Action source could not be verified
Control: Actions must not execute mutable remote code· Config key: actionsMustNotExecuteMutableRemoteCode
📋 What is this?
Plumber could not fetch the action's own source — a network error, an API rate limit, a GitHub Enterprise Server host, a private repository, or a Docker-image action — so it could not confirm whether the action fetches mutable remote code at runtime.
⚠️ Impact
This is surfaced as an explicit could-not-verify finding rather than a silent pass. A silent pass would let the same repository score differently across CI environments and would over-claim safety on a dependency that was never actually checked.
🔧 How to fix
Re-run where the action source is reachable (an authenticated token, network access) to get a definitive result, or vendor the action so its source is local and auditable. This finding is informational: it flags an unchecked dependency, not a confirmed problem.
# .github/workflows/scan.yml: ⚠️ source not reachable from this runjobs: scan: runs-on: ubuntu-latest steps: - uses: docker://ghcr.io/acme/scanner:1.4.0 # ^ a Docker-image action has no fetchable action source, so # Plumber cannot confirm what it does at runtime# Run where the source is reachable, with auth:# GH_TOKEN=… plumber analyze# …or vendor the action so its source is committed locally:# uses: ./.github/actions/scanner💡 Tips
- This is informational and low severity by design: it marks an unchecked dependency, not a detected problem.
- Docker-image actions (
uses: docker://…) have no action source to read and always surface here.
⚙️ Configuration
This control is configured in .plumber.yaml under the github section:
github:
controls:
actionsMustNotExecuteMutableRemoteCode:
enabled: trueSee the CLI documentation for the full configuration reference.