ci: apply security best practices

[stepsecurity-int]

Summary

This pull request has been generated by StepSecurity as part of your enterprise subscription to ensure compliance with recommended security best practices. Please review and merge the pull request to apply these security enhancements.

Security Fixes

Pinned Dependencies

Pinning GitHub Actions to specific versions or commit SHAs ensures that your workflows remain consistent and secure.
Unpinned actions can lead to unexpected changes or vulnerabilities caused by upstream updates.

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Feedback

email here

[step-security-bot]

Please find StepSecurity AI-CodeWise code comments below.

Code Comments

.github/workflows/create_review.yml

[
    {
        "Severity": "High",
        "Recommendation": "Avoid using commit hashes directly for dependencies",
        "Description": "Directly using a commit hash for dependencies can lead to stability and maintainability issues as the exact version cannot be easily tracked or updated.",
        "Remediation": "Update the dependency to use a specific version tag or a range compatible with the project requirements instead of a commit hash."
    },
    {
        "Severity": "Medium",
        "Recommendation": "Ensure secure connections in network configurations",
        "Description": "Hardcoding API addresses with explicit ports can create security vulnerabilities as it may bypass established security procedures or expose sensitive data.",
        "Remediation": "Use HTTPS and avoid specifying ports in plain text, rely on standard ports 443 for HTTPS to enhance security of network communication."
    }
]

Feedback

We appreciate your feedback in helping us improve the service! To provide feedback, please use emojis on this comment. If you find the comments helpful, give them a 👍. If they aren't useful, kindly express that with a 👎. If you have questions or detailed feedback, please create n GitHub issue in StepSecurity/AI-CodeWise.