chore: bump actions/setup-node from 6 to 7 - #156
Conversation
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![bulwark-sc-ent[bot]](https://avatars.githubusercontent.com/b/255931?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary
| Severity | Count |
|---|---|
| High | 41 |
| Total | 41 |
Details
Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.
excessive-permissions — High (3 similar finding(s))
overly broad permissions
File: .github/workflows/release.yaml
Fix guidance: https://docs.zizmor.sh/audits/#excessive-permissions
Locations:
- Line 12 (cols 2–17) — contents: write is overly broad at the workflow level
- Line 13 (cols 2–17) — packages: write is overly broad at the workflow level
- Line 14 (cols 2–17) — id-token: write is overly broad at the workflow level
template-injection — High (2 similar finding(s))
code injection via template expansion
File: .github/workflows/release.yaml
Fix guidance: https://docs.zizmor.sh/audits/#template-injection
Locations:
- Line 75–88 (cols 8–60) — this step
- Line 80 (cols 27–42) — expression
github.workflow— may expand into attacker-controllable code - Line 77 (cols 8–11) — this run block
- Line 148–161 (cols 8–60) — this step
- Line 153 (cols 27–42) — expression
github.workflow— may expand into attacker-controllable code - Line 150 (cols 8–11) — this run block
unpinned-uses — High (17 similar finding(s))
unpinned action reference
File: .github/workflows/release.yaml
Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses
Locations:
- Line 25 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy) - Line 28 (cols 14–35) — expression
actions/setup-node@v7— action is not pinned to a hash (required by blanket policy) - Line 48 (cols 14–41) — expression
docker/setup-qemu-action@v4— action is not pinned to a hash (required by blanket policy) - Line 52 (cols 14–43) — expression
docker/setup-buildx-action@v4— action is not pinned to a hash (required by blanket policy) - Line 56 (cols 14–36) — expression
docker/login-action@v4— action is not pinned to a hash (required by blanket policy) - Line 65 (cols 14–41) — expression
docker/build-push-action@v7— action is not pinned to a hash (required by blanket policy) - Line 73 (cols 14–46) — expression
sigstore/cosign-installer@v4.1.2— action is not pinned to a hash (required by blanket policy) - Line 98 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy) - …and 9 more location(s) in this file.
cache-poisoning — High (2 similar finding(s))
runtime artifacts potentially vulnerable to a cache poisoning attack
File: .github/workflows/release.yaml
Fix guidance: https://docs.zizmor.sh/audits/#cache-poisoning
Locations:
- Line 65 (cols 8–41) — runtime artifacts usually published here
- Line 28 (cols 8–35) — enables caching by default
- Line 27–30 (cols 8–47) — this step
- Line 138 (cols 8–41) — runtime artifacts usually published here
- Line 101 (cols 8–35) — enables caching by default
- Line 100–103 (cols 8–47) — this step
excessive-permissions — High
overly broad permissions
File: .github/workflows/test.yaml
Fix guidance: https://docs.zizmor.sh/audits/#excessive-permissions
Locations:
- Line 14 (cols 2–17) — packages: write is overly broad at the workflow level
unpinned-uses — High (14 similar finding(s))
unpinned action reference
File: .github/workflows/test.yaml
Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses
Locations:
- Line 27 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy) - Line 30 (cols 14–35) — expression
actions/setup-node@v7— action is not pinned to a hash (required by blanket policy) - Line 38 (cols 14–41) — expression
docker/setup-qemu-action@v4— action is not pinned to a hash (required by blanket policy) - Line 41 (cols 14–43) — expression
docker/setup-buildx-action@v4— action is not pinned to a hash (required by blanket policy) - Line 44 (cols 14–36) — expression
docker/login-action@v4— action is not pinned to a hash (required by blanket policy) - Line 51 (cols 14–41) — expression
docker/build-push-action@v7— action is not pinned to a hash (required by blanket policy) - Line 64 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy) - Line 67 (cols 14–35) — expression
actions/setup-node@v7— action is not pinned to a hash (required by blanket policy) - …and 6 more location(s) in this file.
cache-poisoning — High (2 similar finding(s))
runtime artifacts potentially vulnerable to a cache poisoning attack
File: .github/workflows/test.yaml
Fix guidance: https://docs.zizmor.sh/audits/#cache-poisoning
Locations:
- Line 51 (cols 8–41) — runtime artifacts usually published here
- Line 30 (cols 8–35) — enables caching by default
- Line 29–32 (cols 8–47) — this step
- Line 88 (cols 8–41) — runtime artifacts usually published here
- Line 67 (cols 8–35) — enables caching by default
- Line 66–69 (cols 8–47) — this step
Please review these findings before merging.
