feat(gha): Update and pin "peter-evans/create-pull-request"

[kiblik]

Step forward from #11672 already offers.

[dryrunsecurity]

DryRun Security Summary

The GitHub Actions workflow automatically updates sample data using a scheduled or manual trigger, but raises security concerns due to hardcoded credentials, reliance on an external binary, and potential vulnerabilities in the regular update process.

Expand for full summary

Summary:

The provided GitHub Actions workflow is responsible for regularly updating the sample data file dojo/fixtures/defect_dojo_sample_data.json. This workflow runs on a schedule (the first day of January, April, July, and October at midnight UTC) or can be manually triggered. While the workflow serves a routine maintenance purpose, there are a few security considerations that should be addressed.

Firstly, the workflow uses hardcoded values for the GIT_USERNAME and GIT_EMAIL environment variables, which is generally not considered a best practice for storing sensitive information. It would be more secure to store these credentials as GitHub Secrets. Secondly, the workflow relies on an external binary called fixture-updater to update the sample data file. It's essential to ensure that this binary is trusted and does not introduce any security vulnerabilities or malicious code. Finally, the scheduled execution of the workflow means that the sample data will be updated regularly, which could potentially lead to issues if the fixture-updater binary or the update process itself introduces any security vulnerabilities.

Files Changed:

• .github/workflows/update-sample-data.yml: This file contains the GitHub Actions workflow responsible for updating the dojo/fixtures/defect_dojo_sample_data.json file. The workflow checks out the code, runs the fixture-updater binary to update the sample data file, commits the changes to a new branch, and creates a pull request. The key security considerations are the use of hardcoded credentials, the dependency on an external binary, and the scheduled execution of the workflow.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[mtesauro]

Approved