Skip to content

Conversation

eskirk
Copy link
Collaborator

@eskirk eskirk commented Sep 30, 2025

"importance" fits our internal representation of user actions better than "severity" - so I am deprecating the "severity" parameter in favor of "importance".

@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

@github-actions
Copy link

😢 zizmor failed with exit code 14.

Expand for full output
error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/release.yml:22:9
   |
 3 | / on:
 4 | |   push:
 5 | |     tags:
 6 | |       - '*'
   | |___________- generally used when publishing artifacts generated at runtime
...
22 |           uses: actions/setup-node@v5
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
   |
   = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/release.yml:72:9
   |
 3 | / on:
 4 | |   push:
 5 | |     tags:
 6 | |       - '*'
   | |___________- generally used when publishing artifacts generated at runtime
...
72 | /         with:
73 | |           node-version: 'lts/*'
74 | |           cache: 'none'
   | |_______________________^ opt-in for caching here
   |
   = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/release.yml:111:9
    |
  3 | / on:
  4 | |   push:
  5 | |     tags:
  6 | |       - '*'
    | |___________- generally used when publishing artifacts generated at runtime
...
111 |           uses: actions/setup-node@v5
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
    |
    = note: audit confidence → Low

19 findings (16 suppressed): 0 informational, 0 low, 0 medium, 3 high

Copy link
Collaborator

@codecapitano codecapitano left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@eskirk can we change a UserActionImportance enum to a constant.
E. g. like const userActionImportance: 'critical' | 'normal'?

This makes it much easier to use then forcing users to always use the enum.
Atm you cant't do something like the below without getting linter errors because you can't compare string value with enum.

startUserAction('foo', undefined, { severity: 'critical' });

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants