chore(deps): bump actions/setup-node from 6 to 7 - #379
Conversation
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![semgrep-scribd[bot]](https://avatars.githubusercontent.com/u/27892?s=60&v=4){kind=small}
| with: | ||
| version: 7.6.0 | ||
| - uses: actions/setup-node@v6 | ||
| - uses: actions/setup-node@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
The GitHub Actions step actions/setup-node@v7 uses a mutable version tag that could be silently redirected to malicious code by an attacker who compromises the action's repository.
More details about this
The actions/setup-node@v7 step uses a mutable tag (v7) instead of a pinned commit SHA. Since GitHub Actions owners can silently move what v7 points to at any time, an attacker who compromises the actions/setup-node repository could redirect this tag to malicious code. This could happen during the workflow execution, and since this job runs on every pull request, the malicious code would execute with access to your repository contents and secrets.
Exploit scenario:
- Attacker compromises the
actionsorganization on GitHub - Attacker moves the
v7tag in thesetup-noderepository to point to a commit containing malicious code (e.g., exfiltrating${{ secrets.GITHUB_TOKEN }}or repository contents) - Your workflow runs on the next pull request
- GitHub Actions fetches the
v7tag, which now resolves to the attacker's malicious commit - The malicious code executes in the
setup-node@v7step with full access to your repository and environment variables
To resolve this comment:
✨ Commit fix suggestion
- Replace the mutable action reference
actions/setup-node@v7with a full 40-character commit SHA for the exact release you want to keep using, for exampleuses: actions/setup-node@<full-commit-sha>. - Look up the commit SHA from the
v7release in theactions/setup-noderepository and copy the full hash, not a shortened hash. This makes the workflow run the exact same action code every time. - Keep the existing
with:settings unchanged under that step, for example thenode-versionandcachevalues do not need to change. - If you want to keep the version readable, add a comment next to the pinned SHA such as
# actions/setup-node v7so future updates are easier to manage.
Alternatively, if you need to use a local action instead of a remote one, change the step to a local path such as uses: ./path/to/action, which is also allowed by this rule.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help? Review go/semgrep-playbook or Reach out in #security-vulnerabilities on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
| with: | ||
| version: 7.6.0 | ||
| - uses: actions/setup-node@v6 | ||
| - uses: actions/setup-node@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Actions step uses mutable tag v7 instead of a commit SHA, allowing the action owner to silently redirect to malicious code during workflow execution.
More details about this
The actions/setup-node action is pinned to the v7 tag, which is a mutable reference that can be silently repointed by the action owner to point to different commits without any warning.
Here's how an attacker could exploit this:
-
Compromise the action repository: An attacker gains write access to the
actions/setup-noderepository (via stolen credentials, compromised maintainer account, etc.). -
Repoint the v7 tag: The attacker moves the
v7tag to a malicious commit they've created that injects backdoors into Node.js installations or steals environment secrets. -
Automatic deployment: When your GitHub Actions workflow runs on the next push to
main, it automatically uses the new malicious code pointed to byv7. Your CI/CD system then executes the backdoored Node.js setup and potentially exposesGITHUB_TOKENor other secrets to the attacker. -
Supply chain compromise: The attacker now has code execution within your repository's CI/CD context, allowing them to inject malicious code into your published packages or steal sensitive data.
This is exactly how the trivy-action and kics-github-action compromises occurred in real incidents. Using a specific 40-character commit SHA (immutable) instead of v7 (mutable) prevents this attack.
To resolve this comment:
✨ Commit fix suggestion
- Replace the mutable action reference
actions/setup-node@v7with a full 40-character commit SHA for the exact action version you intend to use, for exampleuses: actions/setup-node@<full-commit-sha>. - Keep the existing
with:settings unchanged under that step, includingnode-version: '16'andcache: 'pnpm'. - Choose the SHA from the upstream
actions/setup-noderelease that matches the version you want, rather than using a tag or branch name. Pinning to a commit SHA prevents the referenced code from changing without an explicit workflow update. - Update the other mutable
uses:entries in the same workflow the same way, becauseactions/checkout@v6,pnpm/action-setup@v5, andcycjimmy/semantic-release-action@v5are also tag-based references and should be changed to full commit SHAs.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help? Review go/semgrep-playbook or Reach out in #security-vulnerabilities on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
|
To keep it open, please leave a comment or push an update. You can also label it as 'pinned' to prevent auto-closure. |
1 participant
Bumps actions/setup-node from 6 to 7.
Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
CI-only dependency bump with no application code or workflow input changes; verify PR/release jobs still pass after merge.
Overview
Upgrades
actions/setup-nodefrom v6 to v7 in the release-on-merge and test-on-pull-request workflows.node-version: '16'andcache: 'pnpm'are unchanged.Reviewed by Cursor Bugbot for commit b5bf326. Bugbot is set up for automated code reviews on this repo. Configure here.