Skip to content

Bump trakx/github-actions from 10.1.2 to 10.2.1 #177

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

Bump trakx/github-actions from 10.1.2 to 10.2.1 #177

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/automerge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,6 @@ jobs:
if: ${{ github.actor == 'dependabot[bot]' }}
steps:
- name: Merge non major updates
uses: trakx/github-actions/dependabot-automerge@v10.1.2
uses: trakx/github-actions/dependabot-automerge@v10.2.1
with:
githubToken: ${{ secrets.GITHUB_TOKEN }}
2 changes: 1 addition & 1 deletion .github/workflows/nuget.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@
- name: Build and publish nuget packages
id: publish
uses: trakx/github-actions/publish-nuget@v10.1.2
uses: trakx/github-actions/publish-nuget@v10.2.1

Check warning on line 60 in .github/workflows/nuget.yml

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

.github/workflows/nuget.yml#L60 

An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.
Copy link

@codacy-production codacy-production bot Nov 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Codacy found a medium Security issue: An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.

The issue identified by the Semgrep linter is that the GitHub Action is being referenced by a version tag (v10.2.1) instead of a full-length commit SHA. This can lead to security vulnerabilities because the action could change if the repository owner updates the tagged version. Pinning to a specific commit SHA ensures that the action remains immutable and prevents unintentional changes that could introduce vulnerabilities or bugs.

To fix this issue, you should replace the version tag with the full commit SHA of the action you want to use.

Here's the code suggestion to address the issue:

Suggested change
uses: trakx/github-actions/publish-nuget@v10.2.1
uses: trakx/github-actions/publish-nuget@<full-length-commit-sha>

Make sure to replace <full-length-commit-sha> with the actual SHA of the commit you want to pin to.

This comment was generated by an experimental AI tool.

with:
packageReadonlyPat: ${{secrets.TRAKX_BOT_READONLY_PAT}}
githubToken: ${{secrets.GITHUB_TOKEN}}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
steps:
- name: Test and cover solutions
id: test
uses: trakx/github-actions/test-dotnet@v10.1.2
uses: trakx/github-actions/test-dotnet@v10.2.1

Check warning on line 17 in .github/workflows/test.yml

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

.github/workflows/test.yml#L17 

An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.
Copy link

@codacy-production codacy-production bot Nov 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Codacy found a medium Security issue: An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.

The issue identified by the Semgrep linter is related to the use of a GitHub Action that is sourced from a third-party repository. The action is currently pinned to a version tag (v10.2.1), which can lead to potential security vulnerabilities or unexpected changes if the action is updated in the upstream repository. To mitigate this risk, it's recommended to pin the action to a full-length commit SHA, which provides a specific and immutable reference to the code being executed.

To fix the issue, you should replace the version tag with the full-length commit SHA of the action you intend to use. Assuming you have the commit SHA (e.g., abc123def456...), the code suggestion would look like this:

Suggested change
uses: trakx/github-actions/test-dotnet@v10.2.1
uses: trakx/github-actions/test-dotnet@abc123def456

Make sure to replace abc123def456 with the actual commit SHA of the trakx/github-actions/test-dotnet repository that corresponds to the version you want to use.

This comment was generated by an experimental AI tool.

with:
packageReadonlyPat: ${{secrets.TRAKX_BOT_READONLY_PAT}}
codacyToken: ${{secrets.CODACY_TOKEN}}
Expand Down
Loading