Skip to content

[TT-16950] fix: sync security hardening from release-5.12 (#7956) #8070

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
buger merged 1 commit into from
Apr 17, 2026

fix: sync security hardening from release-5.12 (#7956)

c07c32a
Select commit
Loading
Failed to load commit list.
Merged

[TT-16950] fix: sync security hardening from release-5.12 (#7956) #8070

fix: sync security hardening from release-5.12 (#7956)
c07c32a
Select commit
Loading
Failed to load commit list.
probelabs / Visor: architecture succeeded Apr 17, 2026 in 1m 3s

✅ Check Passed (Warnings Found)

architecture check passed. Found 4 warnings, but fail_if condition was not met.

Details

📊 Summary

  • Total Issues: 4
  • Warning Issues: 4

🔍 Failure Condition Results

Passed Conditions

  • global_fail_if: Condition passed

Issues by Category

Architecture (4)

  • ⚠️ .github/workflows/ci-tests.yml:12 - The workflow is configured to trigger on the labeled event for pull requests. This will cause the entire workflow, including the full test suite, to re-run every time a label is added or removed. This is often unnecessary and can lead to wasted CI resources and increased wait times for developers.
  • ⚠️ .github/workflows/codeql-analysis.yml:11 - The workflow is configured to trigger on the labeled event for pull requests. This will cause the entire CodeQL analysis to re-run every time a label is added or removed from a pull request. This is often unnecessary and can lead to wasted CI resources and longer wait times for developers.
  • ⚠️ .github/workflows/lint-swagger.yml:7 - The workflow is configured to trigger on the labeled event for pull requests. This will cause the swagger linting and diffing to re-run every time a label is added or removed from a pull request. While less expensive than a full test run, it is still often unnecessary and can lead to wasted CI resources.
  • ⚠️ .github/workflows/plugin-compiler-build.yml:5 - The workflow is configured to trigger on the labeled event for pull requests. This will cause the plugin compiler docker images to be rebuilt every time a label is added or removed from a pull request. This is often unnecessary and can lead to wasted CI resources and longer wait times for developers.

Powered by Visor from Probelabs

💡 TIP: You can chat with Visor using /visor ask <your question>

Annotations

Check warning on line 16 in .github/workflows/ci-tests.yml

See this annotation in the file changed.

@probelabs probelabs / Visor: architecture

architecture Issue 

The workflow is configured to trigger on the `labeled` event for pull requests. This will cause the entire workflow, including the full test suite, to re-run every time a label is added or removed. This is often unnecessary and can lead to wasted CI resources and increased wait times for developers.
Raw output 
Unless there is a specific reason to run this workflow on label changes, consider removing `labeled` from the list of pull request types. CI workflows should typically run on code changes (e.g., `synchronize`, `opened`, `reopened`).

Check warning on line 16 in .github/workflows/codeql-analysis.yml

See this annotation in the file changed.

@probelabs probelabs / Visor: architecture

architecture Issue 

The workflow is configured to trigger on the `labeled` event for pull requests. This will cause the entire CodeQL analysis to re-run every time a label is added or removed from a pull request. This is often unnecessary and can lead to wasted CI resources and longer wait times for developers.
Raw output 
Unless there is a specific reason to run this workflow on label changes, consider removing `labeled` from the list of pull request types. CI workflows should typically run on code changes (e.g., `synchronize`, `opened`, `reopened`).

Check warning on line 12 in .github/workflows/lint-swagger.yml

See this annotation in the file changed.

@probelabs probelabs / Visor: architecture

architecture Issue 

The workflow is configured to trigger on the `labeled` event for pull requests. This will cause the swagger linting and diffing to re-run every time a label is added or removed from a pull request. While less expensive than a full test run, it is still often unnecessary and can lead to wasted CI resources.
Raw output 
Unless there is a specific reason to run this workflow on label changes, consider removing `labeled` from the list of pull request types. CI workflows should typically run on code changes (e.g., `synchronize`, `opened`, `reopened`).

Check warning on line 10 in .github/workflows/plugin-compiler-build.yml

See this annotation in the file changed.

@probelabs probelabs / Visor: architecture

architecture Issue 

The workflow is configured to trigger on the `labeled` event for pull requests. This will cause the plugin compiler docker images to be rebuilt every time a label is added or removed from a pull request. This is often unnecessary and can lead to wasted CI resources and longer wait times for developers.
Raw output 
Unless there is a specific reason to run this workflow on label changes, consider removing `labeled` from the list of pull request types. CI workflows should typically run on code changes (e.g., `synchronize`, `opened`, `reopened`).
View more details on probelabs