-
Notifications
You must be signed in to change notification settings - Fork 474
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Pinned-Dependencies incorrectly flags a pinned dependency downloaded from GitHub #3339
Labels
Comments
This issue is stale because it has been open for 60 days with no activity. |
I'm going to have a quick look to see if I can fix this myself. |
martincostello
added a commit
to martincostello/scorecard
that referenced
this issue
Nov 27, 2023
Trust files that are downloaded from `raw.githubusercontent.com` where the file's ref is a Git SHA and therefore immutable. Resolves ossf#3339. Signed-off-by: martincostello <martin@martincostello.com>
2 tasks
martincostello
added a commit
to martincostello/scorecard
that referenced
this issue
Nov 27, 2023
Trust files that are downloaded from `raw.githubusercontent.com` where the file's ref is a Git SHA and therefore immutable. Resolves ossf#3339. Signed-off-by: martincostello <martin@martincostello.com>
martincostello
added a commit
to martincostello/scorecard
that referenced
this issue
Nov 27, 2023
Trust files that are downloaded from `raw.githubusercontent.com` where the file's ref is a Git SHA and therefore immutable. Resolves ossf#3339. Signed-off-by: martincostello <martin@martincostello.com>
martincostello
added a commit
to martincostello/scorecard
that referenced
this issue
Nov 28, 2023
Trust files that are downloaded from `raw.githubusercontent.com` where the file's ref is a Git SHA and therefore immutable. Resolves ossf#3339. Signed-off-by: martincostello <martin@martincostello.com>
martincostello
added a commit
to martincostello/scorecard
that referenced
this issue
Nov 28, 2023
Trust files that are downloaded from `raw.githubusercontent.com` where the file's ref is a Git SHA and therefore immutable. Resolves ossf#3339. Signed-off-by: martincostello <martin@martincostello.com>
martincostello
added a commit
to martincostello/scorecard
that referenced
this issue
Nov 29, 2023
Trust files that are downloaded from `raw.githubusercontent.com` where the file's ref is a Git SHA and therefore immutable. Resolves ossf#3339. Signed-off-by: martincostello <martin@martincostello.com>
martincostello
added a commit
to martincostello/scorecard
that referenced
this issue
Nov 30, 2023
Trust files that are downloaded from `raw.githubusercontent.com` where the file's ref is a Git SHA and therefore immutable. Resolves ossf#3339. Signed-off-by: martincostello <martin@martincostello.com>
spencerschrock
pushed a commit
that referenced
this issue
Nov 30, 2023
* Trust pinned GitHub download URLs Trust files that are downloaded from `raw.githubusercontent.com` where the file's ref is a Git SHA and therefore immutable. Resolves #3339. Signed-off-by: martincostello <martin@martincostello.com> * Move logic to function - Add `hasUnpinnedURLs` function. - Add test cases for different URLs. Signed-off-by: martincostello <martin@martincostello.com> * Fix formatting Appease the linter. Signed-off-by: martincostello <martin@martincostello.com> * Suppress lint warnings Suppress warning on three long URLs. Signed-off-by: martincostello <martin@martincostello.com> * Address peer review Address peer review feedback. Signed-off-by: martincostello <martin@martincostello.com> * Fix lint warning Fix lint warning. Signed-off-by: martincostello <martin@martincostello.com>
ashearin
pushed a commit
to kgangerlm/scorecard-gitlab
that referenced
this issue
Dec 4, 2023
* Trust pinned GitHub download URLs Trust files that are downloaded from `raw.githubusercontent.com` where the file's ref is a Git SHA and therefore immutable. Resolves ossf#3339. Signed-off-by: martincostello <martin@martincostello.com> * Move logic to function - Add `hasUnpinnedURLs` function. - Add test cases for different URLs. Signed-off-by: martincostello <martin@martincostello.com> * Fix formatting Appease the linter. Signed-off-by: martincostello <martin@martincostello.com> * Suppress lint warnings Suppress warning on three long URLs. Signed-off-by: martincostello <martin@martincostello.com> * Address peer review Address peer review feedback. Signed-off-by: martincostello <martin@martincostello.com> * Fix lint warning Fix lint warning. Signed-off-by: martincostello <martin@martincostello.com> Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Is your feature request related to a problem? Please describe.
I have a GitHub Actions workflow that uses rhysd/actionlint to lint GitHub Actions workflow files. As per its own documentation it is used by running a bash script to download and install the tool.
I however changed the value of
main
to the SHA so that it is pinned:This was then flagged as an unpinned dependency as the code doesn't walk the whole step to find the referenced environment variable is a SHA to pin the download. It would be nice if it did, but it's understandable that it doesn't support that.
I then refactored to remove the environment variable like so:
This however still flags the warning:
Describe the solution you'd like
The Pinned-Dependencies rule is able to correctly determine that URLs of this format to raw GitHub content in repositories are pinned.
Describe alternatives you've considered
None.
Additional context
None.
The text was updated successfully, but these errors were encountered: