Skip to content

Commit

Permalink
Update Checkmarx/kics-github-action action to v2.1.4
Browse files Browse the repository at this point in the history
  • Loading branch information
@renovate
renovate[bot] authored Jan 22, 2025
1 parent 0231233 commit 49dce01
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion .github/workflows/terraform_checks.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ jobs:
uses: actions/checkout@v4

- name: Run KICS
uses: Checkmarx/[email protected].3
uses: Checkmarx/[email protected].4

Check warning on line 81 in .github/workflows/terraform_checks.yml

View workflow job for this annotation

GitHub Actions / KICS

[LOW] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 81 in .github/workflows/terraform_checks.yml

View workflow job for this annotation

GitHub Actions / KICS

[LOW] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
with:
path: .
config_path: .kics.yml
Expand Down

0 comments on commit 49dce01

Please sign in to comment.