Merge pull request #170 from AndreasAugustin/fix/#168_CVE-2022-24765

fix(cve): fix bug related to CVE-2022-24765 🔒

.github/workflows/actions_template_sync.yml

@@ -14,9 +14,9 @@ jobs:
     steps:
       # To use this repository's private action, you must check out the repository
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: actions-template-sync
-        uses: AndreasAugustin/actions-template-sync@v0.2.1-draft
+        uses: AndreasAugustin/actions-template-sync@v0.3.1-draft
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           source_repo_path: AndreasAugustin/template

.github/workflows/test.yml

@@ -11,7 +11,7 @@ jobs:
     steps:
       # To use this repository's private action, you must check out the repository
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: Test action step
         uses: ./ # Uses an action in the root directory
         with:

Dockerfile

@@ -3,7 +3,7 @@
 ######################################
 FROM alpine:3.15.4 as dev
 
-ARG GH_CLI_VER=2.3.0
+ARG GH_CLI_VER=2.8.0
 
 # install packages
 RUN apk add --update --no-cache bash make git zsh curl tmux musl openssh

README.md

@@ -39,9 +39,9 @@ jobs:
     steps:
       # To use this repository's private action, you must check out the repository
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: actions-template-sync
-        uses: AndreasAugustin/[email protected].0-draft
+        uses: AndreasAugustin/[email protected].1-draft
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           source_repo_path: <owner/repo>
@@ -90,9 +90,9 @@ jobs:
     steps:
       # To use this repository's private action, you must check out the repository
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: actions-template-sync
-        uses: AndreasAugustin/[email protected].0-draft
+        uses: AndreasAugustin/[email protected].1-draft
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           source_repo_path: ${{ secrets.SOURCE_REPO_PATH }} # <owner/repo>, should be within secrets

src/Dockerfile

@@ -1,6 +1,6 @@
-FROM alpine:3.15.0
+FROM alpine:3.15.4
 
-ARG GH_CLI_VER=2.3.0
+ARG GH_CLI_VER=2.8.0
 
 # labels
 LABEL \

src/entrypoint.sh

@@ -38,6 +38,7 @@ echo "set git global configuration"
 git config --global user.email "[email protected].${SOURCE_REPO_HOSTNAME}"
 git config --global user.name "${GITHUB_ACTOR}"
 git config --global pull.rebase false
+git config --global --add safe.directory /github/workspace
 echo "::endgroup::"
 
 # shellcheck source=src/sync_template.sh