search

semgr8ns / semgr8s

Semgrep-based Policy Controller for Kubernetes
https://semgr8ns.github.io/semgr8s/
Apache License 2.0
5 stars 0 forks source link

update: bump the gh-actions-packages group across 1 directory with 3 updates #271

Closed dependabot[bot] closed 3 months ago

dependabot[bot] commented 3 months ago

Bumps the gh-actions-packages group with 3 updates in the / directory: github/codeql-action, bridgecrewio/checkov-action and mikepenz/action-junit-report.

Updates github/codeql-action from 3.25.6 to 3.25.8

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

No user facing changes.

3.25.8 - 04 Jun 2024

  • Update default CodeQL bundle version to 2.17.4. #2321

3.25.7 - 31 May 2024

  • We are rolling out a feature in May/June 2024 that will reduce the Actions cache usage of the Action by keeping only the newest TRAP cache for each language. #2306

3.25.6 - 20 May 2024

  • Update default CodeQL bundle version to 2.17.3. #2295

3.25.5 - 13 May 2024

  • Add a compatibility matrix of supported CodeQL Action, CodeQL CLI, and GitHub Enterprise Server versions to the https://github.com/github/codeql-action/blob/main/README.md. #2273
  • Avoid printing out a warning for a missing on.push trigger when the CodeQL Action is triggered via a workflow_call event. #2274
  • The tools: latest input to the init Action has been renamed to tools: linked. This option specifies that the Action should use the tools shipped at the same time as the Action. The old name will continue to work for backwards compatibility, but we recommend that new workflows use the new name. #2281

3.25.4 - 08 May 2024

  • Update default CodeQL bundle version to 2.17.2. #2270

3.25.3 - 25 Apr 2024

  • Update default CodeQL bundle version to 2.17.1. #2247
  • Workflows running on macos-latest using CodeQL CLI versions before v2.15.1 will need to either upgrade their CLI version to v2.15.1 or newer, or change the platform to an Intel MacOS runner, such as macos-12. ARM machines with SIP disabled, including the newest macos-latest image, are unsupported for CLI versions before 2.15.1. #2261

3.25.2 - 22 Apr 2024

No user facing changes.

3.25.1 - 17 Apr 2024

  • We are rolling out a feature in April/May 2024 that improves the reliability and performance of analyzing code when analyzing a compiled language with the autobuild build mode. #2235
  • Fix a bug where the init Action would fail if --overwrite was specified in CODEQL_ACTION_EXTRA_OPTIONS. #2245

3.25.0 - 15 Apr 2024

  • The deprecated feature for extracting dependencies for a Python analysis has been removed. #2224

... (truncated)

Commits
  • 2e230e8 Merge pull request #2323 from github/update-v3.25.8-18b06dd1d
  • 66ad891 Update changelog for v3.25.8
  • 18b06dd Merge pull request #2322 from github/dependabot/npm_and_yarn/npm-10d82c2911
  • 200dd0c Update checked-in dependencies
  • 2bb35ea bump the npm group with 4 updates
  • 9c15e42 Merge pull request #2321 from github/update-bundle/codeql-bundle-v2.17.4
  • 98e7922 Merge branch 'main' into update-bundle/codeql-bundle-v2.17.4
  • 440350b Add changelog note
  • d4fcc8b Update default bundle to codeql-bundle-v2.17.4
  • add199b Merge pull request #2320 from github/angelapwen/use-linked-in-tests
  • Additional commits viewable in compare view


Updates bridgecrewio/checkov-action from 12.2762.0 to 12.2769.0

Commits
  • 4f1262e Bump checkov container version to 3.2.125
  • 6ab2f42 Bump checkov container version to 3.2.124
  • 9342aec Bump checkov container version to 3.2.123
  • 48a1028 Bump checkov container version to 3.2.122
  • 329e2bb Bump checkov container version to 3.2.115
  • 3568801 Bump checkov container version to 3.2.114
  • 5ec4ca5 Bump checkov container version to 3.2.113
  • See full diff in compare view


Updates mikepenz/action-junit-report from 4.2.1 to 4.2.2

Release notes

Sourced from mikepenz/action-junit-report's releases.

v4.2.2

🚀 Features

📦 Dependencies

  • Dependency upgrades
Commits


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
github-actions[bot] commented 3 months ago

Dependency Review

The following issues were found:

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 6ec6c3e96c6857218b12ef3592ea370d19b63efb.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

