[KB] Add KB for xt0rted/dotnet-sdk-updater

[step-security-bot]

Knowledge Base is missing for xt0rted/dotnet-sdk-updater.

[github-actions]

This action's action.yml & README.md doesn't contains any reference to GITHUB_TOKEN

[github-actions]

This action's action.yml & README.md doesn't contains any reference to GITHUB_TOKEN

action-security.yml

name: "dotnet sdk updater" # xt0rted/dotnet-sdk-updater
# GITHUB_TOKEN not used

[xt0rted]

This action doesn't use the API. It does call out to a Microsoft server to get version information for .net sdks, but it doesn't hit GitHub's api for anything.

[varunsh-coder]

This action doesn't use the API. It does call out to a Microsoft server to get version information for .net sdks, but it doesn't hit GitHub's api for anything.

Thanks @xt0rted for the confirmation! We do some automated analysis and that had the same conclusion. I am curious how you got to know about this issue?

We are planning to create an issue in the Action repo to let owners of Actions know about this in the future, but I don't think that work is done yet...

[github-actions]

This action's action.yml & README.md doesn't contains any reference to GITHUB_TOKEN

action-security.yml

name: "dotnet sdk updater" # xt0rted/dotnet-sdk-updater
# GITHUB_TOKEN not used

[xt0rted]

@varunsh-coder I was told about this action while setting up a workflow for jsx-eslint/eslint-plugin-react#3223 and ran a couple of my workflows through https://app.stepsecurity.io/ to see what changes it recommended. One of my actions had an issue opened on it, but this one didn't.

[varunsh-coder]

@varunsh-coder I was told about this action while setting up a workflow for yannickcr/eslint-plugin-react#3223 and ran a couple of my workflows through https://app.stepsecurity.io/ to see what changes it recommended. One of my actions had an issue opened on it, but this one didn't.

Thanks @xt0rted for the info! Please let me know if you have feedback on any of these projects. I am specially interested to know how to message harden-runner better. How was your experience using it? How can we improve the messaging to make it easier to understand? Thanks!