Skip to content

v4.0.1

Choose a tag to compare

View all tags
@rsdmike rsdmike released this 29 Aug 03:37
· 8 commits to main since this release
v4.0.1
1df22b1

A maintenance release. The action runtime is unchanged from v4.0.0 (using: node24), so this is a drop-in upgrade for existing workflows — the internals moved to ESM, but that is invisible to consumers, who only ever run the bundled dist/index.js.

The one thing that does change is the rendered output of the report template, which is the point of two of the fixes below.

Fixed

SARIF rule help now renders as HTML in the report template. marked was imported and configured but never actually invoked — the DOMPurify sanitizer was being passed to nunjucks-markdown as the renderer — so rule help text appeared in the generated HTML and PDF as literal markdown source (# Heading, **bold**, [link](url)). It is now parsed with marked and then sanitized, as originally intended. Untrusted SARIF content is still scrubbed.

The bundled templates are no longer shipped stale. dist/templates/ in v4.0.0 had drifted from templates/, so the report output was missing the per-alert Tool: row and a page break before the Dependency Vulnerabilities section. npm run package now copies the templates explicitly rather than relying on ncc's asset relocator, which only recognises path.join(__dirname, '…') and silently stopped copying anything once the sources moved to import.meta.dirname. npm run test:dist now fails if dist/templates ever drifts from source again, or if a bundled template stops compiling.

Changed

  • Migrated from CommonJS to ESM, using Node's native TypeScript type stripping instead of ts-node.
  • Dropped nunjucks-markdown (unmaintained, last published June 2022) in favour of a native nunjucks filter. Output is identical for the same input, and the filter renders empty rather than throwing when a rule carries no help markdown.
  • Dependency updates: @actions/core and @actions/io v3, @octokit/rest v22, @octokit/types v17, marked v18.
  • The minimum Node version for running the CLI from a clone is now 22.18.0 (was 22.12.0). This does not affect the action itself — the runner supplies the node24 runtime.

Documentation

  • Removed report_sca from the list of available templates. It has never existed in any release, and passing it fails with Failed to resolve a template file. Software Composition Analysis is already part of report.
  • Documented aggregated_report, which does exist: the same content as report, with open code scanning alerts grouped by rule and an instance count per rule, rather than listed individually.

Verification

Each top-level template was rendered against the committed sample payload, and the packaged action was run end-to-end on a real repository — CodeQL analyze into ../results, then template: report — producing a valid 281 KB PDF.

Full changelog: v4.0.0...v4.0.1

Assets 2
Loading