Merging to release-5.10: Gromit sync with tyk repo TT-16131 (#7542) #7551
probelabs / Visor: security
succeeded
Nov 19, 2025 in 4m 52s
✅ Check Passed (Warnings Found)
security check passed. Found 1 warning, but fail_if condition was not met.
Details
📊 Summary
- Total Issues: 1
- Warning Issues: 1
Issues by Category
Security (1)
⚠️ .github/workflows/release.yml:491 - The upgrade test workflow pipes a script frompackagecloud.iodirectly tobash. Thiscurl | bashpattern introduces a supply chain risk. If thepackagecloud.iorepository or the connection to it is compromised, arbitrary code could be executed within the CI runner. While this is in a test environment, it's a practice that should be avoided.
Powered by Visor from Probelabs
💡 TIP: You can chat with Visor using /visor ask <your question>
Annotations
Check warning on line 492 in .github/workflows/release.yml
probelabs / Visor: security
security Issue
The upgrade test workflow pipes a script from `packagecloud.io` directly to `bash`. This `curl | bash` pattern introduces a supply chain risk. If the `packagecloud.io` repository or the connection to it is compromised, arbitrary code could be executed within the CI runner. While this is in a test environment, it's a practice that should be avoided.
Raw output
Download the script, verify its integrity (e.g., via a checksum), and then execute it. This prevents execution of a tampered script. For example: `curl -fsSL -o script.deb.sh ... && sha256sum -c script.sha256 && bash script.deb.sh`.
Loading