Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🚀 gha: bump microsoft/security-devops-action from 1.10.0 to 1.11.0 #329

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jul 26, 2024

Bumps microsoft/security-devops-action from 1.10.0 to 1.11.0.

Release notes

Sourced from microsoft/security-devops-action's releases.

Enable Container Mapping by Default for Active Customers

In this release, we're enabling the container-mapping tool by default for customers who have onboarded to Microsoft Defender for Cloud and have enabled their GitHub organization.

Those who do not have Microsoft Defender for Cloud enabled on their GitHub organizations will not be able to run the container-mapping workload and it will be automatically skipped.

With this change, we are deprecating the includeTools option. If you would like to manually specify which tools to run, this can still be done via the tools option as before. See the wiki for further instructions.

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [microsoft/security-devops-action](https://github.com/microsoft/security-devops-action) from 1.10.0 to 1.11.0.
- [Release notes](https://github.com/microsoft/security-devops-action/releases)
- [Commits](microsoft/security-devops-action@v1.10.0...v1.11.0)

---
updated-dependencies:
- dependency-name: microsoft/security-devops-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code labels Jul 26, 2024
Copy link

Here are some friendly prose warnings from write-good:

In ./docs/index.md
=============
Markdown is a lightweight and easy-to-use syntax for styling your writing. It in
^^^^^^^^
"Markdown" is repeated on line 9 at column 0
-------------
. The name of this theme is saved in the Jekyll '_config.yml' configuration file
                         ^^^^^^^^
"is saved" may be passive voice on line 33 at column 202


In ./SECURITY.md
=============
currently being supported with security updates.
^^^^^^^^^
"currently" can weaken meaning on line 6 at column 0
-------------
currently being supported with security updates.
          ^^^^^^^^^^^^^^^
"being supported" may be passive voice on line 6 at column 10
-------------
ect if the vulnerability is accepted or
                         ^^^^^^^^^^^
"is accepted" may be passive voice on line 20 at column 60


In ./.github/PULL_REQUEST_TEMPLATE.md
=============
s one or more issues, or is related to
                         ^^^^^^^^^^
"is related" may be passive voice on line 10 at column 55
-------------
## How Has This Been Tested?
                ^^^^^^^^^^^
"Been Tested" may be passive voice on line 18 at column 16
-------------
request before all these are done, but they should be done before getting merged
                         ^^^^^^^^
"are done" may be passive voice on line 27 at column 51
-------------
re done, but they should be done before getting merged. -->
                         ^^^^^^^
"be done" may be passive voice on line 27 at column 77
-------------
 If the key of a setting is changed, the 'old' attribute is updated or it is
                         ^^^^^^^^^^
"is changed" may be passive voice on line 29 at column 30
-------------
ged, the 'old' attribute is updated or it is
                         ^^^^^^^^^^
"is updated" may be passive voice on line 29 at column 62
-------------
 attribute is updated or it is
                         ^^^^^
"it is" is wordy or unneeded on line 29 at column 76
-------------
tribute is updated or it is
                         ^^^^^^^^^^^^^^^^^
"is
      resolved" may be passive voice on line 29 at column 79
-------------
isplayed in the UI, they are wrapped in 'tr()'
                         ^^^^^^^^^^^
"are wrapped" may be passive voice on line 31 at column 65
-------------
hanges are notable, they are documented in
                         ^^^^^^^^^^^^^^
"are documented" may be passive voice on line 35 at column 41
-------------
## Additional text
   ^^^^^^^^^^
"Additional" is wordy or unneeded on line 38 at column 3
-------------
the translations need to be updated. --->
                         ^^^^^^^^^^
"be updated" may be passive voice on line 40 at column 102


