Repository navigation
ci: bump actions/checkout from 4 to 7 - #1
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
threatdiff — risk 30 / 100 ·
|
| Threat category | Weight | Findings | Worst |
|---|---|---|---|
| Tampering | ██████████ 20.0 |
2 | MEDIUM |
Score = 28.4 from findings (saturating) + 1.3 from blast radius. Raw signal total before saturation: 20.0.
Review checklist
Each item is a question, not a verdict. Answer it in the thread, or tick it and move on. Grouped by the STRIDE category the change touches.
Tampering — 2 findings
-
CI/CD pipeline definition modified —
.github/workflows/ci.yml:23MEDIUMmodified .github/workflows/ci.yml
Ask: Does this pipeline have access to production credentials, and does the change alter when or with whose code it runs?
How to answer it
Read the change as an attacker would: can I get my own code to execute in
this job? Look at trigger events, checkout refs, and any step that runs a
script from the pull request's own tree.
A pipeline change from an external contributor deserves the same scrutiny
as a change to authentication code.rule
ci.pipeline-modified· high confidence · CWE-1395 -
CI/CD pipeline definition modified —
.github/workflows/release.yml:9MEDIUMmodified .github/workflows/release.yml
Ask: Does this pipeline have access to production credentials, and does the change alter when or with whose code it runs?
How to answer it
Read the change as an attacker would: can I get my own code to execute in
this job? Look at trigger events, checkout refs, and any step that runs a
script from the pull request's own tree.
A pipeline change from an external contributor deserves the same scrutiny
as a change to authentication code.rule
ci.pipeline-modified· high confidence · CWE-1395
Suppress a finding in place with // threatdiff:ignore[rule.id] why it is fine on the line or the line above. Generated by threatdiff dev.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
@dependabot rebase |
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
f452419 to
daddaf5
Compare
2 participants
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)