Merge pull request #2628 from OWASP/renovate/gatling-maven-plugin.ver… #485
commjoenmaster-container-publish.yml
on: push
build-and-publish
11m 21s
Annotations
9 warnings
|
build-and-publish
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: docker/build-push-action@v6, docker/login-action@v3, docker/metadata-action@v5, docker/setup-buildx-action@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Sensitive data should not be used in the ARG or ENV commands:
Dockerfile#L22
SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "GOOGLE_SERVICE_ACCOUNT_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
|
|
Sensitive data should not be used in the ARG or ENV commands:
Dockerfile#L21
SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "WRONGSECRETS_MCP_SECRET")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
|
|
Sensitive data should not be used in the ARG or ENV commands:
Dockerfile#L19
SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "AZURE_KEY_VAULT_ENABLED")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
|
|
Sensitive data should not be used in the ARG or ENV commands:
Dockerfile#L18
SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "DOCKER_ENV_PASSWORD")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
|
|
Variables should be defined before their use:
Dockerfile#L17
UndefinedVar: Usage of undefined variable '$argBasedVersion'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
|
|
Sensitive data should not be used in the ARG or ENV commands:
Dockerfile#L16
SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "ARG_BASED_PASSWORD")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
|
|
JSON arguments recommended for ENTRYPOINT/CMD to prevent unintended behavior related to OS signals:
Dockerfile#L79
JSONArgsRecommended: JSON arguments recommended for CMD to prevent unintended behavior related to OS signals
More info: https://docs.docker.com/go/dockerfile/rule/json-args-recommended/
|
|
Sensitive data should not be used in the ARG or ENV commands:
Dockerfile#L24
SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "GOOGLE_SERVICE_ACCOUNT_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
OWASP~wrongsecrets~SHO12S.dockerbuild
|
197 KB |
sha256:80a062ae467959bca2de0007184f9cd62bc099ee34bdcb4216649307d1a48c05
|
|