*: new workflow org-codeql #490
Conversation
thypon
force-pushed
the
features/refactor-codeql-out
branch
21 times, most recently
from
211fdce to
edcf87f
Compare
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
thypon
force-pushed
the
features/refactor-codeql-out
branch
2 times, most recently
from
1d7be7e to
d52e2e7
Compare
thypon
force-pushed
the
features/refactor-codeql-out
branch
from
d52e2e7 to
2d01480
Compare
|
[puLL-Merge] - brave/security-action@490 DescriptionThis pull request introduces several changes and additions to the GitHub Actions workflows, as well as creating new files for handling configurations and properties. It seems to cater to code quality and security automation tasks. ChangesChangesUpdated Workflow Files:
Renamed Workflow Files:
New Files:
Security Hotspots
Please make sure to test all changes thoroughly, especially since some of the scripts involve dynamic JavaScript import statements and access properties that may have implications on repository access control and workflow triggers. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| pip_audit_pypi_index_url: ${{ inputs.pip_audit_pypi_index_url }} | ||
| pip_audit_pypi_insecure_hosts: ${{ inputs.pip_audit_pypi_insecure_hosts }} | ||
| gh_to_slack_user_map: ${{ inputs.gh_to_slack_user_map }} | ||
| - uses: ${{ github.action_path }}/actions/codeql |
There was a problem hiding this comment.
reported by reviewdog 🐶
[semgrep] An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/brave-third-party-action-not-pinned-to-commit-sha.yaml
Cc @thypon @bcaller
action.yml
Outdated
| labels: needs-security-review | ||
| - uses: actions-ecosystem/action-add-assignees@a5b84af721c4a621eb9c7a4a95ec20a90d0b88e9 # v1.0.1 | ||
| if: ${{ steps.reviewdog-enabled-pr.outputs.result == 'true' && steps.should-trigger.outputs.result == 'true' }} | ||
| - uses: ${{ github.action_path }}/actions/reviewdog |
There was a problem hiding this comment.
reported by reviewdog 🐶
[semgrep] An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/brave-third-party-action-not-pinned-to-commit-sha.yaml
Cc @thypon @bcaller
action.yml
Outdated
| pip_audit_pypi_index_url: ${{ inputs.pip_audit_pypi_index_url }} | ||
| pip_audit_pypi_insecure_hosts: ${{ inputs.pip_audit_pypi_insecure_hosts }} | ||
| gh_to_slack_user_map: ${{ inputs.gh_to_slack_user_map }} | ||
| - uses: ${{ github.action_path }}/actions/unverified-commits |
There was a problem hiding this comment.
reported by reviewdog 🐶
[semgrep] An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/brave-third-party-action-not-pinned-to-commit-sha.yaml
Cc @thypon @bcaller
No description provided.