Sync#357

Merged

ahmedfgad merged 4 commits into

github-actionsfrom

May 26, 2026

GitHub Advanced Security / Scorecard failed May 26, 2026 in 6s

12 new alerts including 2 high severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

2 high
10 medium

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 1 in .github/workflows/release.yml

Code scanning / Scorecard

Token-Permissions High

score is 0: no topLevel permission defined
Remediation tip: Visit https://app.stepsecurity.io/secureworkflow.
Tick the 'Restrict permissions for GITHUB_TOKEN'
Untick other options
NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead.
Click Remediation section below for further remediation help

Check failure on line 53 in .github/workflows/release.yml

Code scanning / Scorecard

Token-Permissions High

score is 0: jobLevel 'contents' permission set to 'write'
Remediation tip: Verify which permissions are needed and consider whether you can reduce them.
Click Remediation section below for further remediation help

Check warning on line 89 in .github/workflows/main.yml

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 0: pipCommand not pinned by hash
Click Remediation section below to solve this issue

Check warning on line 18 in .github/workflows/release.yml

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 0: GitHub-owned GitHubAction not pinned by hash
Remediation tip: update your workflow using https://app.stepsecurity.io
Click Remediation section below for further remediation help

Check warning on line 19 in .github/workflows/release.yml

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 0: GitHub-owned GitHubAction not pinned by hash
Remediation tip: update your workflow using https://app.stepsecurity.io
Click Remediation section below for further remediation help

Check warning on line 24 in .github/workflows/release.yml

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 0: pipCommand not pinned by hash
Click Remediation section below to solve this issue

Check warning on line 28 in .github/workflows/release.yml

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 0: pipCommand not pinned by hash
Click Remediation section below to solve this issue

Check warning on line 30 in .github/workflows/release.yml

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 0: GitHub-owned GitHubAction not pinned by hash
Remediation tip: update your workflow using https://app.stepsecurity.io
Click Remediation section below for further remediation help

Check warning on line 42 in .github/workflows/release.yml

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 0: GitHub-owned GitHubAction not pinned by hash
Remediation tip: update your workflow using https://app.stepsecurity.io
Click Remediation section below for further remediation help

Check warning on line 47 in .github/workflows/release.yml

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 0: third-party GitHubAction not pinned by hash
Remediation tip: update your workflow using https://app.stepsecurity.io
Click Remediation section below for further remediation help

Check warning on line 55 in .github/workflows/release.yml

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 0: GitHub-owned GitHubAction not pinned by hash
Remediation tip: update your workflow using https://app.stepsecurity.io
Click Remediation section below for further remediation help

Check warning on line 68 in publish.sh

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 0: pipCommand not pinned by hash
Click Remediation section below to solve this issue