github/workflows/build-apps.yml#L101
build-apps.yml:101: overly broad permissions: default permissions used due to no permissions: block
|
|
excessive-permissions:
.github/workflows/build-apps.yml#L24
build-apps.yml:24: overly broad permissions: default permissions used due to no permissions: block
|
|
excessive-permissions:
.github/workflows/build-apps.yml#L21
build-apps.yml:21: overly broad permissions: default permissions used due to no permissions: block
|
|
excessive-permissions:
.github/workflows/build-apps.yml#L1
build-apps.yml:1: overly broad permissions: default permissions used due to no permissions: block
|
|
artipacked:
.github/workflows/build-apps.yml#L233
build-apps.yml:233: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
|
|
artipacked:
.github/workflows/build-apps.yml#L118
build-apps.yml:118: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
|
|
artipacked:
.github/workflows/build-apps.yml#L31
build-apps.yml:31: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
|
|
no-stringify-keys:
src/machines/modelingMachine.ts#L2070
JSON stringify does not produce a stable key ordering and should not be relied on for producing object keys. Consider using jsonstablestringify instead.
|
|
no-stringify-keys:
src/machines/modelingMachine.ts#L2069
JSON stringify does not produce a stable key ordering and should not be relied on for producing object keys. Consider using jsonstablestringify instead.
|
|
no-stringify-keys:
src/clientSideScene/sceneEntities.ts#L1085
JSON stringify does not produce a stable key ordering and should not be relied on for producing object keys. Consider using jsonstablestringify instead.
|
|
no-stringify-keys:
src/clientSideScene/sceneEntities.ts#L935
JSON stringify does not produce a stable key ordering and should not be relied on for producing object keys. Consider using jsonstablestringify instead.
|
|
panic-in-function-returning-result:
rust/kcl-wasm-lib/src/lsp.rs#L66
expect or unwrap called in function returning a Result
|
|
panic-in-function-returning-result:
rust/kcl-language-server/src/main.rs#L139
expect or unwrap called in function returning a Result
|
|
superfluous-actions:
.github/workflows/publish-apps.yml#L121
publish-apps.yml:121: action functionality is already included by the runner: use `gh release` in a script step
|