[Security] Workflow build.yml is using vulnerable action gradle/wrapper-validation-action

Pi4J / pi4j-intellij-plugin

Plugin to facilitate programming in IntelliJ IDEA for the Raspberry Pi

4 stars 1 forks source link

[Security] Workflow build.yml is using vulnerable action gradle/wrapper-validation-action #1

Open fockboi-lgtm opened 2 years ago

fockboi-lgtm commented 2 years ago

The workflow build.yml is referencing action gradle/wrapper-validation-action using references v1.0.4. However this reference is missing the commit 89eda1fdc0167f59521d2bb10767f7169fb4d018 which may contain fix to the some vulnerability. The vulnerability fix that is missing by actions version could be related to: (1) CVE fix (2) upgrade of vulnerable dependency (3) fix to secret leak and others. Please consider to update the reference to the action.

FDelporte commented 2 years ago

As no work has been done on this project yet, I'm going to remove it and hope we can work on it soon... We will first need to agree on functionalities, can be done in https://github.com/Pi4J/pi4j-v2/discussions/111