Skip to content

chore: use grok-build-0.1 for SquidGate #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DotNetRussell wants to merge 2 commits into
base: master
Choose a base branch
from
Open

chore: use grok-build-0.1 for SquidGate #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
58b44c4
chore: set SquidGate model to grok-build-0.1
DotNetRussell Aug 1, 2026
77a98e0
chore: SquidGate workflow uses grok-build-0.1
DotNetRussell Aug 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions .github/squidgate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
# SquidGate — PR security gate
# https://github.com/SquidSec/SquidGate
version: 1

llm:
provider: custom
model: grok-build-0.1

policy:
block_on: high
min_confidence: medium
categories:
secrets: true
injection: true
authn_authz: true
cryptography: true
insecure_deserialization: true
path_traversal: true
ssrf: true
xss: true
csrf: true
supply_chain: true
hardcoded_credentials: true
dangerous_functions: true
misconfiguration: true
custom_rules: []

context:
lines_before: 30
lines_after: 30
max_files: 50
max_diff_bytes: 500000

output:
comment_on_pr: true
annotate_lines: true
fail_on_error: true
26 changes: 26 additions & 0 deletions .github/workflows/squidgate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
name: SquidGate

on:
pull_request:
types: [opened, synchronize, reopened]

permissions:
contents: read
pull-requests: write
checks: write

jobs:
squidgate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0

- name: SquidGate
uses: SquidSec/SquidGate@v1

Check failure on line 21 in .github/workflows/squidgate.yml

View workflow job for this annotation

GitHub Actions / SquidGate

Unpinned third-party GitHub Action 

HIGH [high] The workflow uses the external action 'SquidSec/SquidGate@v1' referenced by a mutable tag instead of a specific commit SHA. This creates a supply chain risk where an attacker could compromise the tag to inject malicious code into the CI pipeline.

Recommendation: Pin the action to an immutable commit SHA, e.g. 'uses: SquidSec/SquidGate@<full-40-char-sha>'. Use Dependabot, Renovate, or similar to manage updates and review changes.
CWE: CWE-829
Category: supply_chain
with:
llm-api-key: ${{ secrets.LLM_API_KEY }}
llm-provider: custom
llm-model: grok-build-0.1
llm-base-url: https://api.x.ai/v1
Loading