github / github/accessibility-scanner

GitHub Script action not pinned to a full-length commit SHA

Aperta
#169 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
TypeScript
Stelle
369
Fork
40
Merge medio
1g 9h
PR unite (30g)
10

Descrizione

The `accessibility-scanner` workflow uses `actions/github-script@v8` without pinning it to a specific commit SHA. This violates security best practices and causes the pipeline to fail when the **Require actions to be pinned to a full-length commit SHA** setting is enabled.

#### **Steps to Reproduce**
1. Enable **Require actions to be pinned to a full-length commit SHA** in the repository settings.
2. Run the `accessibility-scanner` workflow.
3. Observe the failure caused by the unpinned `actions/github-script` action.

#### **Expected Behavior**
The workflow should run successfully with all actions pinned to full-length commit SHAs.

#### **Actual Behavior**
The workflow fails because `actions/github-script@v8` is not pinned to a commit SHA.

https://github.com/github/accessibility-scanner/blob/db51bb5d470a862cc027836ee1583ab9d5ae5b16/action.yml#L137

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Start with action.yml at line 137, referenced in the issue, and inspect the accessibility-scanner workflow's actions/github-script usage. Update the action reference to a full-length commit SHA, then verify that the workflow satisfies the repository's pinning requirement and runs successfully.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
github-actions
Ambito
ci-cd, security
Tipo di issue
Bug
Difficoltà
1/5
Tempo stimato
Meno di un'ora
Stato di attività
Ferma
Chiarezza
Specificata chiaramente
Idoneità per principianti
55/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.