[Security] Workflow update.yml is using vulnerable action actions/checkout
- 主要語言
- Makefile
- 星號
- 0
- 分支
- 0
- PR 合併指標
- 30 天內沒有已合併 PR
描述
The workflow update.yml is referencing action actions/checkout using references v1. However this reference is missing the commit [a6747255bd19d7a757dbdda8c654a9f84db19839](https://github.com/actions/checkout/commits/a6747255bd19d7a757dbdda8c654a9f84db19839) which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.
貢獻指南
這個儲存庫沒有索引到貢獻指南
研究方向
Open update.yml and inspect its actions/checkout reference, which currently uses v1. Review the linked commit a6747255bd19d7a757dbdda8c654a9f84db19839 and update the workflow reference accordingly. Done means update.yml no longer uses the vulnerable reference and points to the requested fixed revision.
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- github-actions
- 領域
- ci-cd, security
- Issue 類型
- 缺陷
- 難度
- 1/5
- 預估耗時
- 1 小時以內
- 活躍度
- 停滯
- 描述清晰度
- 描述清楚
- 新手友好度
- 45/100