chore(deps): bump the gha group across 1 directory with 7 updates #711
Conversation
dependabot
bot
added
dependencies
Kusari Analysis Results:Caution Flagged Issues Detected While dependency analysis found no concerning changes, code analysis identified 3 critical workflow security issues that must be addressed. The Pull Request contains 2 high-severity unpinned GitHub Actions (aquasecurity/trivy-action and trufflesecurity/trufflehog) that create supply chain attack vectors, plus 1 medium-severity excessive permissions issue in the release workflow. For a security-focused repository like kubesec, these workflow vulnerabilities pose significant risk and must be remediated by pinning actions to specific commit hashes and implementing explicit permission restrictions before the PR can be safely merged. Note View full detailed analysis result for more information on the output and the checks that were run. Required Code MitigationsAdd explicit permissions block to restrict job permissions to minimum required for release operations
Pin aquasecurity/trivy-action to a specific commit hash instead of tag version to prevent supply chain attacks
Pin trufflesecurity/trufflehog to a specific commit hash instead of tag version to prevent supply chain attacks
Found this helpful? Give it a 👍 or 👎 reaction! |
![kusari-inspector[bot]](https://avatars.githubusercontent.com/in/1220830?s=60&v=4){kind=small}
|
|
||
| - name: Set up Go | ||
| uses: actions/setup-go@v5 | ||
| uses: actions/setup-go@v6 |
There was a problem hiding this comment.
Issue: Add explicit permissions block to restrict job permissions to minimum required for release operations
Recommended Code Changes:
release:
name: Release on GitHub
runs-on: ubuntu-latest
permissions:
contents: write
packages: write
steps:
|
|
||
| - name: Run Trivy | ||
| uses: aquasecurity/trivy-action@0.32.0 | ||
| uses: aquasecurity/trivy-action@0.33.1 |
There was a problem hiding this comment.
Issue: Pin aquasecurity/trivy-action to a specific commit hash instead of tag version to prevent supply chain attacks
Recommended Code Changes:
Pin action to commit hash format instead of tag version
| fetch-depth: 0 | ||
| - name: Run Trufflehog | ||
| uses: trufflesecurity/trufflehog@v3.89.2 | ||
| uses: trufflesecurity/trufflehog@v3.90.11 |
There was a problem hiding this comment.
Issue: Pin trufflesecurity/trufflehog to a specific commit hash instead of tag version
Recommended Code Changes:
Pin to commit hash format: uses: trufflesecurity/trufflehog@<commit-hash>
Bumps the gha group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `5` | | [actions/setup-go](https://github.com/actions/setup-go) | `5` | `6` | | [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` | | [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.32.0` | `0.33.1` | | [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.89.2` | `3.90.11` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `5` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `6` | Updates `actions/checkout` from 4 to 5 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v5) Updates `actions/setup-go` from 5 to 6 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v5...v6) Updates `github/codeql-action` from 3 to 4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v3...v4) Updates `aquasecurity/trivy-action` from 0.32.0 to 0.33.1 - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](aquasecurity/trivy-action@0.32.0...0.33.1) Updates `trufflesecurity/trufflehog` from 3.89.2 to 3.90.11 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Changelog](https://github.com/trufflesecurity/trufflehog/blob/main/.goreleaser.yml) - [Commits](trufflesecurity/trufflehog@v3.89.2...v3.90.11) Updates `actions/upload-artifact` from 4 to 5 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v5) Updates `actions/download-artifact` from 4 to 6 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha - dependency-name: actions/setup-go dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha - dependency-name: aquasecurity/trivy-action dependency-version: 0.33.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha - dependency-name: trufflesecurity/trufflehog dependency-version: 3.90.11 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha - dependency-name: actions/upload-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha - dependency-name: actions/download-artifact dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
force-pushed
the
dependabot/github_actions/gha-f08643eb6a
branch
from
f9eda2f to
5a66073
Compare
|
Kusari PR Analysis rerun based on - 5a66073 performed at: 2025-11-17T06:04:39Z - link to updated analysis |
| fetch-depth: 0 | ||
| - name: Run Trufflehog | ||
| uses: trufflesecurity/trufflehog@v3.89.2 | ||
| uses: trufflesecurity/trufflehog@v3.91.0 |
There was a problem hiding this comment.
