Upgrade: Bump anchore/sbom-action from 0.17.7 to 0.17.8

[dependabot]

Bumps anchore/sbom-action from 0.17.7 to 0.17.8.

Release notes

Sourced from anchore/sbom-action's releases.

v0.17.8

Changes in v0.17.8

• chore(deps): update Syft to v1.17.0 (#507) [anchore-actions-token-generator]

Commits

• 55dc4ee chore(deps): update Syft to v1.17.0 (#507)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dryrunsecurity]

DryRun Security Summary

The provided code change updates the version of the anchore/sbom-action/download-syft action used in the GitHub Actions workflow for the project's release process, which does not appear to have any significant security implications but should be reviewed carefully to ensure that the new version does not introduce any known vulnerabilities or security issues.

Expand for full summary

Summary:

The provided code change is related to the GitHub Actions workflow for the project's release process. The key change is an update to the version of the anchore/sbom-action/download-syft action used in the workflow. From an application security perspective, this change does not appear to have any significant security implications. However, it is important to review the changes carefully, as even seemingly minor updates can sometimes have security implications.

In this case, it would be prudent to verify that the new version of the anchore/sbom-action/download-syft action does not introduce any known vulnerabilities or security issues. Additionally, it is a good practice to review the overall release workflow to ensure that it follows best practices for secure software release management, such as proper authentication and authorization mechanisms, secure storage and handling of sensitive information, thorough testing and verification of the release artifacts, and monitoring and logging of the release process for potential security incidents.

Files Changed:

• .github/workflows/release.yaml: This file contains the GitHub Actions workflow for the project's release process. The key change in this pull request is an update to the version of the anchore/sbom-action/download-syft action used in the workflow, from fc46e51fd3cb168ffb36c6d1915723c47db58abb to 55dc4ee22412511ee8c3142cbea40418e6cec693. This change does not appear to have any significant security implications, but it is important to verify that the new version of the action does not introduce any known vulnerabilities or security issues.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.