chore(deps): bump actions/setup-node from 6 to 7 - #377
Conversation
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![semgrep-scribd[bot]](https://avatars.githubusercontent.com/u/27892?s=60&v=4){kind=small}
| with: | ||
| version: 7.6.0 | ||
| - uses: actions/setup-node@v6 | ||
| - uses: actions/setup-node@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Actions step actions/setup-node@v7 uses a mutable version tag that can be silently repointed to malicious code, enabling supply-chain attacks on your workflow.
More details about this
The GitHub Actions workflow step uses actions/setup-node@v7, which references a mutable version tag instead of a pinned commit SHA.
Exploit scenario:
- An attacker who controls the
actions/setup-noderepository compromises the maintainer account or gains push access - The attacker re-points the
v7tag to a malicious commit they've created - The next time your workflow runs, GitHub Actions automatically fetches this updated tag and executes the attacker's malicious code
- The attacker now has full access to your repository secrets, environment variables, and can modify your codebase or inject backdoors into your build artifacts
- This could affect all downstream users of your project if you publish packages from this workflow
The same attack happened in real-world incidents like the Trivy Action compromise, where attackers leveraged mutable tags to inject malicious code into CI/CD pipelines affecting thousands of projects.
Using a mutable reference like v7 or main means you're trusting that the tag will always point to safe code—but the action maintainer, or anyone who gains access to their account, can silently change what that tag points to without any notification.
To resolve this comment:
✨ Commit fix suggestion
- Replace the mutable action reference
actions/setup-node@v7with a full 40-character commit SHA for the same action release, for exampleuses: actions/setup-node@<full-40-character-sha>. - Keep the existing
with:settings unchanged so the step still uses the same Node version and pnpm cache configuration. - Resolve the correct SHA from the
actions/setup-noderelease you intend to trust, then pin that exact revision in the workflow file. This prevents the action owner from moving the tag to different code later. - Manually verify that the workflow still installs Node 16 and restores the pnpm cache as expected after the change.
Alternatively, if you need to stay aligned with a specific upstream release name for maintenance, add a comment next to the pinned SHA noting the corresponding tag, such as # actions/setup-node v7, but keep uses: pinned to the commit SHA.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help? Review go/semgrep-playbook or Reach out in #security-vulnerabilities on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
| with: | ||
| version: 7.6.0 | ||
| - uses: actions/setup-node@v6 | ||
| - uses: actions/setup-node@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
The step actions/setup-node@v7 uses a mutable tag that could be redirected to malicious code if the action owner's account is compromised, exposing your secrets to attackers.
More details about this
The actions/setup-node@v7 step uses a mutable major version tag (v7) instead of pinning to a specific commit. This means that if the maintainers of the actions/setup-node repository push a new commit to the v7 tag, your workflow will silently run the updated action without any notice or approval.
Attack scenario:
- An attacker compromises the GitHub repository for
actions/setup-node - The attacker pushes malicious code that exfiltrates the
GITHUB_TOKENorGITHUB_SECRETSavailable in your workflow to an attacker-controlled server - When your "Release on Merge" workflow runs (triggered by a push to
main), the compromised action executes with full access to your secrets - The attacker now has your
GITHUB_TOKENand can impersonate your repository, push code to your branches, or modify releases
This is the same attack vector that compromised trivy-action and kics-github-action in real-world incidents. The mutable tag allows attackers to inject backdoored code that runs automatically in every workflow execution.
To resolve this comment:
✨ Commit fix suggestion
- Replace the mutable action reference
actions/setup-node@v7with a full 40-character commit SHA for the exact action version you want to keep using, for exampleuses: actions/setup-node@<full-40-char-sha>. - Keep the rest of the step the same, including the existing
with:values likenode-version: '16'andcache: 'pnpm'. - Choose the SHA from the official
actions/setup-noderelease you intend to use, and make sure it is the commit behind the currentv7tag rather than a short SHA or tag name. Pinning to a full commit SHA prevents the action owner from silently changing what code runs later. - Manually confirm the workflow still installs Node 16 and restores the pnpm cache as expected after the pinned action runs.
Alternatively, if you need easier version maintenance, pin to the full commit SHA and add a comment next to it with the human-friendly version, such as uses: actions/setup-node@<full-40-char-sha> # v7.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help? Review go/semgrep-playbook or Reach out in #security-vulnerabilities on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
|
To keep it open, please leave a comment or push an update. You can also label it as 'pinned' to prevent auto-closure. |
1 participant
Bumps actions/setup-node from 6 to 7.
Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
CI-only dependency bump with no application or runtime changes; watch for v7 cache behavior if workflows start failing on install.
Overview
Upgrades
actions/setup-nodefrom v6 to v7 in the PR test and release-on-merge workflows.node-version: '16'andcache: 'pnpm'are unchanged; only the action reference is bumped.Reviewed by Cursor Bugbot for commit 8e1fbd6. Bugbot is set up for automated code reviews on this repo. Configure here.