chore: bump docker/build-push-action from 7.2.0 to 7.3.0 - #123
chore: bump docker/build-push-action from 7.2.0 to 7.3.0#123dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7.2.0 to 7.3.0. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v7.2.0...v7.3.0) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
the
github_actions
![bulwark-sc-ent[bot]](https://avatars.githubusercontent.com/b/255931?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary
| Severity | Count |
|---|---|
| High | 21 |
| Total | 21 |
Details
Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.
template-injection — High
code injection via template expansion
File: .github/workflows/release.yaml
Fix guidance: https://docs.zizmor.sh/audits/#template-injection
Locations:
- Line 79–92 (cols 8–60) — this step
- Line 84 (cols 27–42) — expression
github.workflow— may expand into attacker-controllable code - Line 81 (cols 8–11) — this run block
unpinned-uses — High (9 similar finding(s))
unpinned action reference
File: .github/workflows/release.yaml
Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses
Locations:
- Line 26 (cols 14–35) — expression
actions/setup-node@v6— action is not pinned to a hash (required by blanket policy) - Line 31 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy) - Line 44 (cols 14–41) — expression
docker/setup-qemu-action@v4— action is not pinned to a hash (required by blanket policy) - Line 48 (cols 14–47) — expression
docker/setup-buildx-action@v4.1.0— action is not pinned to a hash (required by blanket policy) - Line 52 (cols 14–40) — expression
docker/login-action@v4.2.0— action is not pinned to a hash (required by blanket policy) - Line 60 (cols 14–45) — expression
docker/build-push-action@v7.3.0— action is not pinned to a hash (required by blanket policy) - Line 77 (cols 14–46) — expression
sigstore/cosign-installer@v4.1.2— action is not pinned to a hash (required by blanket policy) - Line 101 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy) - …and 1 more location(s) in this file.
cache-poisoning — High
runtime artifacts potentially vulnerable to a cache poisoning attack
File: .github/workflows/release.yaml
Fix guidance: https://docs.zizmor.sh/audits/#cache-poisoning
Locations:
- Line 60 (cols 8–45) — runtime artifacts usually published here
- Line 26 (cols 8–35) — enables caching by default
- Line 25–28 (cols 8–47) — this step
excessive-permissions — High
overly broad permissions
File: .github/workflows/test.yaml
Fix guidance: https://docs.zizmor.sh/audits/#excessive-permissions
Locations:
- Line 8 (cols 2–17) — packages: write is overly broad at the workflow level
unpinned-uses — High (8 similar finding(s))
unpinned action reference
File: .github/workflows/test.yaml
Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses
Locations:
- Line 47 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy) - Line 50 (cols 14–35) — expression
actions/setup-node@v6— action is not pinned to a hash (required by blanket policy) - Line 58 (cols 14–41) — expression
docker/setup-qemu-action@v4— action is not pinned to a hash (required by blanket policy) - Line 61 (cols 14–47) — expression
docker/setup-buildx-action@v4.1.0— action is not pinned to a hash (required by blanket policy) - Line 64 (cols 14–40) — expression
docker/login-action@v4.2.0— action is not pinned to a hash (required by blanket policy) - Line 71 (cols 14–45) — expression
docker/build-push-action@v7.3.0— action is not pinned to a hash (required by blanket policy) - Line 94 (cols 14–35) — expression
actions/setup-node@v6— action is not pinned to a hash (required by blanket policy) - Line 99 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy)
cache-poisoning — High
runtime artifacts potentially vulnerable to a cache poisoning attack
File: .github/workflows/test.yaml
Fix guidance: https://docs.zizmor.sh/audits/#cache-poisoning
Locations:
- Line 71 (cols 8–45) — runtime artifacts usually published here
- Line 50 (cols 8–35) — enables caching by default
- Line 49–52 (cols 8–47) — this step
Please review these findings before merging.
There was a problem hiding this comment.
