No material or immediate-danger concern was identified in this review.
This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.
0 immediate danger0 material2 low
What this review found
No material or immediate-danger item was identified.
Minor cautions
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a version label for a reusable GitHub Action instead of locking it to a specific commit. If someone hijacked that label, the workflow could run altered code. Pinning to an exact commit hash prevents that.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The checkout step references actions/checkout@v6 using a floating major-version tag rather than a SHA-pinned reference. If the upstream tag were moved to a compromised commit, the workflow could execute untrusted code. The workflow scopes top-level permissions to empty and grants job-level contents write and id-token write, so a compromised action could push to the repository or mint OIDC tokens. This is a supply-chain hardening gap, not evidence of malicious intent.
Impact: low · Exploitability: plausible
Developer action: Pin actions/checkout to a full commit SHA instead of a floating version tag, and consider restricting the id-token write permission to only what the workflow needs.
The workflow runs a third-party tool using a version label instead of a locked commit. If that label were changed to point at bad code, the workflow would run it with significant repository permissions. Locking to a specific commit hash removes that risk.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The reconcile step references wevm/frog/reconcile@v1 using a floating major-version tag for a third-party action. A tag retag or upstream compromise would let arbitrary code run in a job that has contents write and id-token write permissions. SHA-pinning would eliminate the tag-movement risk. This is a hardening weakness, not malicious behavior.
Impact: low · Exploitability: plausible
Developer action: Pin wevm/frog/reconcile to a full commit SHA instead of a floating version tag, and review whether the id-token write permission is required for this step.