chore(deps): bump the actions group with 4 updates - #87
Conversation
Bumps the actions group with 4 updates: [actions/checkout](https://github.com/actions/checkout), [haskell-actions/setup](https://github.com/haskell-actions/setup), [github/codeql-action](https://github.com/github/codeql-action) and [dawidd6/action-send-mail](https://github.com/dawidd6/action-send-mail). Updates `actions/checkout` from 4.4.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.4.0...v7.0.1) Updates `haskell-actions/setup` from 2.11.0 to 2.12.0 - [Release notes](https://github.com/haskell-actions/setup/releases) - [Commits](haskell-actions/setup@v2.11.0...v2.12.0) Updates `github/codeql-action` from 4.37.3 to 4.37.8 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.37.3...v4.37.8) Updates `dawidd6/action-send-mail` from 3.12.0 to 18 - [Release notes](https://github.com/dawidd6/action-send-mail/releases) - [Commits](dawidd6/action-send-mail@v3.12.0...v18) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: haskell-actions/setup dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: dawidd6/action-send-mail dependency-version: '18' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This pull request updates four GitHub Actions dependencies to their latest versions across the CI/CD workflows. While the updates align with maintenance goals, the implementation uses mutable version tags rather than immutable commit SHAs. This approach introduces high-severity supply chain risks, as the code executed in the pipeline could be modified by a third party without notice. This is a critical security concern for workflows managing sensitive environment secrets, such as SMTP credentials in the email notification pipeline. Resolving these security vulnerabilities by pinning actions to specific commit SHAs is recommended prior to merging. The current analysis indicates that although the changes are 'up to standards' by general metrics, they fail to meet security hardening best practices for GitHub Actions.
About this PR
- The widespread use of version tags for third-party GitHub Actions across this PR introduces a systemic supply chain risk. It is recommended to transition to full-length commit SHA pinning for all external actions to guarantee that the build environment remains immutable and protected against upstream tampering.
Test suggestions
- Verify successful completion of the GitHub Pages workflow using the updated haskell-actions/setup.
- Verify successful completion of the CodeQL analysis workflow using the updated github/codeql-action components.
- Verify successful completion of the main-estate-audit workflow using the updated actions/checkout.
- Verify successful completion of the push-email-notify workflow using the updated dawidd6/action-send-mail.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify successful completion of the GitHub Pages workflow using the updated haskell-actions/setup.
2. Verify successful completion of the CodeQL analysis workflow using the updated github/codeql-action components.
3. Verify successful completion of the main-estate-audit workflow using the updated actions/checkout.
4. Verify successful completion of the push-email-notify workflow using the updated dawidd6/action-send-mail.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
|
|
||
| - name: Setup GHCup | ||
| uses: haskell-actions/setup@v2.11.0 | ||
| uses: haskell-actions/setup@v2.12.0 |
There was a problem hiding this comment.
🔴 HIGH RISK
The 'Setup GHCup' step uses a version tag for a third-party action. Pinning an action to a full-length commit SHA is the only way to ensure the action is an immutable release and protect the pipeline from potential supply chain risks.
|
1 participant
Bumps the actions group with 4 updates: actions/checkout, haskell-actions/setup, github/codeql-action and dawidd6/action-send-mail.
Updates
actions/checkoutfrom 4.4.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
haskell-actions/setupfrom 2.11.0 to 2.12.0Commits
6037f33fix: parseYAMLBoolean for enable-stack/stack-no-global/stack-setup-ghc/disabl...d07e232fix: bump bundled ghcup from 0.1.50.2 to 0.2.6.25873697Bump actions/setup-node from 6 to 7482af4fBump actions/checkout from 6 to 7Updates
github/codeql-actionfrom 4.37.3 to 4.37.8Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
Commits
db488ddMerge pull request #4102 from github/update-v4.37.8-9ee088e131845f5bUpdate changelog for v4.37.89ee088eMerge pull request #4080 from github/henrymercer/studious-giggle1aef003Address review feedback on overlay disk flags508b83bMerge main into overlay minimum disk feature branchd97b342Merge pull request #4098 from github/mbg/permission-error-as-configuration-error47fa622MakeEACCESaConfigurationError45693ccRefactorENOSPCcheck intoisDiskConfigurationErrorfunctionc2fd8f5Merge pull request #4081 from github/mario-campos/version-cache-to-diskc56f48eLog unexpected conditions during caching CLI outputUpdates
dawidd6/action-send-mailfrom 3.12.0 to 18Release notes
Sourced from dawidd6/action-send-mail's releases.
... (truncated)
Commits
94de994fix: Use extended HELLO with github.com domain (#302)6e50282build(deps): bump actions/checkout from 6 to 7 (#300)1d138f3build(deps): bump nodemailer from 9.0.0 to 9.0.1 (#299)1369c5bnode_modules: update (#297)d86d472build(deps): bump nodemailer from 8.0.11 to 9.0.0 (#296)19dc783build(deps): bump nodemailer from 8.0.10 to 8.0.11 (#295)0dd1be8build(deps): bump nodemailer from 8.0.9 to 8.0.10 (#294)6bf8b9cbuild(deps): bump nodemailer from 8.0.8 to 8.0.9 (#293)51e2c0dbuild(deps): bump nodemailer from 8.0.7 to 8.0.8 (#292)076b075build(deps): bump brace-expansion from 5.0.5 to 5.0.6 (#291)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions