Skip to content

revert: restore original pip-action before StepSecurity subscription expires#13

Open
JubbaSmail wants to merge 1 commit intomasterfrom
revert/remove-stepsecurity-actions
Open

revert: restore original pip-action before StepSecurity subscription expires#13
JubbaSmail wants to merge 1 commit intomasterfrom
revert/remove-stepsecurity-actions

Conversation

@JubbaSmail
Copy link

Summary

  • Reverts step-security/pip-action@v1 back to the original upstream BSFishy/pip-action@v1 in the convertKqlFunctionYamlToArmTemplate workflow
  • The StepSecurity subscription is expiring and forked actions will stop working, breaking CI pipelines
  • This is a preventive measure informed by the Feb 12 CI outage in miro-infra-stack where expired StepSecurity actions caused pipeline failures

Changes

  • .github/workflows/convertKqlFunctionYamlToArmTemplate.yaml: replaced step-security/pip-action@v1 with BSFishy/pip-action@v1

Test plan

  • Verify the convertKqlFunctionYamlToArmTemplate workflow runs successfully with the restored BSFishy/pip-action@v1
  • Confirm yamale package installs correctly in the workflow

…ription expires

Replace step-security/pip-action@v1 with BSFishy/pip-action@v1 to avoid
CI breakage when the StepSecurity subscription expires. This reverts the
fork back to the original upstream action.
architecture: 'x64'
- name: Install yamale package
uses: step-security/pip-action@v1
uses: BSFishy/pip-action@v1

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Convert Kql function yaml to ARM template' step
Uses Step
uses 'BSFishy/pip-action' with ref 'v1', not a pinned commit hash
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant