Bump microsoft/security-devops-action from 1.6.0 to 1.10.0

[dependabot]

Bumps microsoft/security-devops-action from 1.6.0 to 1.10.0.

Release notes

Sourced from microsoft/security-devops-action's releases.

v1.10.0

This release brings introduces our first pre and post job feature, container-mapping, as an opt-in feature. It runs docker commands to see which containers have been created during the pipeline for integration with Microsoft Defender for DevOps.

To configure Container Mapping to send conatiner data to Microsoft Defender for DevOps, include container-mapping as a tool:

- uses: microsoft/security-devops-action@v1
  id: msdo
  with:
    includeTools: container-mapping

This will run all the analyzers defined by the configured or defaulted policy in addition to container-mapping. To only run this feature, define container-mapping as the only tool to run:

- uses: microsoft/security-devops-action@v1
  id: msdo
  with:
    tools: container-mapping

---

In future releases, we will use this to auto-configure container scanning as well as introduce additional scanning optimizations and capabilities.

v1.9.1

Adds a backwards compatibility check for the --export-breaking-results-to-file which going forward still exists, with corrected behavior, and will use --export-file instead.

v1.7.2 - node10 backwards compatibility fix

v1.7.2 - 06/22/2023

Fixed

• Added try-catch best effort for gzip json response decompression from nuget.org
• Compile with nodenext moduleResolution so it implements a Promise resolver intead of yield on dynamic module resolution (node v13.2+)
  • Resolves node and node10 task runners

v1.7.0

Added

• The msdo-nuget-client.ts javascript nuget client
• Dependency on adm-zip
• Dependency on decompress-response

Changed

• Install the MSDO nuget package via javascript
  • Removes a dependency on dotnet to leverage restore to install the platform cross-platform
• Upgraded dependencies
  • azure-pipelines-task-lib to v4.3.1
  • azure-pipelines-tool-lib to v2.0.4
  • typescript to v5.1.3

Commits

• 7e3060a Container mapping feature PR #85
• 5582dae Merge pull request #77 from microsoft/containerMappingPreview
• 6732229 Restore on-push verification
• 84b3f4a Merge changes from main
• 2222069 Invert the --tools ordering
• 4bf7b77 Merge pull request #84 from microsoft/dev/daknis/includeTools
• c97453f Use enum and fix input name
• af2f56c Correct when to add --tool on includedTools
• c45e613 Deduplicate included tools
• a24ae55 Correct tools vs includeTools input behavior
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/microsoft/security-devops-action	7e3060ae1e6a9347dd7de6b28195099f39852fe2	🟢 7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 2 3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Token-Permissions 🟢 8 detected GitHub workflow tokens with excessive permissions Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 10 SAST tool is run on all commits Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Vulnerabilities 🟢 8 2 existing vulnerabilities detected
actions/microsoft/security-devops-action	e94440350ed10e2806d47cd0d7504a2c51abdbe9	🟢 7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 2 3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Token-Permissions 🟢 8 detected GitHub workflow tokens with excessive permissions Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 10 SAST tool is run on all commits Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Vulnerabilities 🟢 8 2 existing vulnerabilities detected

Scanned Manifest Files

.github/workflows/defender-for-devops.yml

• microsoft/security-devops-action@7e3060a
• microsoft/security-devops-action@e944403