Unpinned Actions Full Length Commit SHA @ /.github/workflows/nodejs.yml

[cyber-sast]

Checkmarx (IaC-Security): Unpinned Actions Full Length Commit SHA
Applications: Visão Geral
Checkmarx Project: takenet/blip-ds
Repository URL: https://github.com/takenet/blip-ds
Branch: master
Scan ID: 6f0d76c7-ef9a-4ef2-94dc-ca624d6b1227

---

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Locations:

Result 1:
Severity: MEDIUM
State: TO_VERIFY
Status: RECURRENT
    File: /.github/workflows/nodejs.yml[41,0]
    Expected value: Action pinned to a full length commit SHA.
    Actual value: Action is not pinned to a full length commit SHA.
    Review result in Checkmarx One: Unpinned Actions Full Length Commit SHA