[Security] Workflow release-drafter.yml is using vulnerable action raboof/release-drafter

akka / akka-projection

Akka Projections is intended for building systems with the CQRS pattern, and facilitate in event-based service-to-service communication.

https://doc.akka.io/libraries/akka-projection/current/

Other

102 stars 35 forks source link

[Security] Workflow release-drafter.yml is using vulnerable action raboof/release-drafter #619

Closed Ale0x78 closed 1 year ago

Ale0x78 commented 2 years ago

The workflow release-drafter.yml is referencing action raboof/release-drafter using references v5. However this reference is missing the commit 70eb821099dbcd875c2cba75dad4332d3cf5544d which may contain fix to the some vulnerability. The vulnerability fix that is missing by actions version could be related to: (1) CVE fix (2) upgrade of vulnerable dependency (3) fix to secret leak and others. Please consider to update the reference to the action.

ennru commented 1 year ago

We have upgraded the action to version 5.22.0.

https://github.com/akka/akka-projection/blob/35d6ef76a88407c459a4547a2dbe3fa90029f213/.github/workflows/release-drafter.yml#L18-L21