There are some pipeline issues detected in this pull request, either in the latest commit or in historical code commits belonging to this pull-request.
Legit Pipeline Scanning is a unique scanner by Legit that inspects pipeline automation, CI/CD and config-as-code files and finds risky behaviors and patterns that put the organization at risk of supply-chain attack, data leakage or reliability issues.

Pipeline finding examples

1. Using a mutable image - using a job that references an image that might be changed and susceptible to supply chain attacks. Any new changes to the image are automatically executed and can lead to a malicious actor taking over the pipeline. To safely reference the remote job - use a commit SHA notation.

2. Downloading an external resource without verification - A build action downloads an external resource, which might be susceptible to supply chain attacks. 3rd party binaries that are downloaded should go through a checksum verification against the upstream published value to make sure they were not tampered with. In case checksum is unavailable, it is strongly recommended that you consume a static binary from your own registry.

Ignoring a finding

Ignoring a specific alert

If a specific finding is irrelevant, you can add the instance identifier, provided in the annotation, to a.legitignore file at the root directory of your repository. The instance identifier refers to a specific occurrence of the finding, and therefore any other occurrences will still be alerted.
Alternatively, you can add a comment at the end of the relevant line:

legit:ignore-pipeline will prevent the pipeline scanner from scanning this line

curl -fsSL https://example.com/myfile.sh | bash # legit:ignore-pipeline

legit:ignore will prevent all scanners from scanning this line, in case you’re using another scanner such as Legit Secret Scanning

curl -fsSL https://example.com/myfile.sh | bash # legit:ignore

Ignoring a pipeline finding value

If you decide that the value was not relevant or incorrect for the whole repository, add the value identifier provided in the annotation of the finding to .legitignore.

Ignoring alerts from a specific path

In addition, there is an option to completely ignore pipeline findings in a specified path by adding a glob pattern to .legitignore.

.legitignore examples

value_image_ubuntu:latest  # The value ubuntu:latest for images will be ignored throughout the repository

value_url_https://google.com  # The value https://google.com for URLS will be ignored throughout the repository

instance_26229E2D5F8C5B061587C1628F5608E9  # This specific instance of the pipeline finding will be ignored

tests/**  # Ignore everything in the tests directory

other/tests/**:pipeline  # Ignore all pipeline finding in the other/tests directory

config/test_config.json  # Ignore pipeline findings in a specific file