• .github/actions/setup-deno-with-cache/action.yml: Language not supported

.github/workflows/ci.yml (1)

27-27: 💡 Codebase verification

Pin the action to a specific commit hash for better security and reproducibility

The remote action exists and is actively maintained, but using @main remains a security concern. The action's implementation shows it's using pinned versions for its dependencies (e.g., denoland/setup-deno is pinned to 4606d5c).

Recommended changes:

• Replace @main with @ce26794a02408b9ae3334fd6f3e75d86a9f40456 (current commit hash of action.yml)
• Add a comment linking to https://github.com/5ouma/utils/tree/main/setup-deno-with-cache

🔗 Analysis chain

Consider using a specific commit hash instead of @main

While moving to a shared action reduces redundancy, using the @main reference could lead to unexpected behavior if the remote action is updated. Consider:

1. Pin to a specific commit hash for better reproducibility and security
2. Verify the action's availability and maintenance status

Let's verify the remote action's existence and ownership:

Consider:

1. Forking the action to your organization for better control
2. Using a specific version tag or commit hash instead of @main
3. Adding a comment linking to the action's documentation

Also applies to: 44-44, 58-58, 72-72, 97-97

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify the remote action repository and its contents

# Check if the repository exists and is accessible
gh repo view 5ouma/utils

# Check if the action.yml exists in the expected path
gh api repos/5ouma/utils/contents/setup-deno-with-cache/action.yml

Length of output: 2955

.github/workflows/ci.yml (2)

27-27: 💡 Codebase verification

Consider using the official denoland/setup-deno action

The workflow only uses standard Deno commands (lint, fmt, check, doc, publish) without any special setup requirements. The official denoland/setup-deno action with caching would be more reliable and maintainable than a custom action from a personal repository:

- uses: denoland/setup-deno@v1
  with:
    deno-version: v1.x
    cache: true

• The official action provides the same functionality while being actively maintained by the Deno team
• It has built-in caching support and is widely used by the community
• Eliminates dependency on an external personal repository

🔗 Analysis chain

Consider maintaining the setup action in this repository

Moving from a local action to an external repository introduces several operational risks:

1. External repository availability becomes a critical dependency
2. Limited visibility and control over the setup process
3. Potential maintenance and debugging challenges

Consider either:

1. Keep the setup action in this repository for better control and visibility
2. Use official Deno setup action (denoland/setup-deno) with caching configuration

Let's check if the official Deno action might be a better alternative:

Also applies to: 44-44, 58-58, 72-72, 97-97

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Compare our setup requirements with official Deno action capabilities

# Check if we have any special Deno setup requirements in our configuration
rg -l 'deno\s+install|deno\s+upgrade|deno\s+cache' .

Length of output: 54

---

Script:

#!/bin/bash
# Let's check the current workflow file to understand Deno usage patterns
cat .github/workflows/ci.yml

# Also check if there are any other workflow files using Deno
fd -e yml -e yaml . .github/workflows/ --exec cat {}

Length of output: 6688

---

27-27: 💡 Codebase verification

⚠️ Potential issue

Critical: Action from unverified source with unpinned version requires immediate attention

The verification confirms critical security concerns:

1. The action 5ouma/utils/setup-deno-with-cache is from a personal repository, not a verified source
2. Using @main reference allows the action to change without notice
3. The repository is public but lacks proper version tagging and security measures

• All instances in .github/workflows/ci.yml (lines 27, 44, 58, 72, 97) should be replaced with either:
  • A verified alternative like denoland/setup-deno@v1 with proper version pinning
  • Or at minimum, a specific commit SHA of the current action if it must be used

🔗 Analysis chain

Critical: Pin the setup action to a specific commit SHA

Using @main for the setup action poses several risks:

1. The action can change without notice, potentially breaking the CI
2. Security vulnerability as malicious code could be introduced
3. No ability to track changes or rollback to known working versions

Replace all occurrences of uses: 5ouma/utils/setup-deno-with-cache@main with a specific commit SHA:

-uses: 5ouma/utils/setup-deno-with-cache@main
+uses: 5ouma/utils/setup-deno-with-cache@{specific-commit-sha}

Let's verify if other workflows in the repository follow proper action versioning:

Also applies to: 44-44, 58-58, 72-72, 97-97

---

Let me gather more information about the specific action being used to provide a comprehensive verification.

---

Let me check if this action exists in a public repository and gather more information about it.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Check for potentially unsafe action references in workflow files
# Look for patterns that indicate non-pinned versions (@main, @master, @v1, etc.)

echo "Checking for non-pinned action versions in workflow files..."
rg -l '@(main|master|v\d+|latest)' .github/workflows/

Length of output: 211

---

Script:

#!/bin/bash
# Check the content of ci.yml to understand the full context
cat .github/workflows/ci.yml

Length of output: 2485

---

Script:

#!/bin/bash
# Check if the repository exists and is public
gh repo view 5ouma/utils 2>&1 || echo "Repository not found or private"

Length of output: 1288