In ./.github/CONTRIBUTING.md
=============
d the following sections in
                         ^^^^^^^^^^^
"in
order to" is wordy or unneeded on line 3 at column 89
-------------
  requesting for exactly.
                 ^^^^^^^
"exactly" can weaken meaning on line 14 at column 17
-------------
request when you are finished, wait for reviews and apply suggestions from the
                 ^^^^^^^^^^^^
"are finished" may be passive voice on line 27 at column 17
-------------
gle for what you want to implement is usually helpful.
                         ^^^^^^^^^
"implement" is wordy or unneeded on line 35 at column 63
-------------
you want to implement is usually helpful.
                         ^^^^^^^
"usually" can weaken meaning on line 35 at column 76
-------------
Copy and modify the source codes if you want to implement something similar to a
         ^^^^^^
"modify" is wordy or unneeded on line 36 at column 9
-------------
rce codes if you want to implement something similar to an
                         ^^^^^^^^^
"implement" is wordy or unneeded on line 36 at column 48
-------------
t to implement something similar to an
                         ^^^^^^^^^^
"similar to" is wordy or unneeded on line 36 at column 68
-------------
5/signalsandslots.html). Usually, you don't
                         ^^^^^^^
"Usually" can weaken meaning on line 48 at column 66
-------------
issues) and find one you are interested
                         ^^^^^^^^^^^^^^
"are interested" may be passive voice on line 53 at column 79
-------------
on how you would like to implement it) before
                         ^^^^^^^^^
"implement" is wordy or unneeded on line 61 at column 68
-------------
3. You will be notified if this feature is not going to be accepted, or the "bug
            ^^^^^^^^^^^
"be notified" may be passive voice on line 66 at column 12
-------------
 feature is not going to be accepted, or the "bug" is actually not a bug, etc., 
                         ^^^^^^^^^^^
"be accepted" may be passive voice on line 66 at column 56
-------------
uest. If you want to add multiple features/fix multiple
                         ^^^^^^^^
"multiple" is wordy or unneeded on line 71 at column 53
-------------
dd multiple features/fix multiple
                         ^^^^^^^^
"multiple" is wordy or unneeded on line 71 at column 75
-------------
y are not relevant, open multiple pull requests. You may need to create
                         ^^^^^^^^
"multiple" is wordy or unneeded on line 72 at column 39
-------------
  multiple branches to open multiple pull requests, you can learn git branching
  ^^^^^^^^
"multiple" is wordy or unneeded on line 73 at column 2
-------------
ultiple branches to open multiple pull requests, you can learn git branching
                         ^^^^^^^^
"multiple" is wordy or unneeded on line 73 at column 28
-------------
  However, the rules are optional, the key is that, others and yourself in the f
  ^^^^^^^
"However" is wordy or unneeded on line 81 at column 2
-------------
ould understand what has been changed and why these changes are made.
                         ^^^^^^^^^^^^
"been changed" may be passive voice on line 82 at column 29
-------------
ed and why these changes are made.
                         ^^^^^^^^
"are made" may be passive voice on line 82 at column 64
-------------
 Linux and Mac OS should be supported.
                         ^^^^^^^^^^^^
"be supported" may be passive voice on line 90 at column 35
-------------
ark system themes should be supported.
                         ^^^^^^^^^^^^
"be supported" may be passive voice on line 91 at column 39
-------------
uct](CODE_OF_CONDUCT.md) in order to build a
                         ^^^^^^^^^^^
"in order to" is wordy or unneeded on line 92 at column 65
-------------
Can I do it well if I've just started?
                         ^^^^
"just" can weaken meaning on line 97 at column 27
-------------
  - No, you only need to know how to
            ^^^^
"only" can weaken meaning on line 102 at column 12
-------------
  - If the CI tests are passed, it's probably because the submodules are updated
                    ^^^^^^^^^^
"are passed" may be passive voice on line 106 at column 20
-------------
y because the submodules are updated.
                         ^^^^^^^^^^^
"are updated" may be passive voice on line 106 at column 69


