ci: bump docker/login-action from 6862ffc5ab2cdb4405cf318a62a6f4c066e2298b to 916386b00027d425839f8da46d302dab33f5875b in the github-actions group #342
Conversation
dependabot
bot
added
dependencies
Bumps the github-actions group with 1 update: [docker/login-action](https://github.com/docker/login-action). Updates `docker/login-action` from 6862ffc5ab2cdb4405cf318a62a6f4c066e2298b to 916386b00027d425839f8da46d302dab33f5875b - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@6862ffc...916386b) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 916386b00027d425839f8da46d302dab33f5875b dependency-type: direct:production dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
force-pushed
the
dependabot/github_actions/github-actions-3317266c66
branch
from
82274ca to
aeb02ec
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR is being reviewed by Cursor Bugbot
Details
Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
|
|
||
| - name: Log in to Docker registry | ||
| uses: docker/login-action@6862ffc5ab2cdb4405cf318a62a6f4c066e2298b | ||
| uses: docker/login-action@0567fa5ae8c9a197cb207537dc5cbb43ca3d803f |
There was a problem hiding this comment.
Action commit hash mismatch with PR description
High Severity
The commit hash used for docker/login-action (0567fa5ae8c9a197cb207537dc5cbb43ca3d803f) does not match the target hash stated in the PR description (916386b00027d425839f8da46d302dab33f5875b). This mismatch means the workflow pins to an unexpected version of the action. Since this action handles Docker registry credentials, using an unverified commit hash poses a supply chain security risk. The PR description and actual change must be aligned to ensure the correct, audited version is used.
Bumps the github-actions group with 1 update: docker/login-action.
Updates
docker/login-actionfrom 6862ffc5ab2cdb4405cf318a62a6f4c066e2298b to 916386b00027d425839f8da46d302dab33f5875bCommits
916386bMerge pull request #911 from crazy-max/ensure-redact5b3f94achore: update generated contentf9cc43bensure passwords are redacted with registry-authDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsNote
Updates CI dependency pin for Docker login.
.github/workflows/build.yml, updatesuses: docker/login-action@6862ffc...to@0567fa5...No other workflow or application changes.
Written by Cursor Bugbot for commit aeb02ec. This will update automatically on new commits. Configure here.