Skip to content

[releng master] gromit: sync templates - #1072

Open
probelabs[bot] wants to merge 1 commit into
masterfrom
releng/master
Open

[releng master] gromit: sync templates#1072
probelabs[bot] wants to merge 1 commit into
masterfrom
releng/master

Auto generated from templates by gromit

3f1eaf5
Select commit
Loading
Failed to load commit list.
probelabs / Visor: architecture failed Aug 11, 2026 in 25s

🚨 Check Failed

architecture check failed because fail_if condition was met.

Details

📊 Summary

  • Total Issues: 2
  • Error Issues: 2

🔍 Failure Condition Results

Failed Conditions

  • global_fail_if: output.issues && output.issues.some(i => i.severity === 'critical' || i.severity === 'error')
    • Severity: ❌ error

Issues by Category

Architecture (1)

  • ❌ .github/workflows/zizmor.yml:12 - The reusable workflow TykTechnologies/github-actions/.github/workflows/zizmor.yml is referenced using a mutable tag (@production) instead of an immutable commit SHA. This creates a supply-chain security risk. If the source repository is compromised, the production tag could be moved to a malicious commit, which would then be executed by this workflow, compromising the CI/CD pipeline.

Logic (1)

  • ❌ system:0 - Global failure condition met: output.issues && output.issues.some(i => i.severity === 'critical' || i.severity === 'error')

Powered by Visor from Probelabs

💡 TIP: You can chat with Visor using /visor ask <your question>

Annotations

Check failure on line 12 in .github/workflows/zizmor.yml

See this annotation in the file changed.

@probelabs probelabs / Visor: architecture

architecture Issue 

The reusable workflow `TykTechnologies/github-actions/.github/workflows/zizmor.yml` is referenced using a mutable tag (`@production`) instead of an immutable commit SHA. This creates a supply-chain security risk. If the source repository is compromised, the `production` tag could be moved to a malicious commit, which would then be executed by this workflow, compromising the CI/CD pipeline.
Raw output 
For improved security and build reproducibility, pin the reusable workflow to a specific commit SHA instead of a branch or tag. Find a specific commit hash from the `production` branch of the `TykTechnologies/github-actions` repository and replace `@production` with it (e.g., `@a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2`). While the accompanying `zizmor.yml` configuration explicitly allows this for first-party actions, this policy represents an architectural decision that accepts a significant security risk.
View more details on probelabs