From 1058f96afe52f497b93da5ce9368a9cde4ec94ba Mon Sep 17 00:00:00 2001 From: Azizjon Rizayev <20745242+rizaziz@users.noreply.github.com> Date: Tue, 21 Jul 2026 16:44:39 -0400 Subject: [PATCH 1/3] Upgrade actions/checkout and related actions to v7 --- .github/workflows/main.yml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index f58d47b6..6532a72a 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,7 +15,7 @@ jobs: MAYHEM_TOKEN: ${{ secrets.MAYHEM_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: # fetch entire history to compute diffs between jobs fetch-depth: 0 @@ -28,7 +28,7 @@ jobs: # make sure the action works on a clean machine without building runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: # fetch entire history to compute diffs between jobs fetch-depth: 0 @@ -44,7 +44,7 @@ jobs: args: --image forallsecure/lighttpd:vulnerable --duration 60 - name: Upload SARIF file(s) - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: out/sarif @@ -57,7 +57,7 @@ jobs: # make sure the action works on a clean machine without building runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: # fetch entire history to compute diffs between jobs fetch-depth: 0 @@ -75,21 +75,21 @@ jobs: args: --image forallsecure/lighttpd:vulnerable --duration 60 - name: Archive Coverage report - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: coverage-report path: out/coverage/ if-no-files-found: error - name: Archive JUnit results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: mcode-junit path: out/junit/ if-no-files-found: error - name: Upload SARIF file(s) - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: out/sarif @@ -102,7 +102,7 @@ jobs: # make sure the action works on a clean machine without building runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: # fetch entire history to compute diffs between jobs fetch-depth: 0 @@ -125,7 +125,7 @@ jobs: test-override-inputs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: # fetch entire history to compute diffs between jobs fetch-depth: 0 @@ -154,7 +154,7 @@ jobs: # make sure the action works on a clean machine without building runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: # fetch entire history to compute diffs between jobs fetch-depth: 0 From 75efc6046e36b49304f691b22e7447dff38c8dbc Mon Sep 17 00:00:00 2001 From: Azizjon Rizayev <20745242+rizaziz@users.noreply.github.com> Date: Tue, 21 Jul 2026 16:45:50 -0400 Subject: [PATCH 2/3] Update action-cve version to v1.17.3 --- .github/workflows/dependabot-alerts.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-alerts.yml b/.github/workflows/dependabot-alerts.yml index bf301e79..b8c7b6e3 100644 --- a/.github/workflows/dependabot-alerts.yml +++ b/.github/workflows/dependabot-alerts.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: # X.X.X - Latest version available at: https://github.com/kunalnagarco/action-cve/releases - - uses: kunalnagarco/action-cve@v1.12.36 + - uses: kunalnagarco/action-cve@v1.17.3 with: token: ${{ secrets.PERSONAL_ACCESS_TOKEN }} slack_webhook: ${{ secrets.SLACK_WEBHOOK }} From ab9845949760d57b0976ee1a7f9e5c16ffe40c71 Mon Sep 17 00:00:00 2001 From: Azizjon Rizayev <20745242+rizaziz@users.noreply.github.com> Date: Mon, 3 Aug 2026 17:30:38 -0400 Subject: [PATCH 3/3] Apply suggestions from code review Co-authored-by: d-dot-one <7827408+d-dot-one@users.noreply.github.com> --- .github/workflows/dependabot-alerts.yml | 2 +- .github/workflows/main.yml | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/dependabot-alerts.yml b/.github/workflows/dependabot-alerts.yml index b8c7b6e3..914cdd77 100644 --- a/.github/workflows/dependabot-alerts.yml +++ b/.github/workflows/dependabot-alerts.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: # X.X.X - Latest version available at: https://github.com/kunalnagarco/action-cve/releases - - uses: kunalnagarco/action-cve@v1.17.3 + - uses: kunalnagarco/action-cve@97cf2131ab6fc1c9892b431608fa3c686805a157 # v1.17.3 with: token: ${{ secrets.PERSONAL_ACCESS_TOKEN }} slack_webhook: ${{ secrets.SLACK_WEBHOOK }} diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 6532a72a..ce7feffb 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,7 +15,7 @@ jobs: MAYHEM_TOKEN: ${{ secrets.MAYHEM_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # fetch entire history to compute diffs between jobs fetch-depth: 0 @@ -28,7 +28,7 @@ jobs: # make sure the action works on a clean machine without building runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # fetch entire history to compute diffs between jobs fetch-depth: 0 @@ -57,7 +57,7 @@ jobs: # make sure the action works on a clean machine without building runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # fetch entire history to compute diffs between jobs fetch-depth: 0 @@ -75,14 +75,14 @@ jobs: args: --image forallsecure/lighttpd:vulnerable --duration 60 - name: Archive Coverage report - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: coverage-report path: out/coverage/ if-no-files-found: error - name: Archive JUnit results - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: mcode-junit path: out/junit/ @@ -102,7 +102,7 @@ jobs: # make sure the action works on a clean machine without building runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # fetch entire history to compute diffs between jobs fetch-depth: 0 @@ -125,7 +125,7 @@ jobs: test-override-inputs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # fetch entire history to compute diffs between jobs fetch-depth: 0 @@ -154,7 +154,7 @@ jobs: # make sure the action works on a clean machine without building runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # fetch entire history to compute diffs between jobs fetch-depth: 0