JonKazama-Hellion
38c6707970
Semgrep blocks on gha-curl-pipe-shell, and it is pointing at the publish step added an hour ago. The rule exists for `curl https://…/install.sh | bash`: remote content reaching an interpreter. What this actually did was pipe a JSON response into a python3 -c inline script -- the interpreter and its program both live in the workflow file, and the server only ever supplied data. A false positive, then, but the rule cannot see the difference between an interpreter reading a program from stdin and one reading data, and neither can the next person to read the step. Responses go to a file and are read from there. Same shape as the finding suggests, and worth having anyway: a response that is on disk can be looked at when a call misbehaves, instead of vanishing into a pipe. Verified by falsification rather than by a green run: the same ruleset against the previous revision of this file reports 1 blocking finding, against this one zero. Without that check a passing scan only proves the rule was not loaded.