This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.
0 immediate danger1 material2 low
What this review found
No material or immediate-danger item was identified.
Minor cautions
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a version tag instead of a fixed commit hash for a standard GitHub action. If someone moved that tag to malicious code, the workflow could run it. This is a common but avoidable supply-chain weakness.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The workflow references actions/checkout@v6 using a mutable major-version tag rather than a pinned commit SHA. If the tag were moved to a malicious commit, the action would execute with the job's contents:write and id-token:write permissions. This is a first-party GitHub action and persist-credentials is set to false, reducing practical risk, but tag-based pinning remains a supply-chain weakness.
Impact: low · Exploitability: unlikely
Developer action: Pin actions/checkout to a full commit SHA for reproducible and tamper-resistant CI runs.
The workflow runs a third-party tool using a version tag instead of a fixed commit hash, with broad permissions including the ability to write repository contents and issue identity tokens. If that tool's tag were moved to malicious code, it could abuse those permissions. Pinning to a specific commit would prevent this.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The workflow references wevm/frog/reconcile@v1, a third-party action, using a mutable major-version tag. The job grants contents:write, id-token:write, and pull-requests:write permissions. If the upstream tag were moved to a malicious commit, the action would execute with these elevated permissions, enabling repository tampering or OIDC token abuse. The risk is mitigated by the job's actor-id gate on issue_comment triggers, but tag-based pinning for a third-party action with id-token:write is a notable supply-chain weakness.
Impact: low · Exploitability: unlikely
Developer action: Pin wevm/frog/reconcile to a full commit SHA and verify that id-token:write is required; remove it if the action does not need OIDC token issuance.