codecov-commenter
commented
8 months ago Codecov Report
Merging #572 (324173a) into master (c9b7aa2) will not change coverage. The diff coverage is
n/a.
:exclamation: Your organization needs to install the Codecov GitHub app to enable full functionality.
@@ Coverage Diff @@
## master #572 +/- ##
=======================================
Coverage 94.70% 94.70%
=======================================
Files 11 11
Lines 2362 2362
=======================================
Hits 2237 2237
Misses 125 125 :mega: We’re building smart automated test selection to slash your CI/CD build times. Learn more
Summary
This pull request is created by Secure Repo at the request of @donkirkby. Please merge the Pull Request to incorporate the requested changes. Please tag @donkirkby on your message if you have any questions related to the PR. You can also engage with the StepSecurity team by tagging @step-security-bot.
Security Fixes
Pinned Dependencies
GitHub Action tags and Docker tags are mutatble. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.
Secure Dockerfiles
Pin image tags to digests in Dockerfiles. With the Docker v2 API release, it became possible to use digests in place of tags when pulling images or to use them in FROM lines in Dockerfiles.
Feedback
For bug reports, feature requests, and general feedback; please create an issue in step-security/secure-repo. To create such PRs, please visit https://app.stepsecurity.io/securerepo.
Signed-off-by: StepSecurity Bot bot@stepsecurity.io