A security scanner warned that this workflow might store credentials in GitHub Actions artifacts. Looking at the actual workflow, it only runs tests and never creates or saves any artifacts, so there is no risk.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.
Contextual assessment: The zizmor 'artipacked' rule flagged three lines in the CI workflow for potential credential persistence via GitHub Actions artifacts. Review of the full workflow source (ci.yml) shows no artifact upload/download steps, no credential exposure, and no artifact persistence. The workflow only performs checkout, Python setup with pip caching, and test execution. Permissions are restricted to 'contents: read'. The scanner signal is a false positive.
This is the same type of false alarm as the first one. The workflow step at this line just installs dependencies and runs tests; it never creates artifacts.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.
Contextual assessment: Same as candidate 0dee8cf1: the zizmor 'artipacked' flag at line 56 refers to the same workflow with no artifact operations. The pydantic1 job uses only checkout, setup-python, pip install, and make test-full. No artifacts are created or uploaded. This is a false positive.
A security scanner thought this JavaScript file might be obfuscated, but the actual code is clear and readable with comments explaining what each part does. It just opens settings panels and saves user preferences.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The JS-X-Ray scanner flagged this file as 'obfuscated-code' with high severity and low confidence. Examination of the full source shows clean, well-commented JavaScript using standard patterns (async/await, DOM helpers, template literals). There is no obfuscation, minification, encoded strings, or concealed execution. The code performs legitimate UI operations (opening modals, fetching/saving data via API calls). The scanner signal is a false positive.
This is another false positive. The step at this line installs browser test tools and runs browser tests; no artifacts are created or saved.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.
Contextual assessment: Same as the other two: the zizmor 'artipacked' flag at line 87 in the browser job. The workflow step uses actions/checkout, setup-python, pip install, playwright install, and make test-browser. No artifact upload or download occurs. The scanner signal is a false positive.