Templating 8.4

[Peter-Sh]

This includes all workflow changes from unstable, fixes and templating from #503 for release/8.4

[jit-ci]

🛡️ Jit Security Scan Results

🚨 Summary

• Shell injection vulnerability detected in GitHub Actions workflow

• Missing '--no-cache' flag in 'apk add' command in Dockerfile

• Both issues could potentially impact security and image size

🔍 Findings

HIGH - 2 findings

1. Shell Injection Vulnerability in GitHub Actions

ID	Type	Finding	File	Severity
ea580111cb	yaml.github-actions.security.run-shell-injection.run-shell-injection	Shell Injection Vulnerability in GitHub Actions - Using variable interpolation with 'github' context data in a 'run:' step could allow code injection. This poses a risk of secret and code theft.	.github/workflows/release_publish.yml (lines 209-231)	HIGH

🔍 AI Analysis: This is a critical vulnerability affecting a GitHub Actions workflow, which could lead to unauthorized access to sensitive information.

Remediation:

- run: |
-   # Create release_info.json with all fields, then filter out empty ones
+ env:
+   GITHUB_CONTEXT: ${{ toJson(github) }}
+ run: |
+   # Create release_info.json with all fields, then filter out empty ones
+   GITHUB_CONTEXT="$GITHUB_CONTEXT"

2. Missing '--no-cache' Flag in 'apk add' Command

ID	Type	Finding	File	Severity
95e30a09bb	DS025	Missing '--no-cache' Flag in 'apk add' Command - The 'apk add' command is used without the '--no-cache' flag. This can lead to increased image size due to cached package data.	alpine/Dockerfile (lines 19-145)	HIGH

🔍 AI Analysis: This issue affects the Dockerfile, which is a key component in building the container image. It impacts image size and potentially security.

Remediation:

- RUN apk add --update ...
+ RUN apk add --no-cache --update ...

▶️ Advanced Options

Help section with supported ignore actions and syntax.

Need to ignore a finding? Use commands like:

@sera ignore <finding_id> reason:accepted (reason is optional)

@sera ignore all reason:other - this is a test PR (reason is optional)

@sera ignore type:run-shell-injection

@sera ignore type:DS025

---

^{Security scan by Jit}