chore(deps): update amannn/action-semantic-pull-request action to v6 #1842
Conversation
|
|
Size Change: 0 B Total Size: 533 kB ℹ️ View Unchanged
|
![semgrep-code-launchdarkly[bot]](https://avatars.githubusercontent.com/u/8039656?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: amannn/action-semantic-pull-request@v5 | ||
| - uses: amannn/action-semantic-pull-request@v6 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
To resolve this comment:
✨ Commit Assistant fix suggestion
| - uses: amannn/action-semantic-pull-request@v6 | |
| - uses: amannn/action-semantic-pull-request@7e7756342d687a84eff23acb7b5bd1c0e7b17750 | |
| # Pinned to commit SHA for security: https://github.com/amannn/action-semantic-pull-request/commit/7e7756342d687a84eff23acb7b5bd1c0e7b17750 |
View step-by-step instructions
- Replace the version tag
@v6inuses: amannn/action-semantic-pull-request@v6with the specific full commit SHA for the version you want to use, such as@7e7756342d687a84eff23acb7b5bd1c0e7b17750. - Find the correct commit SHA by visiting the action's GitHub repository (for example, https://github.com/amannn/action-semantic-pull-request/tags), selecting your desired release or tag, and copying the full 40-character commit hash.
- Update the
usesline to:uses: amannn/action-semantic-pull-request@<commit-sha>(replace<commit-sha>with the actual SHA you copied). - Save the changes.
Pinning GitHub Actions to a specific commit SHA ensures the action code cannot change unexpectedly in the future, which reduces the risk of using compromised third-party code.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by third-party-action-not-pinned-to-commit-sha.
You can view more details about this finding in the Semgrep AppSec Platform.
This PR contains the following updates:
v5→v6Release Notes
amannn/action-semantic-pull-request (amannn/action-semantic-pull-request)
v6Compare Source
Configuration
📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month ( * 0-3 1 * * ) (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.