build(deps): bump midnightntwrk/upload-sarif-github-action from 9da05ae8b0dc1b97a0a25f809deb586c06b7ad3e to 362d0346b194663004cb371e8e8523bd1c910917

[dependabot]

Bumps midnightntwrk/upload-sarif-github-action from 9da05ae8b0dc1b97a0a25f809deb586c06b7ad3e to 362d0346b194663004cb371e8e8523bd1c910917.

Changelog

Sourced from midnightntwrk/upload-sarif-github-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Changed

• A scorecard check that passed is NOTE, not LOW. A score of 8 or better means the check found nothing wrong, yet LOW License README.md license file detected sat in the same column as things to fix, and eight passes read as eight findings. NOTE ranks 0: still listed in the summary, never gated at any threshold
• A scanned repository's .checkov.yml is honoured instead of being overwritten. The action used to copy its own config to /src/.checkov.yml, over the top of the repository's, and pass that to --config-file - which sets rather than merges. A repository therefore had no lever at all, fatal for JSON, which takes no # checkov:skip= comment. The two are now merged: list values union so the action's entries survive, scalars are the repository's to set, and output, soft-fail and download-external-modules stay pinned because the pipeline depends on them
• checkov no longer scans for secrets. That is gitleaks' job, and unlike checkov it honours a repository's own config. CKV_SECRET_* is a bare entropy heuristic that fires on any high-entropy literal - public keys and hashes in a chain spec, for instance - with no way for the repository to suppress it
• Severities are recalibrated per tool onto one ladder, with CRITICAL at the top. INFO 0 · LOW 1 · MEDIUM 2 · HIGH 3 · CRITICAL 4. SARIF level is a reporting level, not an impact, and it stops at error - read straight through, every tool that speaks only level was capped below CRITICAL and the default threshold gated almost nothing. A severity the tool states is now used as-is; only a bare level is calibrated. ERROR is no longer a severity, but stays accepted as a fail_severity value meaning high
• This is a large behaviour change at the default threshold. opengrep error at high confidence and every zizmor error now reach CRITICAL, so repositories that saw nothing gated at fail_severity: critical will see a great deal. Measured on one real repository's workflows: 0 blocking before, 71 after. Set fail_severity explicitly, or enable differential_gate, before taking this

... (truncated)

Commits

• 362d034 Merge pull request #139 from midnightntwrk/renovate/pypi-pip-vulnerability
• a03e6f7 chore(deps): update dependency pip to v26.2 [security]
• e90808c Merge pull request #136 from midnightntwrk/giles-scorecard-passes-are-notes
• 0d9beb5 fix: success should be a note, not a low
• 6d0d6fa Merge pull request #135 from midnightntwrk/giles-document-exclusions
• bf5e2c5 docs: document how to exclude an expected finding, per scanner
• 98bf87b Merge pull request #134 from midnightntwrk/giles-checkov-skip-secrets
• 8a8f0ab fix: checkov was stepping on gitleaks toes and config wasn't overridable
• f0a23a4 Merge pull request #133 from midnightntwrk/giles-scorecard-inconclusive
• ad93c69 feat: skip publishing check as it's detection is poor
• Additional commits viewable in compare view

[yshyn-iohk]

@dependabot recreate

[yshyn-iohk]

@dependabot rebase

[yshyn-iohk]

@dependabot rebase