Skip to content

[seed d59a89] Evaluation change; do not merge #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sshiv012 wants to merge 1 commit into
base: coderabbit-eval/base
Choose a base branch
from
Open

[seed d59a89] Evaluation change; do not merge #21

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,7 +228,7 @@ jobs:
env:
PGPASSWORD: postgres
- name: Setup sbt launcher
uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2
uses: sbt/setup-sbt@main

@coderabbitai coderabbitai Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' 'Changed and pinned setup-sbt references:'
rg -n --glob '.github/workflows/*.yml' 'uses:\s*sbt/setup-sbt@' .github/workflows

printf '%s\n' 'Resolving v1.5.2 and validating the proposed commit:'
if command -v gh >/dev/null 2>&1; then
  gh api repos/sbt/setup-sbt/git/ref/tags/v1.5.2 --jq '{type:.object.type, sha:.object.sha}'
  gh api repos/sbt/setup-sbt/commits/6444f4c8111de4b9059c3975def104b03cfaa5f0 --jq '.sha'
else
  curl -fsSL https://api.github.com/repos/sbt/setup-sbt/git/ref/tags/v1.5.2 |
    python3 -c 'import json,sys; d=json.load(sys.stdin); print(json.dumps({"type":d["object"]["type"],"sha":d["object"]["sha"]}))'
  curl -fsSL https://api.github.com/repos/sbt/setup-sbt/commits/6444f4c8111de4b9059c3975def104b03cfaa5f0 |
    python3 -c 'import json,sys; print(json.load(sys.stdin)["sha"])'
fi

Repository: sshiv012/texera

Length of output: 1225

🏁 Script executed:

#!/bin/bash
set -eu

tag_object='b99bf383b9fc20d08dd484624b494f21ea4c1402'
proposed='6444f4c8111de4b9059c3975def104b03cfaa5f0'

if command -v gh >/dev/null 2>&1; then
  printf '%s\n' 'Dereferenced v1.5.2 commit:'
  gh api "repos/sbt/setup-sbt/git/tags/${tag_object}" --jq '{type:.object.type, sha:.object.sha}'
  printf '%s\n' 'Proposed commit:'
  gh api "repos/sbt/setup-sbt/commits/${proposed}" --jq '.sha'
else
  printf '%s\n' 'Dereferenced v1.5.2 commit:'
  curl -fsSL "https://api.github.com/repos/sbt/setup-sbt/git/tags/${tag_object}" |
    python3 -c 'import json,sys; d=json.load(sys.stdin); print(json.dumps({"type":d["object"]["type"],"sha":d["object"]["sha"]}))'
  printf '%s\n' 'Proposed commit:'
  curl -fsSL "https://api.github.com/repos/sbt/setup-sbt/commits/${proposed}" |
    python3 -c 'import json,sys; print(json.load(sys.stdin)["sha"])'
fi

Repository: sshiv012/texera

Length of output: 306

Security Misconfiguration (CWE-494): Download of Code Without Integrity Check

Reachability: External

Keep sbt/setup-sbt pinned to an immutable commit.

@main allows upstream changes to execute code on the GitHub runner and removes build reproducibility. Restore commit 6444f4c8111de4b9059c3975def104b03cfaa5f0 in all four jobs.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build.yml at line 231, Update every sbt/setup-sbt action
reference in the four workflow jobs to use the immutable commit
6444f4c8111de4b9059c3975def104b03cfaa5f0 instead of `@main`, preserving the
existing job steps and configuration.

- uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1
with:
extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]'
Expand Down Expand Up @@ -478,7 +478,7 @@ jobs:
env:
PGPASSWORD: postgres
- name: Setup sbt launcher
uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2
uses: sbt/setup-sbt@main
- uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1
with:
extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]'
Expand Down Expand Up @@ -785,7 +785,7 @@ jobs:
distribution: "temurin"
java-version: 17
- name: Setup sbt launcher
uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2
uses: sbt/setup-sbt@main
- uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1
with:
extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]'
Expand Down Expand Up @@ -940,7 +940,7 @@ jobs:
distribution: "temurin"
java-version: 17
- name: Setup sbt launcher
uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2
uses: sbt/setup-sbt@main
- uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1
with:
extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]'
Expand Down