From a6e57525f0a85f1f21e050b14652ad505103cc64 Mon Sep 17 00:00:00 2001 From: pdewilde Date: Thu, 20 Nov 2025 13:07:16 -0800 Subject: [PATCH 1/2] Add a workflow that will trigger action scanner to ensure behavior is as expected --- .github/workflows/vulnerable_workflow.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 .github/workflows/vulnerable_workflow.yml diff --git a/.github/workflows/vulnerable_workflow.yml b/.github/workflows/vulnerable_workflow.yml new file mode 100644 index 0000000..69ac0f0 --- /dev/null +++ b/.github/workflows/vulnerable_workflow.yml @@ -0,0 +1,22 @@ +name: 'Vulnerable Workflow To Test Action Scanning' + +on: + pull_request_target: + types: ['opened', 'synchronize'] + +jobs: + vulnerable-job: + runs-on: 'ubuntu-latest' + steps: + - name: 'Checkout' + uses: 'actions/checkout@v3' + with: + ref: '${{ github.event.pull_request.head.sha }}' + + - name: 'Run PR Code' + run: | + echo "Echo not actually running anything, but the scanner isn't smart enough to know that." + if false; then + chmod +x build.sh + ./build.sh + fi From bcbfba9af3eb13d8e1e3eecca787cd03d0e1c63e Mon Sep 17 00:00:00 2001 From: pdewilde Date: Thu, 20 Nov 2025 17:30:26 -0800 Subject: [PATCH 2/2] Fix lint --- .github/workflows/vulnerable_workflow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/vulnerable_workflow.yml b/.github/workflows/vulnerable_workflow.yml index 69ac0f0..76a06c7 100644 --- a/.github/workflows/vulnerable_workflow.yml +++ b/.github/workflows/vulnerable_workflow.yml @@ -9,7 +9,7 @@ jobs: runs-on: 'ubuntu-latest' steps: - name: 'Checkout' - uses: 'actions/checkout@v3' + uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4 with: ref: '${{ github.event.pull_request.head.sha }}'