Skip to content

chore(deps): bump actions/setup-node from 6 to 7 #379

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump actions/setup-node from 6 to 7 #379

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/release-on-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
- uses: pnpm/action-setup@v5
with:
version: 7.6.0
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7

@semgrep-scribd semgrep-scribd Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

GitHub Actions step uses mutable tag v7 instead of a commit SHA, allowing the action owner to silently redirect to malicious code during workflow execution.

More details about this

The actions/setup-node action is pinned to the v7 tag, which is a mutable reference that can be silently repointed by the action owner to point to different commits without any warning.

Here's how an attacker could exploit this:

  1. Compromise the action repository: An attacker gains write access to the actions/setup-node repository (via stolen credentials, compromised maintainer account, etc.).

  2. Repoint the v7 tag: The attacker moves the v7 tag to a malicious commit they've created that injects backdoors into Node.js installations or steals environment secrets.

  3. Automatic deployment: When your GitHub Actions workflow runs on the next push to main, it automatically uses the new malicious code pointed to by v7. Your CI/CD system then executes the backdoored Node.js setup and potentially exposes GITHUB_TOKEN or other secrets to the attacker.

  4. Supply chain compromise: The attacker now has code execution within your repository's CI/CD context, allowing them to inject malicious code into your published packages or steal sensitive data.

This is exactly how the trivy-action and kics-github-action compromises occurred in real incidents. Using a specific 40-character commit SHA (immutable) instead of v7 (mutable) prevents this attack.

To resolve this comment:

✨ Commit fix suggestion
  1. Replace the mutable action reference actions/setup-node@v7 with a full 40-character commit SHA for the exact action version you intend to use, for example uses: actions/setup-node@<full-commit-sha>.
  2. Keep the existing with: settings unchanged under that step, including node-version: '16' and cache: 'pnpm'.
  3. Choose the SHA from the upstream actions/setup-node release that matches the version you want, rather than using a tag or branch name. Pinning to a commit SHA prevents the referenced code from changing without an explicit workflow update.
  4. Update the other mutable uses: entries in the same workflow the same way, because actions/checkout@v6, pnpm/action-setup@v5, and cycjimmy/semantic-release-action@v5 are also tag-based references and should be changed to full commit SHAs.
💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

Need help? Review go/semgrep-playbook or Reach out in #security-vulnerabilities on Slack.

You can view more details about this finding in the Semgrep AppSec Platform.

with:
node-version: '16'
cache: 'pnpm'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test-on-pull-request.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
- uses: pnpm/action-setup@v5
with:
version: 7.6.0
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7

@semgrep-scribd semgrep-scribd Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

The GitHub Actions step actions/setup-node@v7 uses a mutable version tag that could be silently redirected to malicious code by an attacker who compromises the action's repository.

More details about this

The actions/setup-node@v7 step uses a mutable tag (v7) instead of a pinned commit SHA. Since GitHub Actions owners can silently move what v7 points to at any time, an attacker who compromises the actions/setup-node repository could redirect this tag to malicious code. This could happen during the workflow execution, and since this job runs on every pull request, the malicious code would execute with access to your repository contents and secrets.

Exploit scenario:

  1. Attacker compromises the actions organization on GitHub
  2. Attacker moves the v7 tag in the setup-node repository to point to a commit containing malicious code (e.g., exfiltrating ${{ secrets.GITHUB_TOKEN }} or repository contents)
  3. Your workflow runs on the next pull request
  4. GitHub Actions fetches the v7 tag, which now resolves to the attacker's malicious commit
  5. The malicious code executes in the setup-node@v7 step with full access to your repository and environment variables

To resolve this comment:

✨ Commit fix suggestion
  1. Replace the mutable action reference actions/setup-node@v7 with a full 40-character commit SHA for the exact release you want to keep using, for example uses: actions/setup-node@<full-commit-sha>.
  2. Look up the commit SHA from the v7 release in the actions/setup-node repository and copy the full hash, not a shortened hash. This makes the workflow run the exact same action code every time.
  3. Keep the existing with: settings unchanged under that step, for example the node-version and cache values do not need to change.
  4. If you want to keep the version readable, add a comment next to the pinned SHA such as # actions/setup-node v7 so future updates are easier to manage.

Alternatively, if you need to use a local action instead of a remote one, change the step to a local path such as uses: ./path/to/action, which is also allowed by this rule.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

Need help? Review go/semgrep-playbook or Reach out in #security-vulnerabilities on Slack.

You can view more details about this finding in the Semgrep AppSec Platform.

with:
node-version: '16'
cache: 'pnpm'
Expand Down
Loading