Use newest format-hcl with fixed return codes

[github-actions]

📝 Brief description

Use newest format-hcl with fixed return codes

💻 Commits

• 82f5586 - Krzysztof Szyper - 2023-02-01 15:44:46
  Use newest format-hcl with fixed return codes
  Bump Ubuntu to jammy-20230126.

  Bump release to v0.3.6.

  Fixes check input error. #73

📁 Modified files

Dockerfile | 2 +-
Makefile | 2 +-
README.md | 6 +++---
action.yml | 2 +-
4 files changed, 6 insertions(+), 6 deletions(-)

⚠️ Additional information

• Pushed to a branch with a proper name and provided proper commit message.
• Provided a clear and concise description of what the issue is.

Check CONTRIBUTING.md and CODE_OF_CONDUCT.md for more information

[jit-ci]

❌ Jit has detected 1 important finding in this PR that you should review.
The finding is detailed below as a comment.
It’s highly recommended that you fix this security issue before merge.

[jit-ci]

Security control: Iac Misconfig Detection

Type: Missing User Instruction

Description: A user should be specified in the dockerfile, otherwise the image will run as root

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

• First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: docker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:
  • If a non-root user already exists in your container, consider using it.
  • If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.

Suggested change

	FROM ubuntu:jammy-20230126
	FROM ubuntu:jammy-20230126
	RUN addgroup --system <group>
	RUN adduser --system <user> --ingroup <group>
	USER <user>:<group>

---

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

• #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”
• #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”
• #jit_undo_ignore Undo ignore command

[ChristophShyper]

#jit_ignore_accept

[ChristophShyper]

#jit_ignore_accept