Disagreement · eb14fff2-openai-5

Unpinned npm install of @anthropic-ai/claude-code in CI

solo GPT-5

repo 6f7fc663·PR #2·reviewed 1 week ago

GPT-5 finding

Unpinned npm install of @anthropic-ai/claude-code in CI

mediumsecurityhigh

.github/workflows/messages.yml:184-186

Installing the latest package version on every run exposes the workflow to supply-chain risks if the package or a dependency is compromised, and can introduce breaking changes unexpectedly.

Recommendation

Pin the CLI to a known-good version, e.g.: - run: npm install -g @anthropic-ai/claude-code@<version> Optionally use a container image with the tool preinstalled and verified, or a checksum verification step.

Other reviewer

The other reviewer flagged nothing in this file/line range.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →

From the same review

These findings passed the unanimous gate on the same PR review. The disagreement above was filtered out; the findings below were posted.

← back to all disagreements view public receipts see unanimous findings + anatomies →

Tweet ↗