fix(renovate): Clean records

[kiblik]

• track node-version is not needed. Renovate knows this. See https://github.com/DefectDojo/django-DefectDojo/pull/13508/files
• tune matchStrings

[dryrunsecurity]

This pull request updates the shellcheck workflow to use SHELLCHECK_VERSION v0.9.0 but leaves the hardcoded SHELLCHECK_SHA unchanged (with a comment noting it isn't auto-updated), which creates a supply-chain/integrity risk if the checksum is out of date or if integrity checks are skipped. Consider updating the SHA when bumping the version or automating checksum verification to prevent build failures or potential compromise.

CI/CD Supply Chain Risk (Outdated Checksum) in .github/workflows/shellcheck.yml

Vulnerability

CI/CD Supply Chain Risk (Outdated Checksum)

Description

The shellcheck.yml workflow updates the SHELLCHECK_VERSION to 'v0.9.0', but the SHELLCHECK_SHA is explicitly noted in a comment as not being automatically updated. This creates a risk where the downloaded shellcheck binary might not match the hardcoded SHA. If an integrity check is performed, it would fail, potentially breaking the build. More critically, if the integrity check is skipped or improperly implemented, a compromised version of the shellcheck tool could be executed, leading to a supply chain attack. The code comment itself highlights this manual update requirement, indicating a known gap in automated integrity verification for this specific dependency.

django-DefectDojo/.github/workflows/shellcheck.yml

Lines 8 to 10 in 9cf6ff2

	SHELLCHECK_SHA: '038fd81de6b7e20cc651571362683853670cdc71' # Renovate config is not currently adjusted to update hash - it needs to be done manually for now
	jobs:
	shellcheck:

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.