Repository navigation
ci: bump actions/setup-go from 5 to 7 - #2
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
threatdiff — risk 30 / 100 ·
|
| Threat category | Weight | Findings | Worst |
|---|---|---|---|
| Tampering | ██████████ 20.0 |
2 | MEDIUM |
Score = 28.4 from findings (saturating) + 1.8 from blast radius. Raw signal total before saturation: 20.0.
Review checklist
Each item is a question, not a verdict. Answer it in the thread, or tick it and move on. Grouped by the STRIDE category the change touches.
Tampering — 2 findings
-
CI/CD pipeline definition modified —
.github/workflows/ci.yml:24MEDIUMmodified .github/workflows/ci.yml
Ask: Does this pipeline have access to production credentials, and does the change alter when or with whose code it runs?
How to answer it
Read the change as an attacker would: can I get my own code to execute in
this job? Look at trigger events, checkout refs, and any step that runs a
script from the pull request's own tree.
A pipeline change from an external contributor deserves the same scrutiny
as a change to authentication code.rule
ci.pipeline-modified· high confidence · CWE-1395 -
CI/CD pipeline definition modified —
.github/workflows/release.yml:13MEDIUMmodified .github/workflows/release.yml
Ask: Does this pipeline have access to production credentials, and does the change alter when or with whose code it runs?
How to answer it
Read the change as an attacker would: can I get my own code to execute in
this job? Look at trigger events, checkout refs, and any step that runs a
script from the pull request's own tree.
A pipeline change from an external contributor deserves the same scrutiny
as a change to authentication code.rule
ci.pipeline-modified· high confidence · CWE-1395
Suppress a finding in place with // threatdiff:ignore[rule.id] why it is fine on the line or the line above. Generated by threatdiff dev.
|
@dependabot rebase |
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5 to 7. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v5...v7) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
d3d1c29 to
60fac4d
Compare
1 participant
Bumps actions/setup-go from 5 to 7.
Release notes
Sourced from actions/setup-go's releases.
... (truncated)
Commits
b7ad1dachore(deps): bump@actions/cacheto 6.2.0 (#771)0778a10Migrate to ESM and upgrade dependencies (#763)924ae3achore: bump version to 6.5.0 in package.json and package-lock.json (#762)e91cc3bBump@actions/cacheto 5.1.0, log cache write denied (#758)4a2405echore: update@types/nodeand@typescript-eslintdependencies to latest versi...78961f6chore: update@actionsdependencies and refresh license cache (#744)4a36011docs: fix Microsoft build of Go link (#734)8f19afcfeat: add go-download-base-url input for custom Go distributions (#721)27fdb26Bump minimatch from 3.1.2 to 3.1.5 (#727)def8c39Rearrange README.md, add advanced-usage.md (#724)