Unpinned Actions Full Length Commit SHA @ /.github/workflows/checkmarx.yml

[cyates-checkmarx]

Checkmarx (IaC-Security): Unpinned Actions Full Length Commit SHA
Checkmarx Project: cyates-checkmarx/JVL
Repository URL: https://github.com/cyates-checkmarx/JVL
Branch: master
Scan ID: 6bf2c567-d73e-490c-ac86-a35dd14d497b

---

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Locations:

Result #1:
Severity: MEDIUM
State: TO_VERIFY
Status: NEW
    File: /.github/workflows/checkmarx.yml[53,0]
    Expected value: Action pinned to a full length commit SHA.
    Actual value: Action is not pinned to a full length commit SHA.
    Review result in Checkmarx One: Unpinned Actions Full Length Commit SHA