Bump WuMing to 0.12.0 and floor review findings at medium severity #19

agent-pi · 2026-10-16T23:33:00Z

agent-pi commented

2026-10-16 23:33:00 +00:00

The pr-review job now tracks WuMing 0.12.0 and sets WUMING_MIN_SEVERITY: medium, so only medium-and-above findings are posted as inline review comments.

The severity floor is set via a step-level env: block because 0.12.0 still has no min_severity action input (verified against action.yml at ref 0.12.0 on the forge).

Closes #18

The `pr-review` job now tracks WuMing 0.12.0 and sets `WUMING_MIN_SEVERITY: medium`, so only medium-and-above findings are posted as inline review comments. The severity floor is set via a step-level `env:` block because 0.12.0 still has no `min_severity` action input (verified against `action.yml` at ref `0.12.0` on the forge). Closes #18

agent-pi added 1 commit

2026-10-16 23:33:01 +00:00

👷 ci: bump wuming to 0.12.0 and floor findings at medium severity

/ gitleaks (pull_request) Successful in 15s

Details

/ pr-review (pull_request) Successful in 52s

Details

/ checks (pull_request) Successful in 3m24s

Details

/ deploy-docs (pull_request) Has been skipped

Details

/ container (pull_request) Successful in 1m57s

Details

/ publish-container (pull_request) Successful in 2m39s

Details

e3c1df0ff2

forgejo-actions reviewed

2026-10-16 23:33:46 +00:00

forgejo-actions left a comment

WuMing

Found 1 issue(s). See inline comments below.

## WuMing Found **1** issue(s). See inline comments below.

.forgejo/workflows/ci.yml

					
				@ -18,3 +18,3 @@

				    if: github.event_name == 'pull_request'

				    steps:

				      - uses: https://forge.marvin8.zone/marvin8/wuming@0.11.0

				      - uses: https://forge.marvin8.zone/marvin8/wuming@0.12.0

security [HIGH]

Use of mutable version tag for third-party action violates supply chain integrity. Pin to a commit hash to prevent tampering and ensure reproducible builds. (A08: Software and Data Integrity Failures)

**security** [HIGH] Use of mutable version tag for third-party action violates supply chain integrity. Pin to a commit hash to prevent tampering and ensure reproducible builds. (A08: Software and Data Integrity Failures)

marvin8 marked this conversation as resolved

agent-pi commented

2026-10-16 23:42:29 +00:00

.forgejo/workflows/ci.yml line 20

security [HIGH]

🔴 Declined — version-tag pinning of marvin8/wuming is a deliberate fleet-wide decision (standing precedent from the Oct 2026 OpenRouter migration, declined identically on the rainlog/zaojun/feed2fedi PRs): wuming is a first-party action on the same forge, owned by the same account as this repo, so the A08 tag-tampering threat model would require an account compromise that owns this repository anyway. The rest of the workflow (actions/checkout@v4, astral-sh/setup-uv@v5) follows the same convention.

[`.forgejo/workflows/ci.yml` line 20](https://forge.marvin8.zone/marvin8/xique/pulls/19#issuecomment-5710) > **security** [HIGH] 🔴 Declined — version-tag pinning of `marvin8/wuming` is a deliberate fleet-wide decision (standing precedent from the Oct 2026 OpenRouter migration, declined identically on the rainlog/zaojun/feed2fedi PRs): wuming is a first-party action on the same forge, owned by the same account as this repo, so the A08 tag-tampering threat model would require an account compromise that owns this repository anyway. The rest of the workflow (`actions/checkout@v4`, `astral-sh/setup-uv@v5`) follows the same convention.

marvin8 approved these changes

2026-10-17 00:09:58 +00:00

marvin8 manually merged commit 18cae07709 into main

2026-10-17 00:10:25 +00:00

Sign in to join this conversation.

No reviewers