appbuilder-cicd-pipeline

The workflow is intended for pull-request testing, but it passes extensive staging credentials to an action that executes code derived from the pull request. This creates a significant conditional credential-exfiltration risk, especially for same-repository pull requests or configurations that expose secrets to pull requests. Pin third-party actions to verified immutable commit SHAs, avoid supplying secrets during untrusted PR tests, use a trusted reusable workflow or separate post-validation deployment step, and restrict job permissions explicitly. No direct malware is evident in the YAML itself.

This is a legitimate-looking production deployment workflow, not demonstrably malicious from the supplied YAML. It handles high-value production secrets and grants them to third-party actions and build processes at job scope. Pin all actions, especially Adobe actions, to reviewed immutable commit SHAs; scope secrets only to the deployment step or protected GitHub environment; and require production environment approval where appropriate. The primary finding is supply-chain and credential-exposure risk rather than confirmed malware.

The code appears to be a legitimate convenience script for extracting App Builder CI/CD configuration, with no clear malicious behavior or obfuscation. However, it deliberately prints client secrets and runtime authentication data in plaintext, creating a significant credential-disclosure risk through captured or shared output. Use only in a trusted local terminal, prevent log capture, and prefer secure secret-handling mechanisms.