chore: bump docker/build-push-action from 7.2.0 to 7.3.0 - #123

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	21
Total	21

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

template-injection — High

code injection via template expansion

File: .github/workflows/release.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 79–92 (cols 8–60) — this step
• Line 84 (cols 27–42) — expression github.workflow — may expand into attacker-controllable code
• Line 81 (cols 8–11) — this run block

unpinned-uses — High (9 similar finding(s))

unpinned action reference

File: .github/workflows/release.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 26 (cols 14–35) — expression actions/setup-node@v6 — action is not pinned to a hash (required by blanket policy)
• Line 31 (cols 14–33) — expression actions/checkout@v7 — action is not pinned to a hash (required by blanket policy)
• Line 44 (cols 14–41) — expression docker/setup-qemu-action@v4 — action is not pinned to a hash (required by blanket policy)
• Line 48 (cols 14–47) — expression docker/setup-buildx-action@v4.1.0 — action is not pinned to a hash (required by blanket policy)
• Line 52 (cols 14–40) — expression docker/login-action@v4.2.0 — action is not pinned to a hash (required by blanket policy)
• Line 60 (cols 14–45) — expression docker/build-push-action@v7.3.0 — action is not pinned to a hash (required by blanket policy)
• Line 77 (cols 14–46) — expression sigstore/cosign-installer@v4.1.2 — action is not pinned to a hash (required by blanket policy)
• Line 101 (cols 14–33) — expression actions/checkout@v7 — action is not pinned to a hash (required by blanket policy)
• …and 1 more location(s) in this file.

cache-poisoning — High

runtime artifacts potentially vulnerable to a cache poisoning attack

File: .github/workflows/release.yaml

Fix guidance: https://docs.zizmor.sh/audits/#cache-poisoning

Locations:

• Line 60 (cols 8–45) — runtime artifacts usually published here
• Line 26 (cols 8–35) — enables caching by default
• Line 25–28 (cols 8–47) — this step

excessive-permissions — High

overly broad permissions

File: .github/workflows/test.yaml

Fix guidance: https://docs.zizmor.sh/audits/#excessive-permissions

Locations:

• Line 8 (cols 2–17) — packages: write is overly broad at the workflow level

unpinned-uses — High (8 similar finding(s))

unpinned action reference

File: .github/workflows/test.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 47 (cols 14–33) — expression actions/checkout@v7 — action is not pinned to a hash (required by blanket policy)
• Line 50 (cols 14–35) — expression actions/setup-node@v6 — action is not pinned to a hash (required by blanket policy)
• Line 58 (cols 14–41) — expression docker/setup-qemu-action@v4 — action is not pinned to a hash (required by blanket policy)
• Line 61 (cols 14–47) — expression docker/setup-buildx-action@v4.1.0 — action is not pinned to a hash (required by blanket policy)
• Line 64 (cols 14–40) — expression docker/login-action@v4.2.0 — action is not pinned to a hash (required by blanket policy)
• Line 71 (cols 14–45) — expression docker/build-push-action@v7.3.0 — action is not pinned to a hash (required by blanket policy)
• Line 94 (cols 14–35) — expression actions/setup-node@v6 — action is not pinned to a hash (required by blanket policy)
• Line 99 (cols 14–33) — expression actions/checkout@v7 — action is not pinned to a hash (required by blanket policy)

cache-poisoning — High

runtime artifacts potentially vulnerable to a cache poisoning attack

File: .github/workflows/test.yaml

Fix guidance: https://docs.zizmor.sh/audits/#cache-poisoning

Locations:

• Line 71 (cols 8–45) — runtime artifacts usually published here
• Line 50 (cols 8–35) — enables caching by default
• Line 49–52 (cols 8–47) — this step

Please review these findings before merging.

Click 'View more details' to see the workflow run and detailed results in the Bulwark repository.