From 8d0528774413a7c5c219c6506d24b46b9611d2b7 Mon Sep 17 00:00:00 2001 From: Andy Loughran Date: Tue, 23 Dec 2025 13:27:32 +0000 Subject: [PATCH 1/5] Fix typo in README header from '.gihub' to '.github' --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 1161c11..5a86cfe 100644 --- a/README.md +++ b/README.md @@ -1 +1 @@ -# .gihub +# .github From 4e9ea13fcd8ab987bf28bcf0d8f81d346e87b050 Mon Sep 17 00:00:00 2001 From: Andy Loughran Date: Tue, 23 Dec 2025 13:29:34 +0000 Subject: [PATCH 2/5] Addressing workflow --- .github/workflows/checkov.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/checkov.yaml b/.github/workflows/checkov.yaml index 19b6ef8..92c4dc2 100644 --- a/.github/workflows/checkov.yaml +++ b/.github/workflows/checkov.yaml @@ -26,7 +26,7 @@ jobs: # Steps represent a sequence of tasks that will be executed as part of the job steps: # Checks-out your repository under $GITHUB_WORKSPACE, so follow-up steps can access it - - uses: actions/checkout@v3 + - uses: actions/checkout@v6 - name: Checkov GitHub Action uses: bridgecrewio/checkov-action@v12 @@ -37,7 +37,7 @@ jobs: external_checks_repos: https://github.com/lockran/checkov_custom_policies - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v3 # Results are generated only on a success or failure # this is required since GitHub by default won't run the next step From ad0f7bc6a147a9df3c9b688c8509cba836f6680e Mon Sep 17 00:00:00 2001 From: Andy Loughran Date: Tue, 23 Dec 2025 13:32:10 +0000 Subject: [PATCH 3/5] Tightening permissions --- .github/workflows/checkov.yaml | 2 ++ .github/workflows/dependency.yaml | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/checkov.yaml b/.github/workflows/checkov.yaml index 92c4dc2..bf9e25c 100644 --- a/.github/workflows/checkov.yaml +++ b/.github/workflows/checkov.yaml @@ -11,6 +11,8 @@ on: # Allows you to run this workflow manually from the Actions tab workflow_dispatch: +permissions: + contents: read # for actions/checkout to fetch code # A workflow run is made up of one or more jobs that can run sequentially or in parallel jobs: # This workflow contains a single job called "scan" diff --git a/.github/workflows/dependency.yaml b/.github/workflows/dependency.yaml index c486c8d..fb2c275 100644 --- a/.github/workflows/dependency.yaml +++ b/.github/workflows/dependency.yaml @@ -8,10 +8,13 @@ on: branches: [ "main" ] pull_request: branches: [ "main" ] - +permissions: + contents: read # for actions/checkout to fetch code jobs: build: runs-on: ubuntu-latest + permissions: + contents: read # for actions/checkout to fetch code steps: - uses: actions/checkout@v4 - name: Anchore SBOM Action From c195fb88b564b1dbe525584313d71cb4326f43d9 Mon Sep 17 00:00:00 2001 From: Andy Loughran Date: Tue, 23 Dec 2025 13:33:22 +0000 Subject: [PATCH 4/5] Upgraded CodeQL action --- .github/workflows/checkov.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/checkov.yaml b/.github/workflows/checkov.yaml index bf9e25c..f50d421 100644 --- a/.github/workflows/checkov.yaml +++ b/.github/workflows/checkov.yaml @@ -39,7 +39,7 @@ jobs: external_checks_repos: https://github.com/lockran/checkov_custom_policies - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 # Results are generated only on a success or failure # this is required since GitHub by default won't run the next step From 92d36fb5f097f9fa93475f769968f2284dfff4f2 Mon Sep 17 00:00:00 2001 From: Andy Loughran Date: Tue, 23 Dec 2025 13:39:30 +0000 Subject: [PATCH 5/5] Added version --- .github/workflows/dependency.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/dependency.yaml b/.github/workflows/dependency.yaml index fb2c275..6c59baf 100644 --- a/.github/workflows/dependency.yaml +++ b/.github/workflows/dependency.yaml @@ -28,5 +28,6 @@ jobs: serverHostname: 'depapi.zrmt.com' apiKey: ${{ secrets.DEPENDENCY_TRACK_API_KEY }} projectName: ${{ github.repository }} + projectVersion: ${{ github.sha }} bomFilename: "/tmp/sbom.json" autoCreate: true