Hello, there!

As part of the university research we are currently doing regarding the security of Github Actions, we noticed that one or many of the workflows that are part of this repository are referencing vulnerable versions of the third-party actions. As part of a disclosure process, we decided to open issues to notify GitHub Community.

Please note that there are could be some false positives in our methodology, thus not all of the open issues could be valid. If that is the case, please let us know, so that we can improve on our approach. You can contact me directly using an email: ikoishy [at] ncsu.edu

Thanks in advance

1. The workflow cd.yml is referencing action gittools/actions/gitversion/setup using references v0.9.9. However this reference is missing the commit 90150b4 which may contain fix to the vulnerability.
2. The workflow cd.yml is referencing action gittools/actions/gitversion/execute using references v0.9.9. However this reference is missing the commit 90150b4 which may contain fix to the vulnerability.
3. The workflow ci.yml is referencing action gittools/actions/gitversion/setup using references v0.9.9. However this reference is missing the commit 90150b4 which may contain fix to the vulnerability.
4. The workflow ci.yml is referencing action gittools/actions/gitversion/execute using references v0.9.9. However this reference is missing the commit 90150b4 which may contain fix to the vulnerability.

The vulnerability fix that is missing by actions' versions could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider updating the reference to the action.

If you end up updating the reference, please let us know. We need the stats for the paper :-)

This is an Error in:

• Employee

• Computer an so on.

Tracking issue for:

• https://github.com/jmuelbert/jmbde-dotnet/security/code-scanning/18745

Tracking issue for:

• https://github.com/jmuelbert/jmbde-dotnet/security/code-scanning/18746

Tracking issue for:

• https://github.com/jmuelbert/jmbde-dotnet/security/code-scanning/18504

Workflow Sonar Cloud Analysis don't work

An automatic update for the Java installer is done. The old version is 1.0 and new version is 2.5.0.

The error is:

Run actions/[email protected]
with:
java-version: 1.11
java-package: jdk
architecture: x64
check-latest: false
server-id: github
server-username: GITHUB_ACTOR
server-password: GITHUB_TOKEN
overwrite-settings: true
job-status: success
Error: Input required and not supplied: distribution

The bot created this issue to inform you that pyup.io has been set up on this repo.
Once you have closed it, the bot will open pull requests for updates as soon as they are available.