Address CVE-2020-15228

[LCaparelli]

Currently, the action uses the set-env and add-path commands which have recently been deprecated by Github as remediation to $SUBJECT. They have already been replaced with new mechanisms which offer the same functionality. Please refer to:

• https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/
• GHSA-mfwh-5m23-j46w

When running the action users get warnings about the deprecated actions.

[alex]

Limited grepping suggests that the issue here isn't in golangci-lint-action's own source code, but rather in one of the dependencies. Seems not unlikely merely bumping the version will resolve this, but I don't JS packaging well enough to track down which dep it is.

[LCaparelli]

Limited grepping suggests that the issue here isn't in golangci-lint-action's own source code, but rather in one of the dependencies. Seems not unlikely merely bumping the version will resolve this, but I don't JS packaging well enough to track down which dep it is.

I thought that could be the case as I couldn't find the deprecated commands in this repo either. I'm also unsure how to track this down further.

[tcnghia]

It is action/core: needs to be 1.2.6 or later

https://github.com/golangci/golangci-lint-action/blob/v2/package.json#L29

[sayboras]

Thanks for reporting this issue, I will have a chance to take a look weekend only.

PR is much appreciated 💯

[tcnghia]

@sayboras it is already fixed at HEAD, so just need a new release I think

[tcnghia]

Was fixed here #96

[sayboras]

it is already fixed at HEAD, so just need a new release I think

@tcnghia oh thanks a lot 👍. The testing currently in github action is quite limited, let me do quick check sometime tonight or tomorrow, if it's all good, I will create new release.

[tcnghia]

Thanks a lot @sayboras

[LCaparelli]

Thank you @tcnghia @sayboras :-)

[tcnghia]

@ernado thanks for merging #99. When do we release a new version that includes this fix? Thanks!

[sayboras]

@tcnghia yup, I will plan sometimes for releasing new version v2.2.1 today :)

[tcnghia]

Thanks a lot!!

[sayboras]

v2.2.1 is released https://github.com/golangci/golangci-lint-action/releases/tag/v2.2.1.

I have also tested with one of my private repo, seems good.

[sayboras]

dependabot is working hard as well golangci/golangci-lint#1447