Astrotomic / Astrotomic/stancy
[Security] Workflow stale-issues.yml is using vulnerable action actions/stale
- Dominant language
- PHP
- Stars
- 35
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
The workflow stale-issues.yml is referencing action actions/stale using references v2.0.0. However this reference is missing the commit [af4072615903a8b031f986d25b1ae3bf45ec44d4](https://github.com/actions/stale/commits/af4072615903a8b031f986d25b1ae3bf45ec44d4) which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.
Contributor guide
Research direction
Find the stale-issues.yml workflow and inspect its actions/stale reference, currently v2.0.0; compare it with the referenced commit af4072615903a8b031f986d25b1ae3bf45ec44d4. Done means the workflow points to the updated reference and remains valid.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100