chore(deps): bump actions/setup-node from 6 to 7 - #351
Conversation
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![semgrep-scribd[bot]](https://avatars.githubusercontent.com/u/27892?s=60&v=4){kind=small}
| with: | ||
| version: 7.6.0 | ||
| - uses: actions/setup-node@v6 | ||
| - uses: actions/setup-node@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Actions step uses mutable tag v7 instead of a pinned commit SHA, allowing the action maintainer to silently update the code executed in your workflows—enabling supply-chain attacks.
More details about this
The GitHub Actions workflow uses actions/setup-node@v7, which references a mutable tag instead of a specific commit. Tag v7 can be repointed at any time by the action maintainer to point to different code without your knowledge.
Here's how an attacker could exploit this:
-
Compromise the action repository: An attacker gains access to the
actions/setup-noderepository (e.g., through compromised credentials or social engineering). -
Repoint the tag: The attacker moves the
v7tag to commit a malicious version they've created. This tag could now install a backdoored version of Node.js or inject malware into your build environment. -
Trigger the workflow: The next time your workflow runs (on any pull request), the step
- uses: actions/setup-node@v7will fetch and execute the attacker's malicious code instead of the legitimate action. -
Compromise your environment: The malicious action could steal environment variables (like
GITHUB_TOKEN), exfiltrate source code, inject backdoors into your built artifacts, or compromise your CI/CD pipeline entirely.
This attack pattern mirrors real compromises like the trivy-action and kics-github-action incidents, where attackers exploited mutable tag references to distribute malware through the supply chain.
To resolve this comment:
✨ Commit fix suggestion
- Replace the mutable action reference
actions/setup-node@v7with a full 40-character commit SHA for the exact release you want to trust, for exampleuses: actions/setup-node@<full-commit-sha>. - Resolve the SHA from the action's release page or repository so the pinned commit matches the current
v7version you intended to use. - Keep the existing
with:block unchanged under the pinned action reference, for examplenode-version: '16'andcache: 'pnpm'do not need to change. Pinning to a commit prevents the action owner from moving a tag or branch to different code later. - If you want to keep the version readable for future updates, add a short comment next to the pinned SHA indicating the human-friendly version, such as
# actions/setup-node v7.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help? Review go/semgrep-playbook or Reach out in #security-vulnerabilities on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
| with: | ||
| version: 7.6.0 | ||
| - uses: actions/setup-node@v6 | ||
| - uses: actions/setup-node@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Actions step actions/setup-node@v7 uses a mutable version tag that can be silently repointed by the action owner to malicious code, enabling supply-chain attacks.
More details about this
The GitHub Actions step actions/setup-node@v7 uses a mutable version tag (v7) instead of a pinned commit SHA. This means the action owner can silently update what code runs in your workflow without any change to this file.
Here's a concrete attack scenario:
- An attacker compromises the
actions/setup-noderepository and gains control over thev7tag - They push malicious code to the repository and repoint the
v7tag to their compromised commit - Your workflow runs and
@v7now resolves to the attacker's commit instead of the legitimate version - The malicious code executes with full access to your repository secrets (
GITHUB_TOKEN), allowing the attacker to steal credentials, push code, or modify your releases - This could be used to inject malware into your published packages or exfiltrate sensitive data
This is exactly how the trivy-action and kics-github-action compromises worked—attackers repointed version tags to run their own code.
To resolve this comment:
✨ Commit fix suggestion
- Replace the mutable action reference
actions/setup-node@v7with a full 40-character commit SHA for the exactactions/setup-noderelease you want to keep using, for exampleuses: actions/setup-node@<full-40-character-sha>. - Keep the existing
with:settings unchanged so only the action version pin changes. - Confirm the SHA comes from the official
actions/setup-noderepository release or tag that matches your intended version, and avoid short SHAs or version tags such as@v7. Pinning to a full commit SHA prevents the referenced action code from changing unexpectedly.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help? Review go/semgrep-playbook or Reach out in #security-vulnerabilities on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
|
To keep it open, please leave a comment or push an update. You can also label it as 'pinned' to prevent auto-closure. |
1 participant
Bumps actions/setup-node from 6 to 7.
Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
CI-only action version bump with identical inputs; low impact unless setup-node v7 breaks Node 16 or pnpm caching in these jobs.
Overview
Upgrades
actions/setup-nodefrom v6 to v7 in the PR test and release-on-merge workflows.node-version: '16'andcache: 'pnpm'are unchanged; only the action major version pin moves.This is a routine Dependabot-style CI dependency bump with no application or workflow logic edits.
Reviewed by Cursor Bugbot for commit bc20eab. Bugbot is set up for automated code reviews on this repo. Configure here.