Upgrade actions/checkout and related actions to v7

[rizaziz]

No description provided.

[github-actions]

Mayhem Automated Code Testing Report

❗ 1 Defects Found

CWE Severity	Defect	Description
7.1	Improper Input Validation	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

---

Testing details found at https://app.mayhem.security/forallsecure/mcode-action/mayhemit/44

[semgrep-code-forallsecure]

Semgrep found 10 github-actions-mutable-action-tag findings:

• .github/workflows/main.yml
  • L18 - Triage
  • L31 - Triage
  • L47 - Triage
  • L60 - Triage
  • L78 - Triage
  • L85 - Triage
  • L92 - Triage
  • L105 - Triage
  • L128 - Triage
  • L157 - Triage

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

[semgrep-code-forallsecure]

Semgrep identified an issue in your code:

GitHub Actions step uses mutable version tag v1.17.3 instead of a pinned commit SHA, allowing the action owner to silently redirect your workflow to malicious code via tag reassignment.

More details about this

The step references kunalnagarco/action-cve@v1.17.3 using a version tag (v1.17.3) instead of a pinned commit SHA. Version tags are mutable—the owner can re-tag v1.17.3 to point to different code at any time without any warning or notification to users. This creates a supply-chain attack vector where an attacker could compromise the repository, re-tag an older version to malicious code, and silently inject that code into your workflow on the next run.

Here's how an attack could happen:

1. An attacker gains access to the kunalnagarco/action-cve repository (through compromised credentials or social engineering)
2. The attacker modifies the code in that repository to include malicious logic (e.g., exfiltrating your secrets.PERSONAL_ACCESS_TOKEN or secrets.SLACK_WEBHOOK)
3. The attacker re-tags v1.17.3 to point to their malicious commit instead of the original code
4. Your workflow runs and pulls the tag, but now it resolves to the attacker's malicious code instead
5. The malicious action extracts your secrets and sends them to an attacker-controlled server, or performs other unauthorized actions with your repository permissions

The fix is to replace the version tag with the full 40-character commit SHA (e.g., uses: kunalnagarco/action-cve@<commit-sha>) so the action always runs the exact code you've audited, regardless of any tag changes.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	- uses: kunalnagarco/action-cve@v1.17.3
	# TODO: Replace the placeholder below with the exact 40-character commit SHA currently pointed to by the upstream v1.17.3 tag in kunalnagarco/action-cve.
	- uses: kunalnagarco/action-cve@<full-40-character-commit-sha> # v1.17.3

View step-by-step instructions

1. Replace the mutable action tag with a full 40-character commit SHA in the uses line. Change kunalnagarco/action-cve@v1.17.3 to kunalnagarco/action-cve@<full-40-character-commit-sha>.

2. Keep the current version visible by adding the tag as a comment after the SHA, for example: uses: kunalnagarco/action-cve@<full-40-character-commit-sha> # v1.17.3.

3. Get the correct SHA from the action's v1.17.3 release or tag in the kunalnagarco/action-cve repository, and use the commit that the tag currently points to. Pinning to a commit SHA prevents the action owner from silently changing what code runs later.

4. Leave the with: values unchanged unless the pinned commit's release notes say the inputs changed.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[d-dot-one]

Agree on this one.

Suggested change

	- uses: kunalnagarco/action-cve@v1.17.3
	- uses: kunalnagarco/action-cve@97cf2131ab6fc1c9892b431608fa3c686805a157 # v1.17.3

[d-dot-one]

Feel free to close all my comments if we are not pinning to a SHA (but we should be) :)

[d-dot-one]

All of these should be pinned to a SHA, not a tag. Tags are not guaranteed to be immutable.

Suggested change

	- uses: actions/checkout@v7
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

[d-dot-one]

here too:

Suggested change

	- uses: actions/checkout@v7
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

[d-dot-one]

Agree on this one.

Suggested change

	- uses: kunalnagarco/action-cve@v1.17.3
	- uses: kunalnagarco/action-cve@97cf2131ab6fc1c9892b431608fa3c686805a157 # v1.17.3

[d-dot-one]

This doesn't have a proper release outside of the bundle, so giving this one a pass

[d-dot-one]

here too:

Suggested change

	- uses: actions/checkout@v7
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

[d-dot-one]

Suggested change

	uses: actions/upload-artifact@v7
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

[d-dot-one]

Suggested change

	uses: actions/upload-artifact@v7
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

[d-dot-one]

Suggested change

	- uses: actions/checkout@v7
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

[d-dot-one]

Suggested change

	- uses: actions/checkout@v7
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

[d-dot-one]

Suggested change

	- uses: actions/checkout@v7
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1