In ./.github/CODE_OF_CONDUCT.md
=============
- Giving and gracefully accepting constructive feedback
             ^^^^^^^^^^
"gracefully" can weaken meaning on line 22 at column 13
-------------
sing on what is best not just for us as individuals, but for the
                         ^^^^
"just" can weaken meaning on line 25 at column 31
-------------
  overall community
  ^^^^^^^
"overall" is wordy or unneeded on line 26 at column 2
-------------
t which could reasonably be considered inappropriate in a
                         ^^^^^^^^^^^^^
"be considered" may be passive voice on line 36 at column 39
-------------
nacceptable behavior may be
                         ^^^^^^^^^^^
"be
reported" may be passive voice on line 61 at column 72
-------------
All complaints will be reviewed and investigated promptly and fairly.
                    ^^^^^^^^^^^
"be reviewed" may be passive voice on line 64 at column 20
-------------
eviewed and investigated promptly and fairly.
                         ^^^^^^^^
"promptly" can weaken meaning on line 64 at column 49
-------------
nvestigated promptly and fairly.
                         ^^^^^^
"fairly" is a weasel word and can weaken meaning on line 64 at column 62
-------------
All community leaders are obligated to respect the privacy and security of the
                      ^^^^^^^^^^^^^
"are obligated" may be passive voice on line 66 at column 22
-------------
te. A public apology may be requested.
                         ^^^^^^^^^^^^
"be requested" may be passive voice on line 81 at column 49
-------------
ing the Code of Conduct, is allowed during this period.
                         ^^^^^^^^^^
"is allowed" may be passive voice on line 103 at column 42
-------------
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
                     ^^^^^^^^^^
"is adapted" may be passive voice on line 117 at column 21
-------------
munity Impact Guidelines were inspired by [Mozilla's code of conduct
                         ^^^^^^^^^^^^^
"were inspired" may be passive voice on line 121 at column 28


In ./.github/actions/spelling/README.md
=============
    | one word per line (only letters and '''s allowed)                         
                         ^^^^
"only" can weaken meaning on line 6 at column 157
-------------
| [only.txt](only.txt)                               | Only check matching files
   ^^^^
"only" can weaken meaning on line 9 at column 3
-------------
| [only.txt](only.txt)                               | Only check matching files
             ^^^^
"only" can weaken meaning on line 9 at column 13
-------------
                       | Only check matching files (applied after excludes)     
                         ^^^^
"Only" can weaken meaning on line 9 at column 55
-------------
                      | [only](https://github.com/check-spelling/check-spelling/
                         ^^^^
"only" can weaken meaning on line 9 at column 239
-------------
onfiguration-Examples%3A-only)         |
                         ^^^^
"only" can weaken meaning on line 9 at column 325
-------------
ctions (all matches will be suggested) | [candidates](https://github.com/check-s
                         ^^^^^^^^^^^^
"be suggested" may be passive voice on line 11 at column 222
-------------
 when unrecognized words are found                  | GitHub Markdown           
                         ^^^^^^^^^
"are found" may be passive voice on line 14 at column 109
-------------
then include multiple files inside that directory (with that suffix) to merge mu
             ^^^^^^^^
"multiple" is wordy or unneeded on line 17 at column 13
-------------
th that suffix) to merge multiple files
                         ^^^^^^^^
"multiple" is wordy or unneeded on line 17 at column 78


In ./.github/ISSUE_TEMPLATE/01-bug-report.yml.md
=============
se fill out this form as completely as possible.
                         ^^^^^^^^^^
"completely" is a weasel word and can weaken meaning on line 11 at column 89


In ./README.md
=============
### Additional for the Console Application and the Class Library
    ^^^^^^^^^^
"Additional" is wordy or unneeded on line 51 at column 4
-------------
 This is only available on macOS. Init with 'npm install'
         ^^^^
"only" can weaken meaning on line 54 at column 9
-------------
  - Call with 'gulp lint'only the lintcheck.
                         ^^^^
"only" can weaken meaning on line 57 at column 27

@@ -68,7 +68,7 @@
${{ runner.os }}-nuget-

- name: Run Microsoft Security DevOps
uses: microsoft/security-devops-action@v1.10.0
uses: microsoft/security-devops-action@v1.11.0

Check failure

Code scanning / check-spelling

Unrecognized Spelling Error

microsoft is not a recognized word. (unrecognized-spelling)
Copy link

@check-spelling-bot Report

🔴 Please review

See the 📂 files view, the 📜action log, or 📝 job summary for details.

