[dependabot]

Bumps midnightntwrk/upload-sarif-github-action from 07dad711370cc5985885ebcf07cb8c9264bc4167 to 7fe90dc28a92dd00d353fa49c8e9eedc3a207799.

Changelog

Sourced from midnightntwrk/upload-sarif-github-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Added

• zizmor runs online, always. Its known-vulnerable-actions audit is the only check here on the actions a workflow uses: - tj-actions/changed-files@v35 passed every other scanner. Uses github_token, default github.token, as an earth secret read by +zizmor only. No offline switch: a missing token fails the scan. Adds about 2s
• No apt in any scanner image. The CA bundle comes from the digest-pinned curl image and jq is a pinned, attested static binary (1.8.2, also used by +test). apt installed whatever the mirror served that day and was the slowest step: scorecard spent 41s of 53s in it. scorecard no longer pulls in git or perl
• osv-scanner v2.7.0 runs as a seventh scanner. It overlaps trivy on CVEs, but its reason to be here is OSV's MAL-* malicious-packages feed, which trivy does not carry: a lockfile naming a known-malicious package now fails at every fail_severity, like a committed secret. CVEs are banded by CVSS. Rust call analysis stays off because it runs the scanned repo's build scripts. A repo's osv-scanner.toml is honoured, the same file scorecard's Vulnerabilities check already reads. Skip it with skip_osv_scan: true

Fixed

• # nosemgrep and # checkov:skip= now clear the gate. Both scanners report a suppressed finding anyway, marked suppressions: inSource as SARIF asks; GitHub's Security tab honoured the mark and the gate did not, so the documented way to clear a false positive left the build red on every repo. Honoured per SARIF 3.35.3 (rejected and underReview still count), listed in the job summary rather than hidden, never for a gitleaks secret

Changed

• fail_severity defaults to high, was critical. A HIGH CVE in a lockfile, an opengrep error at medium confidence or a scorecard check scoring 0 now fails a repository that sets nothing. Only trivy and opengrep ever emit CRITICAL, so the old

... (truncated)

Commits

• 7fe90dc Merge pull request #158 from midnightntwrk/giles-fail-high
• dc7d75d chore: DCO remediation for giles-bot <319052204+giles-bot@users.noreply.githu...
• c93c2d6 test(earthfile): ship action.yml into the hermetic test image
• 2ce9834 docs(action): keep the severity example in ladder order
• 68f089b feat(gate): default fail_severity to high, was critical
• 6e93ae0 Merge pull request #155 from midnightntwrk/giles-no-apt
• 5a0f6d4 chore: DCO remediation for giles-bot <319052204+giles-bot@users.noreply.githu...
• f2ab258 ci: run on pull requests to any base, so stacked PRs get CI
• 4eec1ad Merge branch 'main' into giles-no-apt
• 5821ee4 Merge pull request #154 from midnightntwrk/giles-osv-scanner
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.