[dorssel]

This PR exists just to silence GitHub from suggesting to create one. This PR will be closed (without merge) immediately.

The 'slsa' branch exists just to fix the fact that we want hash-pinning of actions, but generator_generic_slsa3 only works with version pinning.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml	2.1.0	🟢 6.7	Details Check Score Reason Maintained ⚠️ 1 1 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 1 Code-Review 🟢 10 all changesets reviewed Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4 CII-Best-Practices 🟢 5 badge detected: Passing Signed-Releases 🟢 10 5 out of the last 5 releases have a total of 5 signed artifacts. License 🟢 10 license file detected SAST 🟢 7 SAST tool detected but not run on all commits Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 2 branch protection is not maximal on development and all release branches Vulnerabilities ⚠️ 0 239 existing vulnerabilities detected CI-Tests ⚠️ 0 2 out of 28 merged PRs checked by a CI test -- score normalized to 0 Contributors 🟢 10 project has 33 contributing companies or organizations

Scanned Files

• .github/workflows/slsa.yml

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (e578ab3) to head (cb61f54).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #139   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            2         2           
  Lines           37        37           
  Branches         3         3           
=========================================
  Hits            37        37           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
✅ ACTION	actionlint	8		0		0	0.11s
❌ ACTION	zizmor	8		17		0	3.33s
✅ EDITORCONFIG	editorconfig-checker	48		0		0	0.06s
✅ JSON	jsonlint	2		0		0	0.09s
✅ JSON	prettier	2		0		0	0.3s
✅ JSON	v8r	2		0		0	3.6s
✅ MARKDOWN	markdownlint	2		0		0	0.43s
✅ MARKDOWN	markdown-table-formatter	2		0		0	0.25s
✅ REPOSITORY	betterleaks	yes		no		no	0.56s
✅ REPOSITORY	checkov	yes		no		no	20.33s
✅ REPOSITORY	git_diff	yes		no		no	0.01s
✅ REPOSITORY	grype	yes		no		no	92.62s
✅ REPOSITORY	osv-scanner	yes		no		no	0.45s
✅ REPOSITORY	secretlint	yes		no		no	1.11s
✅ REPOSITORY	syft	yes		no		no	1.96s
✅ REPOSITORY	trivy-sbom	yes		no		no	0.63s
✅ REPOSITORY	trufflehog	yes		no		no	5.74s
✅ XML	xmllint	14		0		0	0.15s
✅ YAML	prettier	13		0		0	0.79s
✅ YAML	v8r	13		0		0	12.36s
✅ YAML	yamllint	13		0		0	0.66s

Detailed Issues

❌ ACTION / zizmor - 17 errors

INFO zizmor: 🌈 zizmor v1.25.0
 INFO audit: zizmor: 🌈 completed .github/workflows/codeql.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/devskim.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/dotnet.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/mega-linter.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/nuget.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/openssf.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/reuse.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/slsa.yml
error[unpinned-uses]: unpinned action reference
  --> .github/workflows/slsa.yml:67:11
   |
67 |     uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 # f7dd8c54c2067bafc12ca7a55595d5...
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

17 findings (16 suppressed, 1 unsafe fixes): 0 informational, 0 low, 0 medium, 1 high

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository