agents: block all stdlib modules in agent-config code-refs (denylist bypass via cProfile.run/timeit) · google/adk-python@23dc400

Process completed with exit code 1.

Evaluate mandatory checks: .github/workflows/release-cherry-pick.yml#L50

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Evaluate mandatory checks: .github/workflows/release-cherry-pick.yml#L70

code injection via template expansion: may expand into attacker-controllable code

Evaluate mandatory checks: .github/workflows/release-cherry-pick.yml#L62

code injection via template expansion: may expand into attacker-controllable code

Evaluate mandatory checks: .github/workflows/copybara-pr-handler.yml#L43

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Found 4 findings for mandatory checks that must always succeed.

release-cherry-pick.yml:50: unpinned action reference: action is not pinned to a hash (required by blanket policy)

copybara-pr-handler.yml:43: unpinned action reference: action is not pinned to a hash (required by blanket policy)

release-cherry-pick.yml:36: overly broad permissions: default permissions used due to no permissions: block

Navigation Menu