Bump midnightntwrk/upload-sarif-github-action from 07dad711370cc5985885ebcf07cb8c9264bc4167 to e90808cc2a4bde5b3f14b1df426c2f142bc59a37

[dependabot]

Bumps midnightntwrk/upload-sarif-github-action from 07dad711370cc5985885ebcf07cb8c9264bc4167 to e90808cc2a4bde5b3f14b1df426c2f142bc59a37.

Changelog

Sourced from midnightntwrk/upload-sarif-github-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Changed

• A scorecard check that passed is NOTE, not LOW. A score of 8 or better means the check found nothing wrong, yet LOW License README.md license file detected sat in the same column as things to fix, and eight passes read as eight findings. NOTE ranks 0: still listed in the summary, never gated at any threshold
• A scanned repository's .checkov.yml is honoured instead of being overwritten. The action used to copy its own config to /src/.checkov.yml, over the top of the repository's, and pass that to --config-file - which sets rather than merges. A repository therefore had no lever at all, fatal for JSON, which takes no # checkov:skip= comment. The two are now merged: list values union so the action's entries survive, scalars are the repository's to set, and output, soft-fail and download-external-modules stay pinned because the pipeline depends on them
• checkov no longer scans for secrets. That is gitleaks' job, and unlike checkov it honours a repository's own config. CKV_SECRET_* is a bare entropy heuristic that fires on any high-entropy literal - public keys and hashes in a chain spec, for instance - with no way for the repository to suppress it
• Severities are recalibrated per tool onto one ladder, with CRITICAL at the top. INFO 0 · LOW 1 · MEDIUM 2 · HIGH 3 · CRITICAL 4. SARIF level is a reporting level, not an impact, and it stops at error - read straight through, every tool that speaks only level was capped below CRITICAL and the default threshold gated almost nothing. A severity the tool states is now used as-is; only a bare level is calibrated. ERROR is no longer a severity, but stays accepted as a fail_severity value meaning high
• This is a large behaviour change at the default threshold. opengrep error at high confidence and every zizmor error now reach CRITICAL, so repositories that saw nothing gated at fail_severity: critical will see a great deal. Measured on one real repository's workflows: 0 blocking before, 71 after. Set fail_severity explicitly, or enable differential_gate, before taking this

... (truncated)

Commits

• e90808c Merge pull request #136 from midnightntwrk/giles-scorecard-passes-are-notes
• 0d9beb5 fix: success should be a note, not a low
• 6d0d6fa Merge pull request #135 from midnightntwrk/giles-document-exclusions
• bf5e2c5 docs: document how to exclude an expected finding, per scanner
• 98bf87b Merge pull request #134 from midnightntwrk/giles-checkov-skip-secrets
• 8a8f0ab fix: checkov was stepping on gitleaks toes and config wasn't overridable
• f0a23a4 Merge pull request #133 from midnightntwrk/giles-scorecard-inconclusive
• ad93c69 feat: skip publishing check as it's detection is poor
• 8f88ba7 Merge pull request #132 from midnightntwrk/giles-differential-gate
• e41a7e4 Merge branch 'main' into giles-differential-gate
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)