build(deps): bump midnightntwrk/upload-sarif-github-action from 07dad711370cc5985885ebcf07cb8c9264bc4167 to 6d0d6fafb1e1363b3973fab8f0429602a9e31600

[dependabot]

Bumps midnightntwrk/upload-sarif-github-action from 07dad711370cc5985885ebcf07cb8c9264bc4167 to 6d0d6fafb1e1363b3973fab8f0429602a9e31600.

Changelog

Sourced from midnightntwrk/upload-sarif-github-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Changed

• A scanned repository's .checkov.yml is honoured instead of being overwritten. The action used to copy its own config to /src/.checkov.yml, over the top of the repository's, and pass that to --config-file - which sets rather than merges. A repository therefore had no lever at all, fatal for JSON, which takes no # checkov:skip= comment. The two are now merged: list values union so the action's entries survive, scalars are the repository's to set, and output, soft-fail and download-external-modules stay pinned because the pipeline depends on them
• checkov no longer scans for secrets. That is gitleaks' job, and unlike checkov it honours a repository's own config. CKV_SECRET_* is a bare entropy heuristic that fires on any high-entropy literal - public keys and hashes in a chain spec, for instance - with no way for the repository to suppress it
• Severities are recalibrated per tool onto one ladder, with CRITICAL at the top. INFO 0 · LOW 1 · MEDIUM 2 · HIGH 3 · CRITICAL 4. SARIF level is a reporting level, not an impact, and it stops at error - read straight through, every tool that speaks only level was capped below CRITICAL and the default threshold gated almost nothing. A severity the tool states is now used as-is; only a bare level is calibrated. ERROR is no longer a severity, but stays accepted as a fail_severity value meaning high
• This is a large behaviour change at the default threshold. opengrep error at high confidence and every zizmor error now reach CRITICAL, so repositories that saw nothing gated at fail_severity: critical will see a great deal. Measured on one real repository's workflows: 0 blocking before, 71 after. Set fail_severity explicitly, or enable differential_gate, before taking this
• Scorecard's checks are now an enumerated --checks allowlist (there is no exclude counterpart), dropping SAST, Fuzzing and Packaging. This action is the static analyser, so a failing SAST score states something untrue; Fuzzing scores a practice it cannot observe; and Packaging greps for known publish commands, so a tag-only action release reads as no

... (truncated)

Commits

• 6d0d6fa Merge pull request #135 from midnightntwrk/giles-document-exclusions
• bf5e2c5 docs: document how to exclude an expected finding, per scanner
• 98bf87b Merge pull request #134 from midnightntwrk/giles-checkov-skip-secrets
• 8a8f0ab fix: checkov was stepping on gitleaks toes and config wasn't overridable
• f0a23a4 Merge pull request #133 from midnightntwrk/giles-scorecard-inconclusive
• ad93c69 feat: skip publishing check as it's detection is poor
• 8f88ba7 Merge pull request #132 from midnightntwrk/giles-differential-gate
• e41a7e4 Merge branch 'main' into giles-differential-gate
• b64fe70 feat: remove error as a level. recalabrate levels based on threat
• b747f95 feat: remove error as a level. recalabrate levels based on threat
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.