chore(deps): bump dawidd6/action-send-mail from 3.12.0 to 18 in the actions group across 1 directory - #78
chore(deps): bump dawidd6/action-send-mail from 3.12.0 to 18 in the actions group across 1 directory#78dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The pull request updates the third-party action used in the email notification workflow. While Codacy analysis indicates the changes meet standards, the review highlights a significant security recommendation to pin GitHub Actions to specific commit SHAs rather than mutable tags. This practice mitigates supply-chain risks. Additionally, since automated tests for this workflow are not present, manual verification of the SMTP connection and email delivery is required prior to merging.
Test suggestions
- Trigger the 'Push email notification' workflow to verify successful connection to the SMTP server and email delivery using existing parameters.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Trigger the 'Push email notification' workflow to verify successful connection to the SMTP server and email delivery using existing parameters.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| steps: | ||
| - name: Send push notification email | ||
| uses: dawidd6/action-send-mail@v3.12.0 | ||
| uses: dawidd6/action-send-mail@v18 |
There was a problem hiding this comment.
🔴 HIGH RISK
An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release and protects against potential supply-chain attacks where a tag might be maliciously or accidentally moved to a different commit. Consider updating the 'uses' line to a specific commit SHA.
Bumps the actions group with 1 update in the / directory: [dawidd6/action-send-mail](https://github.com/dawidd6/action-send-mail). Updates `dawidd6/action-send-mail` from 3.12.0 to 18 - [Release notes](https://github.com/dawidd6/action-send-mail/releases) - [Commits](dawidd6/action-send-mail@v3.12.0...v18) --- updated-dependencies: - dependency-name: dawidd6/action-send-mail dependency-version: '18' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
52a6cca to
7e0ed95
Compare
|
Looks like dawidd6/action-send-mail is updatable in another way, so this is no longer needed. |
|
Superseded by #80. |
Pull request was closed
1 participant
Bumps the actions group with 1 update in the / directory: dawidd6/action-send-mail.
Updates
dawidd6/action-send-mailfrom 3.12.0 to 18Release notes
Sourced from dawidd6/action-send-mail's releases.
... (truncated)
Commits
94de994fix: Use extended HELLO with github.com domain (#302)6e50282build(deps): bump actions/checkout from 6 to 7 (#300)1d138f3build(deps): bump nodemailer from 9.0.0 to 9.0.1 (#299)1369c5bnode_modules: update (#297)d86d472build(deps): bump nodemailer from 8.0.11 to 9.0.0 (#296)19dc783build(deps): bump nodemailer from 8.0.10 to 8.0.11 (#295)0dd1be8build(deps): bump nodemailer from 8.0.9 to 8.0.10 (#294)6bf8b9cbuild(deps): bump nodemailer from 8.0.8 to 8.0.9 (#293)51e2c0dbuild(deps): bump nodemailer from 8.0.7 to 8.0.8 (#292)076b075build(deps): bump brace-expansion from 5.0.5 to 5.0.6 (#291)