jdx/jactionlint v2.4.0

v2.4.0: Private Use Area detection and fixes for artipacked, Dependabot groups and SARIF uploads

on GitHub

jactionlint 2.4.0 extends invisible-characters to report Private Use Area characters. It also fixes false positives in artipacked and dependabot-syntax, and stops the "inconsistent fingerprint" warnings when you upload SARIF to code scanning.

Added

• invisible-characters reports Private Use Area characters (U+E000–U+F8FF and the two supplementary private-use planes). Most fonts have no glyph for these characters, so they can hide a payload that a script decodes at run time, the same way variation selectors can. The message calls them PRIVATE USE CHARACTER. The rule ID, profile, level and the fix that removes the character have not changed. If you use Nerd Font or Powerline icons on purpose, write them as escape sequences before you apply the fix. Otherwise the fix removes them. (#311, @jdx)

Fixed

• artipacked no longer reports actions/checkout v6 and later. Starting with v6, checkout stores the credential in a file under $RUNNER_TEMP instead of the workspace, so uploading the workspace doesn't publish it. The rule skips v6+ tag refs, and also commit pins whose version comment says v6 or later. v5 and earlier are still reported. (#308, @jdx)
• dependabot-syntax no longer reports an update with multi-ecosystem-group as a duplicate of the regular update for the same ecosystem and directory. Two updates are now duplicates only when they match on ecosystem, directory, target branch and group. Two ungrouped updates, or two updates in the same group, are still reported. (#314, @jdx)
• SARIF output no longer writes primaryLocationLineHash. github/codeql-action/upload-sarif computes this value itself and logs an "inconsistent fingerprint" warning when a file supplies a different one. The fingerprint value is unchanged and is now stored under jactionlint/contextHash/v1 in partialFingerprints. If your tools read jactionlint's fingerprint from primaryLocationLineHash, switch them to the new key. (#307, @jdx)

Full Changelog: v2.3.0...v2.4.0

💚 Sponsor jactionlint

jactionlint is a fork of rhysd/actionlint, maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If jactionlint has a place in your development workflow, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep jactionlint fast, free, and independent.