Issue: Pin trufflesecurity/trufflehog to a specific commit hash instead of tag version to prevent supply chain attacks
Recommended Code Changes:
Pin action to commit hash format instead of tag version
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
Bumps the gha group with 7 updates in the / directory:
4556340.32.00.33.13.89.23.90.114546Updates
actions/checkoutfrom 4 to 5Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
08c6903Prepare v5.0.0 release (#2238)9f26565Update actions checkout to use node 24 (#2226)Updates
actions/setup-gofrom 5 to 6Release notes
Sourced from actions/setup-go's releases.
... (truncated)
Commits
4469467Bump actions/checkout from 4 to 5 (#631)e093d1eNode 24 upgrade (#624)1d76b95Improve toolchain handling (#460)e75c3e8Bumpform-datato bring in fix for critical vulnerability (#618)8e57b58Bump eslint-plugin-jest from 28.11.0 to 29.0.1 (#603)7c0b336Bump typescript from 5.4.2 to 5.8.3 (#538)6f26dccBump undici from 5.28.5 to 5.29.0 (#594)8d4083aBump@typescript-eslint/parserfrom 5.62.0 to 8.32.0 (#590)fa96338Bump@actions/tool-cachefrom 2.0.1 to 2.0.2 (#591)4de67c0Bump@types/jestfrom 29.5.12 to 29.5.14 (#589)Updates
github/codeql-actionfrom 3 to 4Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
8ff870aRename new input toprocessed-sarif-path6f0fcbeRenameuploadSarif89d3359Improve test named79c0a1Fix incomplete comment5e37670Usepost-process-outputin PR checkdef04c1Add test foruploadSarifwith output directoryUpdates
aquasecurity/trivy-actionfrom 0.32.0 to 0.33.1Release notes
Sourced from aquasecurity/trivy-action's releases.
Commits
b6643a2Update setup-trivy action to version v0.2.4 (#486)f9424c1Merge pull request #481 from aquasecurity/bump-trivy-175589825185abccbdev: delete fanal.db before testsa169870ci: update golden files on Trivy bump71f6a8fdev: add update-golden goalbf330b1test: update golden files644762eMerge pull request #482 from aquasecurity/fix-gh-actionsf2e2851chore(ci): Add oras to correctly setup sync jobs636fd3cfix: update tests7c0244bchore(deps): Update trivy to v0.65.0Updates
trufflesecurity/trufflehogfrom 3.89.2 to 3.90.11Release notes
Sourced from trufflesecurity/trufflehog's releases.
... (truncated)
Commits
ad6fc8fbump rardecode (#4503)bc2cd3eLocal Git Config Sanitization (#4502)e88e7d0Bump github.com/nwaples/rardecode/v2 (#4501)e08744cadded prefix to the github old detector regex pattern (#4494)1ef44e7Fix wrong line number in private key detector (#4485) (#4486)7afd5darefactor: use b.Loop() to simplify the code and improve performance (#4497)f9dd660add support for account api token (#4495)b140e2bDetect Organization ID to pass into AnalysisInfo for Atlassian Detector (#4480)d005847set auth-in-url flag to true when using ssh clone (#4488)26d039cProto update to support scanning confluence comments (#4484)Updates
actions/upload-artifactfrom 4 to 5Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
330a01cMerge pull request #734 from actions/danwkennedy/prepare-5.0.003f2824Updategithub.dep.yml905a1ecPreparev5.0.02d9f9cdMerge pull request #725 from patrikpolyak/patch-19687587Merge branch 'main' into patch-12848b2cMerge pull request #727 from danwkennedy/patch-19b51177Spell out the first use of GHEScd231caUpdate GHES guidance to include reference to Node 20 versionde65e23Merge pull request #712 from actions/nebuk89-patch-18747d8cUpdate README.mdUpdates
actions/download-artifactfrom 4 to 6Release notes
Sourced from actions/download-artifact's releases.
... (truncated)
Commits
018cc2cMerge pull request #438 from actions/danwkennedy/prepare-6.0.0815651cRevert "Removegithub.dep.yml"bb3a066Removegithub.dep.ymlfa1ce46Preparev6.0.04a24838Merge pull request #431 from danwkennedy/patch-15e3251cReadme: spell out the first use of GHESabefc31Merge pull request #424 from actions/yacaovsnc/update_readmeac43a60Update README with artifact extraction detailsde96f46Merge pull request #417 from actions/yacaovsnc/update_readme7993cb4Remove migration guide for artifact download changesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions