[sarif] reported by reviewdog 🐶 unpinned image references: container image uses the floating 'latest' tag Raw Output: {"codeFlows":[{"threadFlows":[{"locations":[{"importance":"essential","location":{"logicalLocations":[{"properties":{}}],"message":{"text":"container image uses the floating 'latest' tag"},"physicalLocation":{"artifactLocation":{"uri":"auto-tagger/action.yml"},"region":{"endColumn":55,"endLine":32,"snippet":{"text":" image: \"docker://ghcr.io/notdodo/auto-tagger:latest\""},"sourceLanguage":"yaml","startColumn":3,"startLine":32}}}}]}]}],"kind":"fail","level":"error","locations":[{"logicalLocations":[{"properties":{}}],"message":{"text":"container image uses the floating 'latest' tag"},"physicalLocation":{"artifactLocation":{"uri":"auto-tagger/action.yml"},"region":{"endColumn":55,"endLine":32,"snippet":{"text":" image: \"docker://ghcr.io/notdodo/auto-tagger:latest\""},"sourceLanguage":"yaml","startColumn":3,"startLine":32}}}],"message":{"text":"unpinned image references: container image uses the floating 'latest' tag"},"properties":{},"ruleId":"zizmor/unpinned-images"}

Process completed with exit code 1.

reviewdog: Too many results (annotations) in diff. You may miss some annotations due to GitHub limitation for annotation created by logging command. Please check GitHub Actions log console to see all results. Limitation: - 10 warning annotations and 10 error annotations per step - 50 annotations per job (sum of annotations from all the steps) - 50 annotations per run (separate from the job annotations, these annotations aren't created by users) Source: https://github.com/orgs/community/discussions/26680#discussioncomment-3252835

[sarif] reported by reviewdog 🐶 GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. Raw Output: {"fingerprints":{"matchBasedId/v1":"503b5bcdfc41a24c68ec534aca959b35e2c92e16418e3cb60fe93a4a0c931430c26d716ac2321f876dc749e8c558dcd9c0a658a322df3e05488e2c1a463cab77_8"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/local-auto-tagger.yml","uriBaseId":"%SRCROOT%"},"region":{"endColumn":64,"endLine":170,"snippet":{"text":" uses: notdodo/github-actions/auto-tagger@auto-tagger-v0"},"startColumn":9,"startLine":170}}}],"message":{"text":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`."},"properties":{},"ruleId":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag"}

[sarif] reported by reviewdog 🐶 GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. Raw Output: {"fingerprints":{"matchBasedId/v1":"503b5bcdfc41a24c68ec534aca959b35e2c92e16418e3cb60fe93a4a0c931430c26d716ac2321f876dc749e8c558dcd9c0a658a322df3e05488e2c1a463cab77_7"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/local-auto-tagger.yml","uriBaseId":"%SRCROOT%"},"region":{"endColumn":64,"endLine":157,"snippet":{"text":" uses: notdodo/github-actions/auto-tagger@auto-tagger-v0"},"startColumn":9,"startLine":157}}}],"message":{"text":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`."},"properties":{},"ruleId":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag"}

[sarif] reported by reviewdog 🐶 GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. Raw Output: {"fingerprints":{"matchBasedId/v1":"503b5bcdfc41a24c68ec534aca959b35e2c92e16418e3cb60fe93a4a0c931430c26d716ac2321f876dc749e8c558dcd9c0a658a322df3e05488e2c1a463cab77_6"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/local-auto-tagger.yml","uriBaseId":"%SRCROOT%"},"region":{"endColumn":64,"endLine":144,"snippet":{"text":" uses: notdodo/github-actions/auto-tagger@auto-tagger-v0"},"startColumn":9,"startLine":144}}}],"message":{"text":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`."},"properties":{},"ruleId":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag"}

[sarif] reported by reviewdog 🐶 GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. Raw Output: {"fingerprints":{"matchBasedId/v1":"503b5bcdfc41a24c68ec534aca959b35e2c92e16418e3cb60fe93a4a0c931430c26d716ac2321f876dc749e8c558dcd9c0a658a322df3e05488e2c1a463cab77_5"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/local-auto-tagger.yml","uriBaseId":"%SRCROOT%"},"region":{"endColumn":64,"endLine":131,"snippet":{"text":" uses: notdodo/github-actions/auto-tagger@auto-tagger-v0"},"startColumn":9,"startLine":131}}}],"message":{"text":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`."},"properties":{},"ruleId":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag"}

[sarif] reported by reviewdog 🐶 GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. Raw Output: {"fingerprints":{"matchBasedId/v1":"503b5bcdfc41a24c68ec534aca959b35e2c92e16418e3cb60fe93a4a0c931430c26d716ac2321f876dc749e8c558dcd9c0a658a322df3e05488e2c1a463cab77_4"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/local-auto-tagger.yml","uriBaseId":"%SRCROOT%"},"region":{"endColumn":64,"endLine":118,"snippet":{"text":" uses: notdodo/github-actions/auto-tagger@auto-tagger-v0"},"startColumn":9,"startLine":118}}}],"message":{"text":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`."},"properties":{},"ruleId":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag"}

[sarif] reported by reviewdog 🐶 GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. Raw Output: {"fingerprints":{"matchBasedId/v1":"503b5bcdfc41a24c68ec534aca959b35e2c92e16418e3cb60fe93a4a0c931430c26d716ac2321f876dc749e8c558dcd9c0a658a322df3e05488e2c1a463cab77_3"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/local-auto-tagger.yml","uriBaseId":"%SRCROOT%"},"region":{"endColumn":64,"endLine":105,"snippet":{"text":" uses: notdodo/github-actions/auto-tagger@auto-tagger-v0"},"startColumn":9,"startLine":105}}}],"message":{"text":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`."},"properties":{},"ruleId":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag"}

[sarif] reported by reviewdog 🐶 GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. Raw Output: {"fingerprints":{"matchBasedId/v1":"503b5bcdfc41a24c68ec534aca959b35e2c92e16418e3cb60fe93a4a0c931430c26d716ac2321f876dc749e8c558dcd9c0a658a322df3e05488e2c1a463cab77_2"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/local-auto-tagger.yml","uriBaseId":"%SRCROOT%"},"region":{"endColumn":64,"endLine":92,"snippet":{"text":" uses: notdodo/github-actions/auto-tagger@auto-tagger-v0"},"startColumn":9,"startLine":92}}}],"message":{"text":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`."},"properties":{},"ruleId":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag"}

[sarif] reported by reviewdog 🐶 GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. Raw Output: {"fingerprints":{"matchBasedId/v1":"503b5bcdfc41a24c68ec534aca959b35e2c92e16418e3cb60fe93a4a0c931430c26d716ac2321f876dc749e8c558dcd9c0a658a322df3e05488e2c1a463cab77_1"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/local-auto-tagger.yml","uriBaseId":"%SRCROOT%"},"region":{"endColumn":64,"endLine":79,"snippet":{"text":" uses: notdodo/github-actions/auto-tagger@auto-tagger-v0"},"startColumn":9,"startLine":79}}}],"message":{"text":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`."},"properties":{},"ruleId":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag"}

[sarif] reported by reviewdog 🐶 GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. Raw Output: {"fingerprints":{"matchBasedId/v1":"503b5bcdfc41a24c68ec534aca959b35e2c92e16418e3cb60fe93a4a0c931430c26d716ac2321f876dc749e8c558dcd9c0a658a322df3e05488e2c1a463cab77_0"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/local-auto-tagger.yml","uriBaseId":"%SRCROOT%"},"region":{"endColumn":64,"endLine":66,"snippet":{"text":" uses: notdodo/github-actions/auto-tagger@auto-tagger-v0"},"startColumn":9,"startLine":66}}}],"message":{"text":"GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`."},"properties":{},"ruleId":"yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag"}