scorecard Feature: support wildcard in dangerous workflow

Feature: support wildcard in dangerous workflow

Open laurentsimon opened this issue 3 years ago • 3 comments

Interesting problem scorecard would not catch:

github.event.pull_request.labels.*.name

See https://github.com/google/GoogleSignIn-iOS/blob/main/.github/workflows/pr_notification.yml#L55-L70

Sep 08 '22 00:09 laurentsimon

Stale issue message - this issue will be closed in 7 days

Sep 21 '23 01:09 github-actions[bot]

This issue is stale because it has been open for 60 days with no activity.

Nov 20 '23 01:11 github-actions[bot]

This issue has been marked stale because it has been open for 60 days with no activity.

May 03 '24 01:05 github-actions[bot]