From ee6ef5e662676de1784d60808dcb68fb5ec45661 Mon Sep 17 00:00:00 2001 From: Christopher Langton Date: Sat, 14 Nov 2026 05:44:27 +1100 Subject: [PATCH] ci(vulnetix): pin the Vulnetix actions at v4.24.33 v4.24.33 carries the bounded GitHub licence lookups (#342): scan jobs on a push no longer spend the repository's API quota that analyze's forge pass, CodeQL's SARIF upload and the release dispatch share. --- .github/workflows/actions.lock | 8 ++--- .github/workflows/vulnetix.yml | 58 +++++++++++++++++----------------- 2 files changed, 33 insertions(+), 33 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 08a180294..256ccf06b 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -62,7 +62,7 @@ workflows: - 'hadolint/hadolint-action@v3.5.0' '.github/workflows/vulnetix.yml': - 'actions/checkout@v7' - - 'vulnetix/cli@v4.24.30' + - 'vulnetix/cli@v4.24.33' dependencies: 'actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8': ref: 'v4.2.2' @@ -202,9 +202,9 @@ dependencies: commit: 'sha1-6f9f17788090df1f26f669e9d70d6ae9567deba6' owner_id: 71096353 repo_id: 351211695 - 'vulnetix/cli@v4.24.30': - ref: 'v4.24.30' - commit: 'sha1-720f8cc1c565f2454bfd6687d25a391e67bf6b09' + 'vulnetix/cli@v4.24.33': + ref: 'v4.24.33' + commit: 'sha1-c55e15941f1d4e364188aefd161faa5c78a5336b' owner_id: 178014019 repo_id: 809336204 uses: diff --git a/.github/workflows/vulnetix.yml b/.github/workflows/vulnetix.yml index c7c45b5a1..62eb67d7e 100644 --- a/.github/workflows/vulnetix.yml +++ b/.github/workflows/vulnetix.yml @@ -23,7 +23,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/secrets@v4.24.30 + - uses: Vulnetix/cli/secrets@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -51,7 +51,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/sast@v4.24.30 + - uses: Vulnetix/cli/sast@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -76,7 +76,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/sca/go@v4.24.30 + - uses: Vulnetix/cli/sca/go@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -84,7 +84,7 @@ jobs: fail-on-findings: false github-code-scanning: ${{ github.event_name == 'push' }} github-token: ${{ github.event_name != 'pull_request' && github.token || '' }} - - uses: Vulnetix/cli/sca@v4.24.30 + - uses: Vulnetix/cli/sca@v4.24.33 if: ${{ !cancelled() }} with: org-id: ${{ secrets.VULNETIX_ORG_ID }} @@ -104,7 +104,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/iac@v4.24.30 + - uses: Vulnetix/cli/iac@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -130,7 +130,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/containers@v4.24.30 + - uses: Vulnetix/cli/containers@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -155,7 +155,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/license@v4.24.30 + - uses: Vulnetix/cli/license@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -170,7 +170,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/cbom@v4.24.30 + - uses: Vulnetix/cli/cbom@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -184,7 +184,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/aibom@v4.24.30 + - uses: Vulnetix/cli/aibom@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -207,7 +207,7 @@ jobs: - uses: actions/checkout@v7 with: fetch-depth: 0 - - uses: Vulnetix/cli/analyze@v4.24.30 + - uses: Vulnetix/cli/analyze@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -226,7 +226,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/sbom@v4.24.30 + - uses: Vulnetix/cli/sbom@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -242,7 +242,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/gha-status@v4.24.30 + - uses: Vulnetix/cli/gha-status@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -254,13 +254,13 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/sast@v4.24.30 + - uses: Vulnetix/cli/sast@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} fail-on-findings: false github-token: "" - - uses: Vulnetix/cli/github-advisories@v4.24.30 + - uses: Vulnetix/cli/github-advisories@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -273,13 +273,13 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/sbom@v4.24.30 + - uses: Vulnetix/cli/sbom@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} fail-on-findings: false github-token: "" - - uses: Vulnetix/cli/bom-validate@v4.24.30 + - uses: Vulnetix/cli/bom-validate@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -292,9 +292,9 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/setup@v4.24.30 + - uses: Vulnetix/cli/setup@v4.24.33 - run: vulnetix license policy init --no-banner - - uses: Vulnetix/cli/license-policy-validate@v4.24.30 + - uses: Vulnetix/cli/license-policy-validate@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -306,9 +306,9 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/setup@v4.24.30 + - uses: Vulnetix/cli/setup@v4.24.33 - run: vulnetix license exceptions add --no-banner --license MPL-2.0 --reason dogfood --approver security@vulnetix.com --expires 2030-01-01 - - uses: Vulnetix/cli/license-exceptions-check@v4.24.30 + - uses: Vulnetix/cli/license-exceptions-check@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -320,7 +320,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/ai-firewall-apply@v4.24.30 + - uses: Vulnetix/cli/ai-firewall-apply@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -335,7 +335,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/image@v4.24.30 + - uses: Vulnetix/cli/image@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -350,7 +350,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/vex@v4.24.30 + - uses: Vulnetix/cli/vex@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -366,7 +366,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/jail@v4.24.30 + - uses: Vulnetix/cli/jail@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -378,7 +378,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/setup@v4.24.30 + - uses: Vulnetix/cli/setup@v4.24.33 - run: vulnetix version --no-banner - run: "vulnetix auth verify --no-banner || true" @@ -388,13 +388,13 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/sbom@v4.24.30 + - uses: Vulnetix/cli/sbom@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} fail-on-findings: false github-token: "" - - uses: Vulnetix/cli/upload@v4.24.30 + - uses: Vulnetix/cli/upload@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -410,7 +410,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/config-plan@v4.24.30 + - uses: Vulnetix/cli/config-plan@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }} @@ -428,7 +428,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v7 - - uses: Vulnetix/cli/gha-upload@v4.24.30 + - uses: Vulnetix/cli/gha-upload@v4.24.33 with: org-id: ${{ secrets.VULNETIX_ORG_ID }} api-key: ${{ secrets.VULNETIX_API_KEY }}