zellij/0.41.2-r1: cve remediation

[octo-sts]

GHSA-c2f5-jxjv-2hh8 has been raised as a false-positive advisory, since this PR was opened: wolfi-dev/advisories#11060.

GHSA-h97m-ww89-6jmq is covered in: #38689

---

zellij/0.41.2-r1: fix GHSA-h97m-ww89-6jmq/GHSA-c2f5-jxjv-2hh8/

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/zellij.advisories.yaml

[octo-sts]

Gen AI suggestions to solve the build error:

Based on the error output and context, I'll analyze and provide a solution:

• Detected Error: [git checkout] execute: git clone --quiet --origin=origin --config=user.name=Melange Build [email protected] --config=advice.detachedHead=false --branch=v0.41.2 --depth=1 https://github.com/zellij-org/zellij /tmp/tmp.v7wbUk

• Error Category: Version/Git Checkout

• Failure Point: The git-checkout step in the pipeline

• Root Cause Analysis: The build is failing because it's trying to clone directly using the tag as a branch, which is not the correct way to fetch a specific tag in git.

• Suggested Fix: Modify the git-checkout step to use proper tag fetching:

  - uses: git-checkout
    with:
      repository: https://github.com/zellij-org/zellij
      tag: v${{package.version}}
      expected-commit: 40d49737d126eef60dd988f1fe60df4c42d23773
      fetch-depth: 1
      fetch-tags: true

• Explanation: The current approach tries to use the tag as a branch which doesn't work. The fix explicitly tells git to fetch tags and then checkout the specific tag. The fetch-tags: true ensures all tags are fetched before attempting to checkout.

• Additional Notes:

• This is a common issue when working with tagged releases in git
• The expected-commit hash verification will still work as intended
• The fetch-depth: 1 keeps the clone minimal for better performance

• References:

• Melange git-checkout action documentation: https://github.com/chainguard-dev/melange/blob/main/docs/reference.md#git-checkout
• Git documentation on fetching tags: https://git-scm.com/docs/git-fetch#Documentation/git-fetch.txt---tags

[Dentrax]

Superseded by #38689