dsalaj is testing updates for a SnowForm Terraform Module 馃殌 #3
dsalajgithub_actions.yaml
on: push
TFLint
6s
Terraform Format
7s
Unit Tests
9s
KICS Security Scan
1m 8s
Annotations
9 warnings
|
TFLint
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v3, actions/checkout@v4, terraform-linters/setup-tflint@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Terraform Format
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, opentofu/setup-opentofu@v1. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Unit Tests
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, opentofu/setup-opentofu@v1. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
KICS Security Scan
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
[LOW] Unpinned Actions Full Length Commit SHA:
.github/workflows/github_actions.yaml#L74
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
|
|
[LOW] Unpinned Actions Full Length Commit SHA:
.github/workflows/github_actions.yaml#L20
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
|
|
[LOW] Unpinned Actions Full Length Commit SHA:
.github/workflows/github_actions.yaml#L56
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
|
|
[LOW] Unpinned Actions Full Length Commit SHA:
.github/workflows/github_actions.yaml#L41
Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
|
|
KICS Security Scan
Unexpected input(s) 'disable_progress_bar', valid inputs are ['entryPoint', 'args', 'token', 'enable_annotations', 'enable_comments', 'enable_jobs_summary', 'comments_with_queries', 'excluded_column_for_comments_with_queries', 'path', 'ignore_on_exit', 'fail_on', 'timeout', 'profiling', 'config_path', 'platform_type', 'exclude_paths', 'exclude_queries', 'exclude_categories', 'exclude_results', 'exclude_severities', 'exclude_gitignore', 'output_formats', 'output_path', 'payload_path', 'queries', 'secrets_regexes_path', 'libraries_path', 'disable_full_descriptions', 'disable_secrets', 'type', 'verbose', 'include_queries', 'bom', 'cloud_provider']
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
kics-results.json
Expired
|
1.32 KB |
sha256:199470263f663b79bc63b0598406893725da77b3e71e5ae5f97ff1945c173397
|
|