TavernKeeper Scan Report

M4Marvin/charon

Commit 930fab4 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

zizmor reported unpinned-uses

Minor caution · high confidence

The workflow uses a version label for a reusable GitHub Action instead of locking it to a specific commit. If someone hijacked that label, the workflow could run altered code. Pinning to an exact commit hash prevents that.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The checkout step references actions/checkout@v6 using a floating major-version tag rather than a SHA-pinned reference. If the upstream tag were moved to a compromised commit, the workflow could execute untrusted code. The workflow scopes top-level permissions to empty and grants job-level contents write and id-token write, so a compromised action could push to the repository or mint OIDC tokens. This is a supply-chain hardening gap, not evidence of malicious intent.

Impact: low · Exploitability: plausible

Developer action: Pin actions/checkout to a full commit SHA instead of a floating version tag, and consider restricting the id-token write permission to only what the workflow needs.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/friction-log.yml:34

zizmor reported unpinned-uses

Minor caution · high confidence

The workflow runs a third-party tool using a version label instead of a locked commit. If that label were changed to point at bad code, the workflow would run it with significant repository permissions. Locking to a specific commit hash removes that risk.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The reconcile step references wevm/frog/reconcile@v1 using a floating major-version tag for a third-party action. A tag retag or upstream compromise would let arbitrary code run in a job that has contents write and id-token write permissions. SHA-pinning would eliminate the tag-movement risk. This is a hardening weakness, not malicious behavior.

Impact: low · Exploitability: plausible

Developer action: Pin wevm/frog/reconcile to a full commit SHA instead of a floating version tag, and review whether the id-token write permission is required for this step.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/friction-log.yml:40
Expected scanner matches (0)

None.

Coverage and limitations

Tools

Limitations

Technical scan identity