Bump ruby/setup-ruby from 1 to 1.312.0 - #449
Conversation
Bumps [ruby/setup-ruby](https://github.com/ruby/setup-ruby) from 1 to 1.312.0. - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@v1...v1.312.0) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.312.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
|
|
||
| - name: Set up Ruby | ||
| uses: ruby/setup-ruby@v1 | ||
| uses: ruby/setup-ruby@v1.312.0 |
There was a problem hiding this comment.
Workflow uses ruby/setup-ruby@v1.312.0 (tag) instead of an immutable SHA and lacks checksum verification; pin the action to a specific commit SHA and enable checksum verification where supported.
Details
✨ AI Reasoning
The PR changed the workflow to use ruby/setup-ruby@v1.312.0 instead of ruby/setup-ruby@v1. This introduced a dependency reference that is still a version tag rather than an immutable commit SHA and does not include checksum verification. Using a tag allows the action source to change if the tag is repointed or re-released, which undermines strict dependency management. The change therefore fails the requirements to pin exact package versions (preferably SHAs) and to enable checksum verification where supported. This is a clear, actionable alignment issue with the dependency rules introduced/worsened by this commit.
🔧 How do I fix it?
Include lockfiles in your repo and CI. Pin exact versions or SHAs in manifests. Enable checksum verification. Set ignore-scripts in npm or equivalent. Enforce a 72hr minimum package age policy to avoid newly published malicious packages.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
|
Superseded by #453. |
Bumps ruby/setup-ruby from 1 to 1.312.0.
Release notes
Sourced from ruby/setup-ruby's releases.
... (truncated)
Commits
4eb9f11Update Node to 24Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)