Jefffrey opened a new issue, #12229: URL: https://github.com/apache/arrow-rs/issues/12229
For each of the below findings, investigate to see if there is an easy/safe remediation for them. If there is no easy remediation (the remediation is far too complex), AND we are certain they are safe usages, we can place an ignore. - https://docs.zizmor.sh/usage/#ignoring-results ## Findings https://github.com/apache/arrow-rs/blob/4ea4d225e4312f968e8cc9ab3922aa460ac377e6/.github/actions/setup-rustup/action.yaml#L13-L15 - dangerous use of environment file: write to GITHUB_PATH may allow code execution - https://docs.zizmor.sh/audits/#github-env https://github.com/apache/arrow-rs/blob/4ea4d225e4312f968e8cc9ab3922aa460ac377e6/.github/workflows/take.yml#L6-L8 - use of fundamentally insecure workflow trigger: issue_comment is almost always used insecurely - https://docs.zizmor.sh/audits/#dangerous-triggers https://github.com/apache/arrow-rs/blob/4ea4d225e4312f968e8cc9ab3922aa460ac377e6/.github/workflows/fork_ci_status.yml#L15-L21 - use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely - https://docs.zizmor.sh/audits/#dangerous-triggers https://github.com/apache/arrow-rs/blob/4ea4d225e4312f968e8cc9ab3922aa460ac377e6/.github/workflows/dev_pr.yml#L11-L14 - use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely - https://docs.zizmor.sh/audits/#dangerous-triggers -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
