Description: The workflow uses third-party GitHub Actions referenced by mutable tags
(actions/checkout@v5 and softprops/action-gh-release@v2) instead of pinning to immutable
commit SHAs, which creates a supply-chain risk if those tags are moved or compromised.
release-asset.yml [19-46]

- name: Checkout
  uses: actions/checkout@v5

- name: Resolve archive ref
  id: archive_ref
  run: |
    if [ -n "${{ github.event.release.tag_name }}" ]; then
      echo "ref=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
    else
      echo "ref=$GITHUB_SHA" >> "$GITHUB_OUTPUT"
    fi

- name: Build release archive
  run: |
    git archive --format=zip \
      --output=pollenlevels.zip \
      "${{ steps.archive_ref.outputs.ref }}" \
      custom_components/pollenlevels

- name: Verify ZIP structure
  run: |


 ... (clipped 7 lines)

• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
Limited failure context: The workflow relies on implicit shell/command failures (e.g., git archive and unzip |
grep) without emitting actionable error context (such as missing tag/ref, missing path, or
ZIP listing) to help diagnose edge-case failures.

  run: |
    if [ -n "${{ github.event.release.tag_name }}" ]; then
      echo "ref=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
    else
      echo "ref=$GITHUB_SHA" >> "$GITHUB_OUTPUT"
    fi

- name: Build release archive
  run: |
    git archive --format=zip \
      --output=pollenlevels.zip \
      "${{ steps.archive_ref.outputs.ref }}" \
      custom_components/pollenlevels

- name: Verify ZIP structure
  run: |
    unzip -l pollenlevels.zip | grep -q "custom_components/pollenlevels/manifest.json"

Learn more about managing compliance generic rules or creating your own custom rules

Add fetch-depth: 0 to the checkout step to ensure the full git history is
available, which is necessary for the git archive command to find release tags.

.github/workflows/release-asset.yml [19-20]

 - name: Checkout
   uses: actions/checkout@v5
+  with:
+    fetch-depth: 0

• Apply / Chat

To prevent failures on manual workflow runs, add a condition to the Upload
pollenlevels.zip step so it only executes on release events.

.github/workflows/release-asset.yml [42-46]

 - name: Upload pollenlevels.zip
+  if: github.event_name == 'release'
   uses: softprops/action-gh-release@v2
   with:
     files: pollenlevels.zip
-    tag_name: ${{ github.event.release.tag_name || github.ref_name }}

• Apply / Chat