Skip to content

chore(deps): update actions/cache action to v6 #344

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
red-hat-konflux wants to merge 1 commit into
base: master
Choose a base branch
from
+4 −4
Open

chore(deps): update actions/cache action to v6 #344

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
node-version: 20
cache: 'npm'
# cache node modules for all jobs to use
- uses: actions/cache@v5
- uses: actions/cache@v6

@coderabbitai coderabbitai Bot Jun 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

sed -n '1,140p' .github/workflows/test.yml

Repository: RedHatInsights/learning-resources

Length of output: 3760

🏁 Script executed:

sed -n '1,140p' .github/workflows/test.yml

Repository: RedHatInsights/learning-resources

Length of output: 3760

Pin actions/cache to a commit SHA.
All four uses: actions/cache@v6 entries are still tag-pinned, so the workflow remains vulnerable to tag retargeting and still violates the unpinned-uses policy. Replace them with the intended release commit SHA.

🧰 Tools
🪛 zizmor (1.26.1)

[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test.yml at line 22, The workflow still uses tag-pinned
actions/cache references, which violates the unpinned-uses policy; update each
actions/cache usage in the test workflow to the intended release commit SHA
instead of `@v6`. Make sure all four occurrences are changed consistently so the
cache step is pinned securely.

Source: Linters/SAST tools

id: node_modules-cache
with:
path: |
Expand All @@ -45,15 +45,15 @@ jobs:
node-version: 20
cache: 'npm'
# consume installed modules
- uses: actions/cache@v5
- uses: actions/cache@v6
id: node_modules-cache
with:
path: |
**/node_modules
/home/runner/.cache/Cypress
key: install-cache-${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
# custom cypress cache, caches cypress and cypress webpack node module dependencies based on lock file
- uses: actions/cache@v5
- uses: actions/cache@v6
id: cypress-cache
with:
path: |
Expand Down Expand Up @@ -86,7 +86,7 @@ jobs:
node-version: 20
cache: 'npm'
# consume installed modules
- uses: actions/cache@v5
- uses: actions/cache@v6
id: node_modules-cache
with:
path: |
Expand Down
Loading