4 ms·
You lose vulnerability alerts, on GitHub. This is a (ridiculous, IMO) platform limitation that GitHub could lift by applying more engineering time to Dependabot
by woodruffw 6mo ago
You lose vulnerability alerts, on GitHub. This is a (ridiculous, IMO) platform limitation that GitHub could lift by applying more engineering time to Dependabot and Dependabot's integrated security alerts feature.
zizmor (and other tools) correctly recovers vulnerability information for SHA-pinned actions[1].
[1]: https://docs.zizmor.sh/audits/#known-vulnerable-actions https://docs.zizmor.sh/audits/#known-vulnerable-actions
- mmarian 6mo agoI agree, silly limitation. On zizmor, there's no mention of coverage on commit SHA the section you've linked, nor in the entire page when I do Ctrl+F. Is there anything I'm missing?
- woodruffw 6mo agoOh, I guess I didn't document it explicitly. My bad! You can see it in the source here[1]. [1]: https://github.com/zizmorcore/zizmor/blob/db5ed6b3bb445848a8e7b1920a12c9c664d08a33/crates/zizmor/src/audit/known_vulnerable_actions.rs#L84-L98 https://github.com/zizmorcore/zizmor/blob/db5ed6b3bb445848a8...
- mmarian 6mo agoOh, nice, will look into it, thanks! Let me know if you're aware of any other tools that do this. I had a look before and couldn't find any.