What this review found
No material or high-risk item was identified.
Minor cautions
zizmor reported unpinned-uses
Minor caution · high confidence
The CI uses a standard GitHub action but pins it to a version label instead of an exact code snapshot. If someone were able to move that label, they could change what runs. Pinning to a specific commit hash would be safer.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The workflow references actions/checkout at a major-version tag rather than a full commit SHA. This is an official GitHub action and the workflow runs on push and pull_request with contents:read permissions, so the practical exposure is limited to the theoretical risk of a tag being moved or a maintainer account being compromised. SHA-pinning would remove that residual risk.
Impact: low · Exploitability: unlikely
Developer action: Pin actions/checkout to a full commit SHA instead of the v4 tag.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:24
zizmor reported artipacked
Minor caution · medium confidence
This is a secondary flag tied to the same unpinned action. No artifact upload or credential handling is visible in this workflow, so the practical risk is low and overlaps with the version-pinning issue.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The artipacked finding is associated with the unpinned actions/checkout reference. The workflow does not upload artifacts and uses a read-only permission scope, so there is no concrete credential-persistence path shown. The underlying concern reduces to the unpinned action reference already covered by the unpinned-uses candidate.
Impact: low · Exploitability: unlikely
Developer action: Pin actions/checkout to a full commit SHA; no separate artifact handling change is needed based on the supplied evidence.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:24
zizmor reported unpinned-uses
Minor caution · high confidence
Another job in the same CI file uses the same version-label pinning for the checkout action. The fix is the same: pin to an exact commit hash.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The pydantic1 job references actions/checkout at the v4 major-version tag rather than a SHA. Same official action and same restricted permissions as the fast job; the residual risk is tag movement or account compromise, not a concrete data flow shown here.
Impact: low · Exploitability: unlikely
Developer action: Pin actions/checkout to a full commit SHA instead of the v4 tag.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:56
zizmor reported artipacked
Minor caution · medium confidence
This is another secondary flag tied to the unpinned checkout action. No artifact or credential handling is visible, so the practical risk is low and overlaps with the pinning issue.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The artipacked finding is associated with the unpinned actions/checkout reference in the pydantic1 job. No artifact upload or secret usage is visible in that job, so the credential-persistence concern does not correspond to a concrete flow in the supplied source.
Impact: low · Exploitability: unlikely
Developer action: Pin actions/checkout to a full commit SHA; no separate artifact handling change is needed based on the supplied evidence.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:56
zizmor reported unpinned-uses
Minor caution · high confidence
The Python setup action is pinned to a version label instead of an exact commit. Pinning to a hash would be safer.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The fast job references actions/setup-python at the v5 major-version tag rather than a SHA. This is an official GitHub action and the job uses read-only permissions, so the residual risk is limited to tag movement or maintainer account compromise.
Impact: low · Exploitability: unlikely
Developer action: Pin actions/setup-python to a full commit SHA instead of the v5 tag.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:25
zizmor reported unpinned-uses
Minor caution · high confidence
Another job uses the same version-label pinning for the Python setup action. Pin to an exact commit hash to remove the residual risk.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The pydantic1 job references actions/setup-python at the v5 major-version tag rather than a SHA. Same official action and restricted permissions as elsewhere; residual risk is tag movement or account compromise.
Impact: low · Exploitability: unlikely
Developer action: Pin actions/setup-python to a full commit SHA instead of the v5 tag.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:57
zizmor reported unpinned-uses
Minor caution · high confidence
The automated test setup uses a standard shorthand reference to a well-known GitHub helper tool instead of locking it to an exact version. This is normal practice and not dangerous, though stricter projects sometimes lock to an exact version for extra safety.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The flagged line references a first-party GitHub action using a major-version tag rather than a full commit SHA. This is the conventional, widely-used pinning style for official actions in CI workflows. It does not introduce a supply-chain backdoor, credential exfiltration, or malicious execution path. The residual risk is that a compromised tag could move to a malicious commit, but this is a general CI hardening concern, not evidence of malicious intent or a material vulnerability in this project.
Impact: low · Exploitability: unlikely
Developer action: Pin first-party actions to a full commit SHA with a verification comment if stricter supply-chain hardening is desired; otherwise no change is required.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:88
zizmor reported artipacked
Minor caution · medium confidence
This is a secondary flag tied to the unpinned checkout action in the browser job. No artifact or credential handling is visible, so the practical risk is low and overlaps with the pinning issue.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The artipacked finding is associated with the unpinned actions/checkout reference in the browser job. No artifact upload or secret usage is visible in that job, so the credential-persistence concern does not correspond to a concrete flow in the supplied source.
Impact: low · Exploitability: unlikely
Developer action: Pin actions/checkout to a full commit SHA; no separate artifact handling change is needed based on the supplied evidence.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:87
zizmor reported unpinned-uses
Minor caution · high confidence
The browser job uses the same version-label pinning for the checkout action. Pin to an exact commit hash to remove the residual risk.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The browser job references actions/checkout at the v4 major-version tag rather than a SHA. This is an official GitHub action and the job uses read-only permissions, so the residual risk is limited to tag movement or maintainer account compromise.
Impact: low · Exploitability: unlikely
Developer action: Pin actions/checkout to a full commit SHA instead of the v4 tag.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:87
Expected scanner matches (0)
None.