fix(rules): check major and minor action refs against the latest release in their line

[Mohil-Ahuja]

Fixes #443

known_vulnerability_in_build_component trims the v from a ref and passes the rest to semver.constraint_check, so @v4 is checked as 4.0.0. Action authors move a major tag (and often a minor one) to each new release in that line, so @v4 runs the latest 4.x. With an advisory fixed in 4.2.0, @v4 was reported even though the tag already points at a fixed release.

This pads a major or minor ref to the highest version it can stand for before the check: 4 becomes 4.999999999.999999999 and 4.1 becomes 4.1.999999999. Along the lines of the padding suggested in the issue, but done in the rule rather than in the builtin:

• @v4 is reported only if no 4.x release has the fix (e.g. a range <5.0.0).
• @v4.1 is reported only if no 4.1.x release has it.
• Full versions like @v4.1.2 are checked exactly as before.

semver.constraint_check itself is unchanged, because known_vulnerability_in_build_platform also uses it for platform versions, where a short version is not a moving tag.

The trade-off: a repository that never moves its major tag stays at whatever release the tag was cut on, and a ref to it would now be treated as the latest in its line. Moving major tags is the documented convention for actions, so this follows what the ref usually resolves to.

Tests

TestKnownVulnerabilityInBuildComponentFloatingRefs runs step_advisory against run-terraform.yml (vulnerable below 2.7.5, in the bundled advisories):

ref	reported
v1	yes
v2	no (2.7.5 is in the 2.x line)
v2.2	yes
v2.7	no
v2.7.1, 2.7.1	yes
v2.7.5, v3	no

With the previous rule, v2 and v2.7 fail (reported) and the rest pass. go test ./... passes; the existing @v2.2 fixture in scanner/testdata is still reported, as 2.2.x is below 2.7.5.

[fproulx-boostsecurity]

Sorry, but CI fails. Some tests do not pass @Mohil-Ahuja

[Mohil-Ahuja]

@fproulx-boostsecurity Thanks, fixed in c383a7d. The two failing snapshot tests expected known_vulnerability_in_build_component for rlespinasse/github-slug-action@v4 in messypoutine/gravy-overflow (GHSA-6q4m-7476-932w, affects versions below 4.4.1). That repo's v4 tag points at v4.5.0, so with this change @v4 is no longer reported. That was the false positive #443 describes. I removed that finding from both snapshots. The other findings for the same step (from other rules) are unchanged. I couldn't run the snapshot tests locally since they need GH_TOKEN, so CI is the check here.