Summary
| Severity | Count |
|---|---|
| High | 21 |
| Total | 21 |
Details
Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.
template-injection — High
code injection via template expansion
File: .github/workflows/release.yaml
Fix guidance: https://docs.zizmor.sh/audits/#template-injection
Locations:
- Line 79–92 (cols 8–60) — this step
- Line 84 (cols 27–42) — expression
github.workflow— may expand into attacker-controllable code - Line 81 (cols 8–11) — this run block
unpinned-uses — High (9 similar finding(s))
unpinned action reference
File: .github/workflows/release.yaml
Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses
Locations:
- Line 26 (cols 14–35) — expression
actions/setup-node@v6— action is not pinned to a hash (required by blanket policy) - Line 31 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy) - Line 44 (cols 14–41) — expression
docker/setup-qemu-action@v4— action is not pinned to a hash (required by blanket policy) - Line 48 (cols 14–47) — expression
docker/setup-buildx-action@v4.1.0— action is not pinned to a hash (required by blanket policy) - Line 52 (cols 14–40) — expression
docker/login-action@v4.2.0— action is not pinned to a hash (required by blanket policy) - Line 60 (cols 14–45) — expression
docker/build-push-action@v7.3.0— action is not pinned to a hash (required by blanket policy) - Line 77 (cols 14–46) — expression
sigstore/cosign-installer@v4.1.2— action is not pinned to a hash (required by blanket policy) - Line 101 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy) - …and 1 more location(s) in this file.
cache-poisoning — High
runtime artifacts potentially vulnerable to a cache poisoning attack
File: .github/workflows/release.yaml
Fix guidance: https://docs.zizmor.sh/audits/#cache-poisoning
Locations:
- Line 60 (cols 8–45) — runtime artifacts usually published here
- Line 26 (cols 8–35) — enables caching by default
- Line 25–28 (cols 8–47) — this step
excessive-permissions — High
overly broad permissions
File: .github/workflows/test.yaml
Fix guidance: https://docs.zizmor.sh/audits/#excessive-permissions
Locations:
- Line 8 (cols 2–17) — packages: write is overly broad at the workflow level
unpinned-uses — High (8 similar finding(s))
unpinned action reference
File: .github/workflows/test.yaml
Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses
Locations:
- Line 47 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy) - Line 50 (cols 14–35) — expression
actions/setup-node@v6— action is not pinned to a hash (required by blanket policy) - Line 58 (cols 14–41) — expression
docker/setup-qemu-action@v4— action is not pinned to a hash (required by blanket policy) - Line 61 (cols 14–47) — expression
docker/setup-buildx-action@v4.1.0— action is not pinned to a hash (required by blanket policy) - Line 64 (cols 14–40) — expression
docker/login-action@v4.2.0— action is not pinned to a hash (required by blanket policy) - Line 71 (cols 14–45) — expression
docker/build-push-action@v7.3.0— action is not pinned to a hash (required by blanket policy) - Line 94 (cols 14–35) — expression
actions/setup-node@v6— action is not pinned to a hash (required by blanket policy) - Line 99 (cols 14–33) — expression
actions/checkout@v7— action is not pinned to a hash (required by blanket policy)
cache-poisoning — High
runtime artifacts potentially vulnerable to a cache poisoning attack
File: .github/workflows/test.yaml
Fix guidance: https://docs.zizmor.sh/audits/#cache-poisoning
Locations:
- Line 71 (cols 8–45) — runtime artifacts usually published here
- Line 50 (cols 8–35) — enables caching by default
- Line 49–52 (cols 8–47) — this step
Please review these findings before merging.
Bumps docker/build-push-action from 7.2.0 to 7.3.0.
Release notes
Sourced from docker/build-push-action's releases.
Commits
53b7df9Merge pull request #1572 from docker/dependabot/npm_and_yarn/docker/actions-t...154298c[dependabot skip] chore: update generated contentcb1238bchore(deps): Bump@docker/actions-toolkitfrom 0.91.0 to 0.92.024f845dMerge pull request #1566 from docker/dependabot/npm_and_yarn/js-yaml-4.2.09c69730[dependabot skip] chore: update generated contentbc3a3a5Merge pull request #1574 from docker/dependabot/github_actions/aws-actions/co...a82c504chore(deps): Bump js-yaml from 4.1.1 to 4.3.00285a75Merge pull request #1573 from docker/dependabot/github_actions/actions/cache-...c6ad2a3Merge pull request #1575 from docker/dependabot/github_actions/actions/checko...d37484fMerge pull request #1564 from docker/dependabot/npm_and_yarn/undici-6.27.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)