chore(deps): update actions/checkout action from v3 to v4 (.github/workflows/update-sample-data.yml)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v3 -> v4

---

Release Notes

actions/checkout (actions/checkout)

v4

Compare Source

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in https://github.com/actions/checkout/pull/1924

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dryrunsecurity]

DryRun Security Summary

The GitHub Pull Request updates the Actions workflow for maintaining sample data by upgrading the checkout action, implementing secure credential handling, and automating the branch creation and PR process, with no significant security concerns identified.

Expand for full summary

Summary:

The changes in this GitHub Pull Request primarily focus on updating the GitHub Actions workflow that is responsible for periodically updating the sample data file dojo/fixtures/defect_dojo_sample_data.json. The key changes include upgrading to the latest version of the actions/checkout action, setting secure environment variables for the git user, and automating the process of creating a new branch, committing the changes, and opening a Pull Request.

From an application security perspective, these changes do not introduce any obvious security concerns. The version upgrade, secure handling of credentials, and automated Pull Request creation are all good security practices that help maintain the integrity and traceability of the codebase. The scheduled update of the sample data file is also a routine maintenance task that helps keep the application's test data up-to-date.

Files Changed:

• .github/workflows/update-sample-data.yml: This file contains the GitHub Actions workflow that is responsible for updating the sample data file. The changes include:
  • Upgrading the actions/checkout action to version 4, which typically includes bug fixes and improvements.
  • Setting the GIT_USERNAME and GIT_EMAIL environment variables to ensure the commit is attributed to the correct user.
  • Automating the process of creating a new branch, committing the changes, and opening a Pull Request to merge the updated sample data.

Overall, these changes appear to be reasonable and appropriate for the task of maintaining the sample data used in the application. As an application security engineer, I do not have any major concerns with the code changes presented in this Pull Request.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[mtesauro]

Approved