TavernKeeper Scan Report

N0819/Sonder_Engine

Commit bfd68cd Reviewed

No material or high-risk concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 high 0 material 10 low

What this review found

No material or high-risk item was identified.

Minor cautions

zizmor reported unpinned-uses

Minor caution · high confidence

The CI uses a standard GitHub action but pins it to a version label instead of an exact code snapshot. If someone were able to move that label, they could change what runs. Pinning to a specific commit hash would be safer.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The workflow references actions/checkout at a major-version tag rather than a full commit SHA. This is an official GitHub action and the workflow runs on push and pull_request with contents:read permissions, so the practical exposure is limited to the theoretical risk of a tag being moved or a maintainer account being compromised. SHA-pinning would remove that residual risk.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/checkout to a full commit SHA instead of the v4 tag.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/ci.yml:24

zizmor reported artipacked

Minor caution · medium confidence

This is a secondary flag tied to the same unpinned action. No artifact upload or credential handling is visible in this workflow, so the practical risk is low and overlaps with the version-pinning issue.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked in this repository.

Contextual assessment: The artipacked finding is associated with the unpinned actions/checkout reference. The workflow does not upload artifacts and uses a read-only permission scope, so there is no concrete credential-persistence path shown. The underlying concern reduces to the unpinned action reference already covered by the unpinned-uses candidate.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/checkout to a full commit SHA; no separate artifact handling change is needed based on the supplied evidence.

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/ci.yml:24

zizmor reported unpinned-uses

Minor caution · high confidence

Another job in the same CI file uses the same version-label pinning for the checkout action. The fix is the same: pin to an exact commit hash.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The pydantic1 job references actions/checkout at the v4 major-version tag rather than a SHA. Same official action and same restricted permissions as the fast job; the residual risk is tag movement or account compromise, not a concrete data flow shown here.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/checkout to a full commit SHA instead of the v4 tag.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/ci.yml:56

zizmor reported artipacked

Minor caution · medium confidence

This is another secondary flag tied to the unpinned checkout action. No artifact or credential handling is visible, so the practical risk is low and overlaps with the pinning issue.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked in this repository.

Contextual assessment: The artipacked finding is associated with the unpinned actions/checkout reference in the pydantic1 job. No artifact upload or secret usage is visible in that job, so the credential-persistence concern does not correspond to a concrete flow in the supplied source.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/checkout to a full commit SHA; no separate artifact handling change is needed based on the supplied evidence.

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/ci.yml:56

zizmor reported unpinned-uses

Minor caution · high confidence

The Python setup action is pinned to a version label instead of an exact commit. Pinning to a hash would be safer.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The fast job references actions/setup-python at the v5 major-version tag rather than a SHA. This is an official GitHub action and the job uses read-only permissions, so the residual risk is limited to tag movement or maintainer account compromise.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/setup-python to a full commit SHA instead of the v5 tag.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/ci.yml:25

zizmor reported unpinned-uses

Minor caution · high confidence

Another job uses the same version-label pinning for the Python setup action. Pin to an exact commit hash to remove the residual risk.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The pydantic1 job references actions/setup-python at the v5 major-version tag rather than a SHA. Same official action and restricted permissions as elsewhere; residual risk is tag movement or account compromise.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/setup-python to a full commit SHA instead of the v5 tag.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/ci.yml:57

zizmor reported unpinned-uses

Minor caution · high confidence

The automated test setup uses a standard shorthand reference to a well-known GitHub helper tool instead of locking it to an exact version. This is normal practice and not dangerous, though stricter projects sometimes lock to an exact version for extra safety.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The flagged line references a first-party GitHub action using a major-version tag rather than a full commit SHA. This is the conventional, widely-used pinning style for official actions in CI workflows. It does not introduce a supply-chain backdoor, credential exfiltration, or malicious execution path. The residual risk is that a compromised tag could move to a malicious commit, but this is a general CI hardening concern, not evidence of malicious intent or a material vulnerability in this project.

Impact: low · Exploitability: unlikely

Developer action: Pin first-party actions to a full commit SHA with a verification comment if stricter supply-chain hardening is desired; otherwise no change is required.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/ci.yml:88

zizmor reported artipacked

Minor caution · medium confidence

This is a secondary flag tied to the unpinned checkout action in the browser job. No artifact or credential handling is visible, so the practical risk is low and overlaps with the pinning issue.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked in this repository.

Contextual assessment: The artipacked finding is associated with the unpinned actions/checkout reference in the browser job. No artifact upload or secret usage is visible in that job, so the credential-persistence concern does not correspond to a concrete flow in the supplied source.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/checkout to a full commit SHA; no separate artifact handling change is needed based on the supplied evidence.

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/ci.yml:87

zizmor reported unpinned-uses

Minor caution · high confidence

The browser job uses the same version-label pinning for the checkout action. Pin to an exact commit hash to remove the residual risk.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The browser job references actions/checkout at the v4 major-version tag rather than a SHA. This is an official GitHub action and the job uses read-only permissions, so the residual risk is limited to tag movement or maintainer account compromise.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/checkout to a full commit SHA instead of the v4 tag.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/ci.yml:87
Expected scanner matches (0)

None.

Related contextual observations

actions/setup-python unpinned in browser job

low risk · high confidence

The browser job also pins the Python setup action to a version label. Pin it to an exact commit hash for consistency.

Technical assessment

The browser job at line 88 references actions/setup-python@v5 without a SHA pin, consistent with the other jobs. The same minor weakness and same remediation apply.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/setup-python to a full commit SHA instead of the v5 tag.

Sources:

Coverage and limitations

Tools

Limitations

Technical scan identity