Unrecognized words (292)
aacd
abbd
abf
abfb
Abh
adf
Aissue
Akismet
Alertmanager
alex
andresz
anf
Anwendung
Aopen
appquick
apps
appveyor
Assistenten
astro
atx
Aufruf
Authentiq
autobuild
autolabeler
automerge
autopep
autoupdate
backticks
bbf
bcbfa
bccc
bdd
bdf
bea
beaa
behaviorbot
Beitragen
Betriebssystem
bfb
bfcd
bfd
bfdadc
Bibliothek
Bild
blogs
bluemix
brauen
brightgreen
Bugzilla
buildscript
cccebad
checkboxes
cheshirekow
chris
ckkehren
codacy
codecov
CODEOWNERS
codeql
codespell
codespellrc
commitizen
commitlint
commment
compat
conan
conanfile
conventionalcommits
coverrun
cpr
CQA
Dangerfile
daviddm
dbb
ddab
ddee
debf
Debian
dessant
deutsch
devcontainer
devskim
DJANGO
Dokumentation
dotnet
Doxyfile
dummyfile
durchf
edc
eea
eeaaad
eee
eeef
eef
ein
eine
einen
einer
Einleiten
Elasticsearch
emtpy
Erste
Erstellen
Erstellung
EUPL
faf
fastlane
fcc
fdd
fdescribe
febcab
findup
fossas
fsfe
Funktionen
Fusselkontrolle
Fusselscheck
fwlink
gammaray
gbar
GDK
geberator
gha
ghaction
GHE
GHSA
Gitaly
githubocto
Gitleaks
gitlint
gitpod
gmail
goodcheck
Grafana
gsoc
gulpfile
handover
hhatto
hren
idstepsrun
img
inplace
installieren
installiert
Intelli
Jef
jekyllrb
Jetzt
jmbde
JMBe
jmuelbert
jobsjob
jquery
juergen
KDAB
Klassenbibliothek
Klassenname
Klassenvorlage
Knative
Knoten
Konsolen
Konsolenanwendung
lbert
lcov
learngitbranching
Leere
linkcheck
linkid
lintargs
lintcheck
lintcmd
linting
Lizenz
marcbachmann
markdownlint
Mattermost
matthiashermsen
mcr
mdl
mdlrc
mega
megalinter
microsoft
mikepenz
mkdocs
mozilla
msbuild
mscadocs
msdo
mshick
mudlet
muelbert
nderungsprotokoll
ndige
neue
neuen
ngigkeiten
nnumber
nosetests
npmjs
nur
OAuth
oben
oder
opensource
ossar
ossf
outreachy
oxsecurity
pfad
playlists
Postgre
processinf
Programm
Projekte
Prozess
pycodestyle
pyenv
pylint
pytest
QCore
qhcp
qml
QNX
QString
Quellenverzeichnis
quickstart
rdpart
rdparty
redis
Redmine
refact
releasenotes
resetable
returntocorp
rubocop
Rufen
runit
Salesforce
SAML
Schablone
Schluckfussel
schreiben
Schritte
Screenshots
semgrep
shellcheck
shelljs
Sidekiq
signalsandslots
Signup
skywinder
slowlog
sobolevn
socio
softprops
srggrs
starten
stdlib
stefanzweifel
stl
svenstaro
swiftfile
swiftlint
tcc
tomwhross
tzlich
Umakefile
uncrustify
und
unter
Unterbefehl
Unterverzeichnis
utm
uuid
vcpkg
venv
verf
Verwendung
Vollst
vorlagenbasierte
wagoid
website
werden
wip
withastro
wontfix
workflows
yosay
zeigt
zur
Zus
Some files were automatically ignored 🙈

These sample patterns would exclude them:

^\Qcspell.config.yaml\E$
^\Qproject-words.txt\E$

You should consider adding them to:

.github/actions/spelling/excludes.txt

File matching is via Perl regular expressions.

To check these files, more of their words need to be in the dictionary than not. You can use patterns.txt to exclude portions, add items to the dictionary (e.g. by adding them to allow.txt), or fix typos.

To accept these unrecognized words as correct and update file exclusions, you could run the following commands

... in a clone of the git@github.com:jmuelbert/generator-swift.git repository
on the dependabot/github_actions/microsoft/security-devops-action-1.11.0 branch (ℹ️ how do I use this?):

curl -s -S -L 'https://raw.githubusercontent.com/check-spelling/check-spelling/00c989c97749eb0cb2d256bdc55ac61b0096c6d3/apply.pl' |
perl - 'https://github.com/jmuelbert/generator-swift/actions/runs/10103467458/attempts/1'

OR

To have the bot accept them for you, reply quoting the following line:
@check-spelling-bot apply updates.

