ad-m / ad-m/urlwatch-template

[Security] Workflow update.yml is using vulnerable action actions/checkout

未關閉
#1 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
Makefile
星號
0
分支
0
PR 合併指標
30 天內沒有已合併 PR

描述

The workflow update.yml is referencing action actions/checkout using references v1. However this reference is missing the commit [a6747255bd19d7a757dbdda8c654a9f84db19839](https://github.com/actions/checkout/commits/a6747255bd19d7a757dbdda8c654a9f84db19839) which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.

貢獻指南

這個儲存庫沒有索引到貢獻指南

研究方向

Open update.yml and inspect its actions/checkout reference, which currently uses v1. Review the linked commit a6747255bd19d7a757dbdda8c654a9f84db19839 and update the workflow reference accordingly. Done means update.yml no longer uses the vulnerable reference and points to the requested fixed revision.

由索引模型根據 Issue 內容生成。

評估

技術堆疊
github-actions
領域
ci-cd, security
Issue 類型
缺陷
難度
1/5
預估耗時
1 小時以內
活躍度
停滯
描述清晰度
描述清楚
新手友好度
45/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。