github / github/accessibility-scanner
GitHub Script action not pinned to a full-length commit SHA
- Lingua principale
- TypeScript
- Stelle
- 369
- Fork
- 40
- Merge medio
- 1g 9h
- PR unite (30g)
- 10
Descrizione
The `accessibility-scanner` workflow uses `actions/github-script@v8` without pinning it to a specific commit SHA. This violates security best practices and causes the pipeline to fail when the **Require actions to be pinned to a full-length commit SHA** setting is enabled.
#### **Steps to Reproduce**
1. Enable **Require actions to be pinned to a full-length commit SHA** in the repository settings.
2. Run the `accessibility-scanner` workflow.
3. Observe the failure caused by the unpinned `actions/github-script` action.
#### **Expected Behavior**
The workflow should run successfully with all actions pinned to full-length commit SHAs.
#### **Actual Behavior**
The workflow fails because `actions/github-script@v8` is not pinned to a commit SHA.
https://github.com/github/accessibility-scanner/blob/db51bb5d470a862cc027836ee1583ab9d5ae5b16/action.yml#L137
Guida per i contributori
Apri la guida per i contributori
Direzione di ricerca
Start with action.yml at line 137, referenced in the issue, and inspect the accessibility-scanner workflow's actions/github-script usage. Update the action reference to a full-length commit SHA, then verify that the workflow satisfies the repository's pinning requirement and runs successfully.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- github-actions
- Ambito
- ci-cd, security
- Tipo di issue
- Bug
- Difficoltà
- 1/5
- Tempo stimato
- Meno di un'ora
- Stato di attività
- Ferma
- Chiarezza
- Specificata chiaramente
- Idoneità per principianti
- 55/100