There was a problem hiding this comment.
Summary
| Severity | Count |
|---|---|
| High | 41 |
| Total | 41 |
Details
Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.
excessive-permissions — High (3 similar finding(s))
overly broad permissions
File: .github/workflows/release.yaml
Fix guidance: https://docs.zizmor.sh/audits/#excessive-permissions
Locations:
- Line 12 (cols 2–17) — contents: write is overly broad at the workflow level
- Line 13 (cols 2–17) — packages: write is overly broad at the workflow level
- Line 14 (cols 2–17) — id-token: write is overly broad at the workflow level
template-injection — High (2 similar finding(s))
code injection via template expansion
File: .github/workflows/release.yaml
Fix guidance: https://docs.zizmor.sh/audits/#template-injection
Locations:
- Line 75–88 (cols 8–60) — this step
- Line 80 (cols 27–42) — expression
github.workflow— may expand into attacker-controllable code - Line 77 (cols 8–11) — this run block
- Line 148–161 (cols 8–60) — this step
- Line 153 (cols 27–42) — expression
github.workflow— may expand into attacker-controllable code - Line 150 (cols 8–11) — this run block
unpinned-uses — High (17 similar finding(s))
unpinned action reference
File: .github/workflows/release.yaml
Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses
Locations:
- Line 25 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy) - Line 28 (cols 14–35) — expression
actions/setup-node@v7— action is not pinned to a hash (required by blanket policy) - Line 48 (cols 14–41) — expression
docker/setup-qemu-action@v4— action is not pinned to a hash (required by blanket policy) - Line 52 (cols 14–43) — expression
docker/setup-buildx-action@v4— action is not pinned to a hash (required by blanket policy) - Line 56 (cols 14–36) — expression
docker/login-action@v4— action is not pinned to a hash (required by blanket policy) - Line 65 (cols 14–41) — expression
docker/build-push-action@v7— action is not pinned to a hash (required by blanket policy) - Line 73 (cols 14–46) — expression
sigstore/cosign-installer@v4.1.2— action is not pinned to a hash (required by blanket policy) - Line 98 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy) - …and 9 more location(s) in this file.
cache-poisoning — High (2 similar finding(s))
runtime artifacts potentially vulnerable to a cache poisoning attack
File: .github/workflows/release.yaml
Fix guidance: https://docs.zizmor.sh/audits/#cache-poisoning
Locations:
- Line 65 (cols 8–41) — runtime artifacts usually published here
- Line 28 (cols 8–35) — enables caching by default
- Line 27–30 (cols 8–47) — this step
- Line 138 (cols 8–41) — runtime artifacts usually published here
- Line 101 (cols 8–35) — enables caching by default
- Line 100–103 (cols 8–47) — this step
excessive-permissions — High
overly broad permissions
File: .github/workflows/test.yaml
Fix guidance: https://docs.zizmor.sh/audits/#excessive-permissions
Locations:
- Line 14 (cols 2–17) — packages: write is overly broad at the workflow level
unpinned-uses — High (14 similar finding(s))
unpinned action reference
File: .github/workflows/test.yaml
Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses
Locations:
- Line 27 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy) - Line 30 (cols 14–35) — expression
actions/setup-node@v7— action is not pinned to a hash (required by blanket policy) - Line 38 (cols 14–41) — expression
docker/setup-qemu-action@v4— action is not pinned to a hash (required by blanket policy) - Line 41 (cols 14–43) — expression
docker/setup-buildx-action@v4— action is not pinned to a hash (required by blanket policy) - Line 44 (cols 14–36) — expression
docker/login-action@v4— action is not pinned to a hash (required by blanket policy) - Line 51 (cols 14–41) — expression
docker/build-push-action@v7— action is not pinned to a hash (required by blanket policy) - Line 64 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy) - Line 67 (cols 14–35) — expression
actions/setup-node@v7— action is not pinned to a hash (required by blanket policy) - …and 6 more location(s) in this file.
cache-poisoning — High (2 similar finding(s))
runtime artifacts potentially vulnerable to a cache poisoning attack
File: .github/workflows/test.yaml
Fix guidance: https://docs.zizmor.sh/audits/#cache-poisoning
Locations:
- Line 51 (cols 8–41) — runtime artifacts usually published here
- Line 30 (cols 8–35) — enables caching by default
- Line 29–32 (cols 8–47) — this step
- Line 88 (cols 8–41) — runtime artifacts usually published here
- Line 67 (cols 8–35) — enables caching by default
- Line 66–69 (cols 8–47) — this step
Please review these findings before merging.
Bumps actions/setup-node from 6 to 7.
Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)