Skip to content
KICS security and vulnerability scanner

chore(deps): bump actions/checkout from 3 to 4 #662

Sign in to view logs

chore(deps): bump actions/checkout from 3 to 4

chore(deps): bump actions/checkout from 3 to 4 #662

Triggered via pull request October 4, 2023 14:45
@dependabotdependabot[bot]
synchronize #163
dependabot/github_actions/actions/checkout-4
Status Success
Total duration 11m 6s
Artifacts 1
This run and associated checks have been archived and are scheduled for deletion. Learn more about checks retention

kics.yml

on: pull_request
Analyze
3m 19s
Analyze
Fit to window
Zoom out
Zoom in

Annotations

10 warnings
[MEDIUM] Unpinned Actions Full Length Commit SHA: .github/workflows/trivy-docker-hub-scan.yml#L22
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
[MEDIUM] Unpinned Actions Full Length Commit SHA: .github/workflows/publish-documentation.yaml#L25
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
[MEDIUM] Unpinned Actions Full Length Commit SHA: .github/workflows/release.yaml#L29
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
[MEDIUM] Unpinned Actions Full Length Commit SHA: .github/workflows/helm-chart-release.yaml#L58
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
[MEDIUM] Unpinned Actions Full Length Commit SHA: .github/workflows/irs-build.yml#L149
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
[MEDIUM] Unpinned Actions Full Length Commit SHA: .github/workflows/trivy.yml#L47
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
[MEDIUM] Unpinned Actions Full Length Commit SHA: .github/workflows/helm-test.yaml#L45
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
[MEDIUM] Unpinned Actions Full Length Commit SHA: .github/workflows/trivy-image-scan.yml#L67
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
[MEDIUM] Unpinned Actions Full Length Commit SHA: .github/workflows/release.yaml#L19
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
[MEDIUM] Unpinned Actions Full Length Commit SHA: .github/workflows/kics.yml#L61
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Artifacts

Produced during runtime
Name Size
kicsResults.json Expired
58.4 KB