.github/workflows/.reusable-sast.yml

PackageVersionLicenseIssue Type
bridgecrewio/checkov-action4f1262efb561a0057cbedffffb93644228257c9eNullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
actions/github/codeql-action/upload-sarif 2e230e8fe0ad3a14a340ad0815ddb96d599d2aff UnknownUnknown
actions/github/codeql-action/upload-sarif 9fdb3e49720b44c48891d036bb502feb25684276 UnknownUnknown
actions/bridgecrewio/checkov-action 4f1262efb561a0057cbedffffb93644228257c9e UnknownUnknown
actions/github/codeql-action/analyze 2e230e8fe0ad3a14a340ad0815ddb96d599d2aff UnknownUnknown
actions/github/codeql-action/init 2e230e8fe0ad3a14a340ad0815ddb96d599d2aff UnknownUnknown
actions/github/codeql-action/upload-sarif 2e230e8fe0ad3a14a340ad0815ddb96d599d2aff UnknownUnknown
actions/bridgecrewio/checkov-action cbef505ba3282486a24541d7c862e19266ad0d96 UnknownUnknown
actions/github/codeql-action/analyze 9fdb3e49720b44c48891d036bb502feb25684276 UnknownUnknown
actions/github/codeql-action/init 9fdb3e49720b44c48891d036bb502feb25684276 UnknownUnknown
actions/github/codeql-action/upload-sarif 9fdb3e49720b44c48891d036bb502feb25684276 UnknownUnknown
actions/mikepenz/action-junit-report ac30be7acb0a361e5492575ab42e47fcadec4928 :green_circle: 5.7
Details
CheckScoreReason
Code-Review:warning: 1Found 2/12 approved changesets -- score normalized to 1
Maintained:green_circle: 1017 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 10license file detected
Security-Policy:green_circle: 10security policy file detected
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Packaging:warning: -1packaging workflow not detected
Binary-Artifacts:green_circle: 10no binaries found in the repo
Token-Permissions:warning: 0detected GitHub workflow tokens with excessive permissions
Signed-Releases:warning: -1no releases found
Branch-Protection:warning: 0branch protection not enabled on development/release branches
Fuzzing:warning: 0project is not fuzzed
SAST:green_circle: 9SAST tool detected but not run on all commits
Pinned-Dependencies:warning: 0dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities:green_circle: 100 existing vulnerabilities detected
actions/mikepenz/action-junit-report 9379f0ccddcab154835d4e2487555ee79614fe95 :green_circle: 5.7
Details
CheckScoreReason
Code-Review:warning: 1Found 2/12 approved changesets -- score normalized to 1
Maintained:green_circle: 1017 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices:warning: 0no effort to earn an OpenSSF best practices badge detected
License:green_circle: 10license file detected
Security-Policy:green_circle: 10security policy file detected
Dangerous-Workflow:green_circle: 10no dangerous workflow patterns detected
Packaging:warning: -1packaging workflow not detected
Binary-Artifacts:green_circle: 10no binaries found in the repo
Token-Permissions:warning: 0detected GitHub workflow tokens with excessive permissions
Signed-Releases:warning: -1no releases found
Branch-Protection:warning: 0branch protection not enabled on development/release branches
Fuzzing:warning: 0project is not fuzzed
SAST:green_circle: 9SAST tool detected but not run on all commits
Pinned-Dependencies:warning: 0dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities:green_circle: 100 existing vulnerabilities detected

Scanned Manifest Files

.github/workflows/.reusable-compliance.yml
  • github/codeql-action/upload-sarif@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff
  • github/codeql-action/upload-sarif@9fdb3e49720b44c48891d036bb502feb25684276
.github/workflows/.reusable-sast.yml
  • bridgecrewio/checkov-action@4f1262efb561a0057cbedffffb93644228257c9e
  • github/codeql-action/analyze@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff
  • github/codeql-action/init@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff
  • github/codeql-action/upload-sarif@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff
  • bridgecrewio/checkov-action@cbef505ba3282486a24541d7c862e19266ad0d96
  • github/codeql-action/analyze@9fdb3e49720b44c48891d036bb502feb25684276
  • github/codeql-action/init@9fdb3e49720b44c48891d036bb502feb25684276
  • github/codeql-action/upload-sarif@9fdb3e49720b44c48891d036bb502feb25684276
.github/workflows/.reusable-unit-test.yml
  • mikepenz/action-junit-report@ac30be7acb0a361e5492575ab42e47fcadec4928
  • mikepenz/action-junit-report@9379f0ccddcab154835d4e2487555ee79614fe95
github-actions[bot] commented 3 months ago

Coverage

Coverage Report
FileStmtsMissCoverMissing
semgr8s
   __main__.py16160%5–29
   app.py78396%116, 176–177
   k8s_api.py22291%43–44
   updater.py29293%49–50
TOTAL1972388% 

Tests Skipped Failures Errors Time
18 0 :zzz: 0 :x: 0 :fire: 2.331s :stopwatch:
dependabot[bot] commented 3 months ago

Looks like these dependencies are updatable in another way, so this is no longer needed.