[plumber-agent]

Plumber checks the CI configuration of this repository against a supply-chain trust policy: how actions are pinned, what a token may do, and what a workflow may reach. It scanned mlco2/codecarbon when it was installed, and this pull request is what it found. Every value below comes from that one scan.

This pull request adds the default policy as .plumber.yaml.

Progress

• ✅ Policy and workflow added
• ✅ Scan
• ✅ Remediation

Findings

Score: C (70/100)

3 medium, 15 low

• ISSUE-713 x3: Action comes from an unauthorized source
• ISSUE-307 x15: Checkout persists credentials in .git/config (latent)

All 18 findings

Code	Severity	File	Job	Line	Title
ISSUE-713	medium	.github/workflows/pr-labeler.yml	pr-labeler/size-label	-	Action comes from an unauthorized source
ISSUE-713	medium	.github/workflows/pre-commit.yml	pre-commit/pre-commit	-	Action comes from an unauthorized source
ISSUE-713	medium	.github/workflows/release-drafter.yml	release-drafter/update_release_draft	-	Action comes from an unauthorized source
ISSUE-307	low	.github/workflows/build-docs.yml	build-docs/build	-	Checkout persists credentials in .git/config (latent)
ISSUE-307	low	.github/workflows/build-server.yml	build-server/build_server	-	Checkout persists credentials in .git/config (latent)
ISSUE-307	low	.github/workflows/build-server.yml	build-server/test_api_server	-	Checkout persists credentials in .git/config (latent)
ISSUE-307	low	.github/workflows/build-ui.yml	build-ui/build-ui	-	Checkout persists credentials in .git/config (latent)
ISSUE-307	low	.github/workflows/build-ui.yml	build-ui/e2e-ui	-	Checkout persists credentials in .git/config (latent)
ISSUE-307	low	.github/workflows/codeql.yml	codeql/analyze	-	Checkout persists credentials in .git/config (latent)
ISSUE-307	low	.github/workflows/deploy-docs.yml	deploy-docs/deploy	-	Checkout persists credentials in .git/config (latent)
ISSUE-307	low	.github/workflows/deploy-staging.yml	deploy-staging/staging	-	Checkout persists credentials in .git/config (latent)
ISSUE-307	low	.github/workflows/deploy.yml	deploy/production	-	Checkout persists credentials in .git/config (latent)
ISSUE-307	low	.github/workflows/package-validation-reusable.yml	package-validation-reusable/build-package	-	Checkout persists credentials in .git/config (latent)
ISSUE-307	low	.github/workflows/package-validation-reusable.yml	package-validation-reusable/test-package-from-wheel	-	Checkout persists credentials in .git/config (latent)
ISSUE-307	low	.github/workflows/pre-commit.yml	pre-commit/pre-commit	-	Checkout persists credentials in .git/config (latent)
ISSUE-307	low	.github/workflows/release-drafter.yml	release-drafter/update_release_draft	-	Checkout persists credentials in .git/config (latent)
ISSUE-307	low	.github/workflows/test-api-requirements.yml	test-api-requirements/pip-install-api-requirements	-	Checkout persists credentials in .git/config (latent)
ISSUE-307	low	.github/workflows/test-package.yml	test-package/python-test	-	Checkout persists credentials in .git/config (latent)

Solved by the agent

Score after remediation: B (85/100)

The agent repaired 15 findings: ISSUE-307 x15.

Details

• ISSUE-307 in .github/workflows/build-docs.yml, job build-docs/build
• ISSUE-307 in .github/workflows/build-server.yml, job build-server/build_server
• ISSUE-307 in .github/workflows/build-server.yml, job build-server/test_api_server
• ISSUE-307 in .github/workflows/build-ui.yml, job build-ui/build-ui
• ISSUE-307 in .github/workflows/build-ui.yml, job build-ui/e2e-ui
• ISSUE-307 in .github/workflows/codeql.yml, job codeql/analyze
• ISSUE-307 in .github/workflows/deploy-docs.yml, job deploy-docs/deploy
• ISSUE-307 in .github/workflows/deploy-staging.yml, job deploy-staging/staging
• ISSUE-307 in .github/workflows/deploy.yml, job deploy/production
• ISSUE-307 in .github/workflows/package-validation-reusable.yml, job package-validation-reusable/build-package
• ISSUE-307 in .github/workflows/package-validation-reusable.yml, job package-validation-reusable/test-package-from-wheel
• ISSUE-307 in .github/workflows/pre-commit.yml, job pre-commit/pre-commit
• ISSUE-307 in .github/workflows/release-drafter.yml, job release-drafter/update_release_draft
• ISSUE-307 in .github/workflows/test-api-requirements.yml, job test-api-requirements/pip-install-api-requirements
• ISSUE-307 in .github/workflows/test-package.yml, job test-package/python-test

Remaining findings

• ISSUE-713 x3 An action comes from an owner that is not on your allowlist: manual by design.

3 of them are the manual actions below.

Details

• ISSUE-713 in .github/workflows/pr-labeler.yml, job pr-labeler/size-label
• ISSUE-713 in .github/workflows/pre-commit.yml, job pre-commit/pre-commit
• ISSUE-713 in .github/workflows/release-drafter.yml, job release-drafter/update_release_draft

Manual actions

Plumber does not change these on its own; each one is yours to decide.

• ISSUE-713 An action comes from an owner that is not on your allowlist, in .github/workflows/pr-labeler.yml, job pr-labeler/size-label: Decide whether you trust this owner, then either add it to the allowlist in your Plumber configuration or move to an action from an owner already on it.

Why Plumber could not decide

• pr-labeler/size-label: No authorized replacement resolved for githubActionMustComeFromAuthorizedSources: the control config supplies membership patterns only, which say which sources are allowed but not which action to write. Choose an authorized replacement for CodelyTV/pr-size-labeler@095a41f by hand, or add it to the control config as an owner/repo@ref entry.
• pre-commit/pre-commit: No authorized replacement resolved for githubActionMustComeFromAuthorizedSources: the control config supplies membership patterns only, which say which sources are allowed but not which action to write. Choose an authorized replacement for pre-commit/action@2c7b380 by hand, or add it to the control config as an owner/repo@ref entry.
• release-drafter/update_release_draft: No authorized replacement resolved for githubActionMustComeFromAuthorizedSources: the control config supplies membership patterns only, which say which sources are allowed but not which action to write. Choose an authorized replacement for release-drafter/release-drafter@b1476f6 by hand, or add it to the control config as an owner/repo@ref entry.

The workflow is gated at 85/100, which is what Plumber measured on this branch. Raise it when you are ready; nothing here lowers it.

Waiting for the repository's checks; the pull request is marked ready once they pass.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.66%. Comparing base (e159a68) to head (c1253f3).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1469   +/-   ##
=======================================
  Coverage   93.66%   93.66%           
=======================================
  Files          50       50           
  Lines        5591     5591           
=======================================
  Hits         5237     5237           
  Misses        354      354           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.