Conversation
* Add getters to storage contracts * pre-commit
![semgrep-code-uniswap[bot]](https://avatars.githubusercontent.com/u/36115574?s=60&v=4){kind=small}
| env: | ||
| OLYMPIX_API_TOKEN: ${{ secrets.OLYMPIX_API_TOKEN }} | ||
| - name: Upload result to GitHub Code Scanning | ||
| uses: github/codeql-action/upload-sarif@v3 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
First step in each job must use bullfrogsec/bullfrog, unless the job is on macOS.
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by gh-actions-first-step-must-be-bullfrogsec.
You can view more details about this finding in the Semgrep AppSec Platform.
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Run Olympix Integrated Security | ||
| uses: olympix/integrated-security@main |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
First step in each job must use bullfrogsec/bullfrog, unless the job is on macOS.
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by gh-actions-first-step-must-be-bullfrogsec.
You can view more details about this finding in the Semgrep AppSec Platform.
| security: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
First step in each job must use bullfrogsec/bullfrog, unless the job is on macOS.
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by gh-actions-first-step-must-be-bullfrogsec.
You can view more details about this finding in the Semgrep AppSec Platform.
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Run Olympix Integrated Security | ||
| uses: olympix/integrated-security@main |
There was a problem hiding this comment.
Semgrep identified a blocking 🔴 issue in your code:
An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. Github, foundry, and uniswap made github actions are exempt.
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by third-party-action-not-pinned-to-commit-sha-foundry-allowed.
You can view more details about this finding in the Semgrep AppSec Platform.
1 participant
No description provided.