Skip to content

chore(deps): bump actions/setup-node from 6 to 7 #377

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump actions/setup-node from 6 to 7 #377

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/release-on-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
- uses: pnpm/action-setup@v5
with:
version: 7.6.0
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7

@semgrep-scribd semgrep-scribd Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

The step actions/setup-node@v7 uses a mutable tag that could be redirected to malicious code if the action owner's account is compromised, exposing your secrets to attackers.

More details about this

The actions/setup-node@v7 step uses a mutable major version tag (v7) instead of pinning to a specific commit. This means that if the maintainers of the actions/setup-node repository push a new commit to the v7 tag, your workflow will silently run the updated action without any notice or approval.

Attack scenario:

  1. An attacker compromises the GitHub repository for actions/setup-node
  2. The attacker pushes malicious code that exfiltrates the GITHUB_TOKEN or GITHUB_SECRETS available in your workflow to an attacker-controlled server
  3. When your "Release on Merge" workflow runs (triggered by a push to main), the compromised action executes with full access to your secrets
  4. The attacker now has your GITHUB_TOKEN and can impersonate your repository, push code to your branches, or modify releases

This is the same attack vector that compromised trivy-action and kics-github-action in real-world incidents. The mutable tag allows attackers to inject backdoored code that runs automatically in every workflow execution.

To resolve this comment:

✨ Commit fix suggestion
  1. Replace the mutable action reference actions/setup-node@v7 with a full 40-character commit SHA for the exact action version you want to keep using, for example uses: actions/setup-node@<full-40-char-sha>.
  2. Keep the rest of the step the same, including the existing with: values like node-version: '16' and cache: 'pnpm'.
  3. Choose the SHA from the official actions/setup-node release you intend to use, and make sure it is the commit behind the current v7 tag rather than a short SHA or tag name. Pinning to a full commit SHA prevents the action owner from silently changing what code runs later.
  4. Manually confirm the workflow still installs Node 16 and restores the pnpm cache as expected after the pinned action runs.

Alternatively, if you need easier version maintenance, pin to the full commit SHA and add a comment next to it with the human-friendly version, such as uses: actions/setup-node@<full-40-char-sha> # v7.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

Need help? Review go/semgrep-playbook or Reach out in #security-vulnerabilities on Slack.

You can view more details about this finding in the Semgrep AppSec Platform.

with:
node-version: '16'
cache: 'pnpm'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test-on-pull-request.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
- uses: pnpm/action-setup@v5
with:
version: 7.6.0
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7

@semgrep-scribd semgrep-scribd Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

GitHub Actions step actions/setup-node@v7 uses a mutable version tag that can be silently repointed to malicious code, enabling supply-chain attacks on your workflow.

More details about this

The GitHub Actions workflow step uses actions/setup-node@v7, which references a mutable version tag instead of a pinned commit SHA.

Exploit scenario:

  1. An attacker who controls the actions/setup-node repository compromises the maintainer account or gains push access
  2. The attacker re-points the v7 tag to a malicious commit they've created
  3. The next time your workflow runs, GitHub Actions automatically fetches this updated tag and executes the attacker's malicious code
  4. The attacker now has full access to your repository secrets, environment variables, and can modify your codebase or inject backdoors into your build artifacts
  5. This could affect all downstream users of your project if you publish packages from this workflow

The same attack happened in real-world incidents like the Trivy Action compromise, where attackers leveraged mutable tags to inject malicious code into CI/CD pipelines affecting thousands of projects.

Using a mutable reference like v7 or main means you're trusting that the tag will always point to safe code—but the action maintainer, or anyone who gains access to their account, can silently change what that tag points to without any notification.

To resolve this comment:

✨ Commit fix suggestion
  1. Replace the mutable action reference actions/setup-node@v7 with a full 40-character commit SHA for the same action release, for example uses: actions/setup-node@<full-40-character-sha>.
  2. Keep the existing with: settings unchanged so the step still uses the same Node version and pnpm cache configuration.
  3. Resolve the correct SHA from the actions/setup-node release you intend to trust, then pin that exact revision in the workflow file. This prevents the action owner from moving the tag to different code later.
  4. Manually verify that the workflow still installs Node 16 and restores the pnpm cache as expected after the change.

Alternatively, if you need to stay aligned with a specific upstream release name for maintenance, add a comment next to the pinned SHA noting the corresponding tag, such as # actions/setup-node v7, but keep uses: pinned to the commit SHA.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

Need help? Review go/semgrep-playbook or Reach out in #security-vulnerabilities on Slack.

You can view more details about this finding in the Semgrep AppSec Platform.

with:
node-version: '16'
cache: 'pnpm'
Expand Down
Loading