Skip to content

Update unsecure.yaml #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
try-panwiac wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update unsecure.yaml #7

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/unsecure.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,6 @@ jobs:
name: job3
runs-on: ubuntu-latest
env:
ACTIONS_ALLOW_UNSECURE_COMMANDS: false
ACTIONS_ALLOW_UNSECURE_COMMANDS: true
Copy link

@prisma-cloud-devsecops prisma-cloud-devsecops bot May 8, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MEDIUM  GitHub Actions ACTIONS_ALLOW_UNSECURE_COMMANDS environment variable is set to true
    Resource: jobs(secure-job) | Bridgecrew ID: BC_REPO_GITHUB_ACTION_1 | Checkov ID: CKV_GHA_1

Description

GitHub Actions has an environment variable flag called `ACTIONS_ALLOW_UNSECURE_COMMANDS` that allows GHA workflows to run deprecated commands `set-env` and `add-path`. These are vulnerable commands that should not be used as they expose accounts to potential credential theft or code injection.

run: |
echo "ok"