Available 📚 dictionaries could cover words not in the 📘 dictionary
Dictionary Entries Covers Uniquely
cspell:npm/dict/npm.txt 302 7 4
cspell:python/src/python/python.txt 392 7 4
cspell:fullstack/dict/fullstack.txt 419 5 2
cspell:python/src/python/python-lib.txt 2417 5 1
cspell:aws/aws.txt 218 4 2

Consider adding them (in .github/workflows/spelling.yml) for uses: check-spelling/check-spelling@00c989c97749eb0cb2d256bdc55ac61b0096c6d3 in its with:

      with:
        extra_dictionaries:
          cspell:npm/dict/npm.txt
          cspell:python/src/python/python.txt
          cspell:fullstack/dict/fullstack.txt
          cspell:python/src/python/python-lib.txt
          cspell:aws/aws.txt

To stop checking additional dictionaries, add (in .github/workflows/spelling.yml) for uses: check-spelling/check-spelling@00c989c97749eb0cb2d256bdc55ac61b0096c6d3 in its with:

check_extra_dictionaries: ''
Pattern suggestions ✂️ (9)

You could add these patterns to .github/actions/spelling/patterns.txt:

# Automatically suggested patterns
# hit-count: 106 file-count: 28
# https/http/file urls
(?:\b(?:https?|ftp|file)://)[-A-Za-z0-9+&@#/%?=~_|!:,.;]+[-A-Za-z0-9+&@#/%=~_|]

# hit-count: 45 file-count: 17
# Non-English
[a-zA-Z]*[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź][a-zA-Z]{3}[a-zA-ZÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź]*|[a-zA-Z]{3,}[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź]|[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź][a-zA-Z]{3,}

# hit-count: 30 file-count: 20
# hex runs
\b[0-9a-fA-F]{16,}\b

# hit-count: 21 file-count: 11
# GitHub SHAs (markdown)
(?:\[`?[0-9a-f]+`?\]\(https:/|)/(?:www\.|)github\.com(?:/[^/\s"]+){2,}(?:/[^/\s")]+)(?:[0-9a-f]+(?:[-0-9a-zA-Z/#.]*|)\b|)

# hit-count: 10 file-count: 2
# shields.io
\bshields\.io/[-\w/%?=&.:+;,]*

# hit-count: 9 file-count: 3
# URL escaped characters
\%[0-9A-F][A-F]

# hit-count: 2 file-count: 2
# codacy
\bapi\.codacy\.com/project/badge/Grade/[0-9a-f]+

# hit-count: 1 file-count: 1
# Contributor
\[[^\]]+\]\(https://github\.com/[^/\s"]+/?\)

# hit-count: 1 file-count: 1
# GHSA
GHSA(?:-[0-9a-z]{4}){3}

Errors (5)

See the 📂 files view, the 📜action log, or 📝 job summary for details.

❌ Errors Count
ℹ️ candidate-pattern 21
❌ check-file-path 54
❌ dictionary-not-found 6
❌ forbidden-pattern 4
ℹ️ noisy-file 2

See ❌ Event descriptions for more information.

If the flagged items are 🤯 false positives

If items relate to a ...

  • binary file (or some other file you wouldn't want to check at all).

    Please add a file path to the excludes.txt file matching the containing file.

    File paths are Perl 5 Regular Expressions - you can
    test yours before committing to verify it will match
    your files.

    ^ refers to the file's path from the root of the repository, so ^README\.md$ would exclude
    README.md (on whichever branch you're using).

  • well-formed pattern.

    If you can write a
    pattern
    that would match it, try adding it to the patterns.txt file.

    Patterns are Perl 5 Regular Expressions - you can
    test yours before committing to verify it will match
    your lines.

    Note that patterns can't match multiline strings.

🚂 If you're seeing this message and your PR is from a branch that doesn't have
check-spelling, please merge to your PR's base branch to get the version configured for your
repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
AnyChange dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code GithubActions release
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

0 participants