chore(deps): bump actions/setup-node from 6 to 7 - #380
Conversation
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![semgrep-scribd[bot]](https://avatars.githubusercontent.com/u/27892?s=60&v=4){kind=small}
| with: | ||
| version: 7.6.0 | ||
| - uses: actions/setup-node@v6 | ||
| - uses: actions/setup-node@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Actions step uses mutable tag v7 which can be silently repointed by the action owner, enabling supply-chain attacks through malicious code injection into CI/CD pipelines.
More details about this
The workflow step actions/setup-node@v7 uses a mutable version tag (v7) instead of a pinned commit SHA. This allows the action owner to silently update what code runs in your CI/CD pipeline without your knowledge.
Here's how an attacker could exploit this:
- Compromise the action repository: An attacker gains access to the
actions/setup-noderepository on GitHub. - Repoint the tag: They force-push to the
v7tag, pointing it to a malicious commit that includes backdoored Node.js setup code or credentials theft. - Automatic execution: The next time your workflow runs (on any pull request), GitHub automatically pulls the latest commit at
v7, which is now the attacker's malicious code. - Silent compromise: Your
node-versionand cache settings execute against the attacker's modified action, potentially exposing secrets in${{ secrets }}or injecting malware into your build artifacts.
This mirrors real supply-chain attacks like the Trivy and KICS GitHub Action compromises, where legitimate actions were weaponized through tag manipulation.
To prevent this, replace the mutable tag with a full 40-character commit SHA so your workflow always runs the exact same code.
To resolve this comment:
✨ Commit fix suggestion
- Replace the mutable action reference
actions/setup-node@v7with a full 40-character commit SHA for the exact release you want to keep using, for exampleuses: actions/setup-node@<full-commit-sha>. - Keep the existing
with:block unchanged so the workflow behavior stays the same, for examplenode-version: '16'andcache: 'pnpm'do not need to change. - Get the correct SHA from the
actions/setup-noderelease you intend to use, then paste that SHA directly into theuses:line instead of the version tag. Pinning to a commit SHA prevents the action owner from movingv7to different code later.
Alternatively, if you need easier version updates, pin to the commit SHA that corresponds to the current v7 release and track upgrades separately by updating that SHA when you intentionally adopt a newer release.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help? Review go/semgrep-playbook or Reach out in #security-vulnerabilities on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
| with: | ||
| version: 7.6.0 | ||
| - uses: actions/setup-node@v6 | ||
| - uses: actions/setup-node@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Actions step uses mutable version tag v7 which can be repointed by the action owner to inject malicious code into your workflow. Pin to a full commit SHA instead.
More details about this
The step uses: actions/setup-node@v7 references the action using a mutable version tag (v7) instead of pinning to a specific commit SHA. Version tags can be moved or repointed by the action owner after release, allowing them to silently inject malicious code into your workflow.
Here's how an attacker could exploit this:
- Compromise the action repository: An attacker gains control of the
actions/setup-noderepository (via credential theft, internal access, or social engineering). - Repoint the v7 tag: The attacker moves the
v7tag to a malicious commit they've created that contains backdoored Node.js setup logic. - Your workflow pulls the malicious version: Next time your CI/CD pipeline runs,
actions/setup-node@v7resolves to the attacker's malicious commit instead of the legitimate one. - Execute payload: The backdoor code runs with full access to your repository secrets (
GITHUB_TOKEN), environment variables, and build artifacts. The attacker can steal credentials, modify your package contents, or compromise downstream users.
This same attack vector was used in the real-world compromises of trivy-action and kics-github-action, where attackers gained the ability to exfiltrate credentials and manipulate build outputs.
To resolve this comment:
✨ Commit fix suggestion
-
Replace the mutable GitHub Action reference with a full 40-character commit SHA instead of the
v7tag.
Changeuses: actions/setup-node@v7touses: actions/setup-node@<full-commit-sha>. -
Resolve the SHA from the exact action version you intend to trust.
For example, open theactions/setup-noderelease or tag page, find the commit behindv7, and copy the full SHA rather than a branch or tag name. -
Keep the existing
with:block unchanged after pinning the action.
The step should look like- uses: actions/setup-node@8ade135a41bc03ea155e62e844d188df1ea18608followed by the currentnode-versionandcachesettings. Pinning to a commit SHA prevents the action owner from silently moving the version reference later.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help? Review go/semgrep-playbook or Reach out in #security-vulnerabilities on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
|
To keep it open, please leave a comment or push an update. You can also label it as 'pinned' to prevent auto-closure. |
1 participant
Bumps actions/setup-node from 6 to 7.
Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Workflow-only dependency bump with no application or secret-handling changes; existing inputs are unchanged.
Overview
Upgrades
actions/setup-nodefrom v6 to v7 in the CI workflows that install Node for pnpm.release-on-merge.ymlandtest-on-pull-request.ymlstill use Node 16 andcache: 'pnpm'; only the action major version changes.Reviewed by Cursor Bugbot for commit 01ab8d6. Bugbot is set up for automated code reviews on this repo. Configure here.