Speed up the build (change gate test) - #1

Policy version 3aae8b81ba7d653e from the policy repository. 1 changed pipeline definition(s) checked.

• Tier 1 static checks: not run (the isolated static checks runner isn't available yet)
• Tier 2 policy checks and pin verification: run
• Novel patterns: compared with 11 proven pipeline(s)

.github/workflows/ci-cd.yml

Scope: team web, environments prod, staging.

Downloaded scripts aren't piped straight into a shell (no-pipe-to-shell, expected)

• What to do: Download the script, verify its checksum or signature, then run it; or use a pinned component instead.
• Why: Piping a download into a shell runs whatever the server returns at that moment, unreviewed and unpinned, with the job's credentials. A compromised or spoofed host gets code execution in your pipeline. (decided by ForeCode default pack)
• deploy-staging: command matches the forbidden pattern (curl|wget)\b[^|]|\s(sudo\s+(-E\s+)?)?(ba|z|da|k)?sh\b

Reusable components are pinned to immutable versions (pin-components, expected)

• What to do: Pin the component to an immutable version (a full commit SHA or an image digest).
• Why: Tags and branches can be moved to new code without any change in your repository, and compromised third-party components have spread exactly that way. An immutable version means a change in what runs is always a reviewed change in your repository. (decided by ForeCode default pack)
• build: actions/checkout@v4 is not pinned to an immutable version

Suggested fix (applies the remediations above; re-checked against the policy):

--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -29,7 +29,7 @@
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: 22
@@ -40,7 +40,7 @@
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Build image
         run: docker build -t "$IMAGE:${{ github.sha }}" .
 
@@ -54,7 +54,7 @@
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Build and push image
         run: |
           source .github/simulate.sh
@@ -77,7 +77,7 @@
     timeout-minutes: 10
     environment: production
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Deploy
         run: |
           source .github/simulate.sh

Need an exception to no-pipe-to-shell? A draft for your policy repository (an administrator approves it):

apiVersion: forecode/v1
kind: Exception
id: sample-web-helm-no-pipe-to-shell
guardrail: no-pipe-to-shell
scope: {repositories: [forecode-ai/sample-web-helm], environments: [prod, staging]}
reason: "<why this pipeline needs an exception, from change proposal #1>"
approved: {by: <administrator>, date: 2026-10-12}
expires: 2026-11-11

Merging needs an acknowledged reason for: no-pipe-to-shell, pin-components. Fix them, or record why they are acceptable for this change by commenting /forecode acknowledge <guardrail> <reason> (needs write access). If a finding is wrong, comment /forecode dismiss <guardrail> <reason>. required guardrails need an exception instead.