Skip to content

Upgrade actions/checkout and related actions to v7 #253

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rizaziz wants to merge 2 commits into
base: main
Choose a base branch
from
+11 −11
Open

Upgrade actions/checkout and related actions to v7 #253

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1058f96
Upgrade actions/checkout and related actions to v7
rizaziz Jul 21, 2026
75efc60
Update action-cve version to v1.17.3
rizaziz Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/dependabot-alerts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
runs-on: ubuntu-latest
steps:
# X.X.X - Latest version available at: https://github.com/kunalnagarco/action-cve/releases
- uses: kunalnagarco/action-cve@v1.12.36
- uses: kunalnagarco/action-cve@v1.17.3

@semgrep-code-forallsecure semgrep-code-forallsecure Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

GitHub Actions step uses mutable version tag v1.17.3 instead of a pinned commit SHA, allowing the action owner to silently redirect your workflow to malicious code via tag reassignment.

More details about this

The step references kunalnagarco/action-cve@v1.17.3 using a version tag (v1.17.3) instead of a pinned commit SHA. Version tags are mutable—the owner can re-tag v1.17.3 to point to different code at any time without any warning or notification to users. This creates a supply-chain attack vector where an attacker could compromise the repository, re-tag an older version to malicious code, and silently inject that code into your workflow on the next run.

Here's how an attack could happen:

  1. An attacker gains access to the kunalnagarco/action-cve repository (through compromised credentials or social engineering)
  2. The attacker modifies the code in that repository to include malicious logic (e.g., exfiltrating your secrets.PERSONAL_ACCESS_TOKEN or secrets.SLACK_WEBHOOK)
  3. The attacker re-tags v1.17.3 to point to their malicious commit instead of the original code
  4. Your workflow runs and pulls the tag, but now it resolves to the attacker's malicious code instead
  5. The malicious action extracts your secrets and sends them to an attacker-controlled server, or performs other unauthorized actions with your repository permissions

The fix is to replace the version tag with the full 40-character commit SHA (e.g., uses: kunalnagarco/action-cve@<commit-sha>) so the action always runs the exact code you've audited, regardless of any tag changes.

To resolve this comment:

✨ Commit fix suggestion

Suggested change
- uses: kunalnagarco/action-cve@v1.17.3
# TODO: Replace the placeholder below with the exact 40-character commit SHA currently pointed to by the upstream v1.17.3 tag in kunalnagarco/action-cve.
- uses: kunalnagarco/action-cve@<full-40-character-commit-sha> # v1.17.3
View step-by-step instructions

  1. Replace the mutable action tag with a full 40-character commit SHA in the uses line. Change kunalnagarco/action-cve@v1.17.3 to kunalnagarco/action-cve@<full-40-character-commit-sha>.

  2. Keep the current version visible by adding the tag as a comment after the SHA, for example: uses: kunalnagarco/action-cve@<full-40-character-commit-sha> # v1.17.3.

  3. Get the correct SHA from the action's v1.17.3 release or tag in the kunalnagarco/action-cve repository, and use the commit that the tag currently points to. Pinning to a commit SHA prevents the action owner from silently changing what code runs later.

  4. Leave the with: values unchanged unless the pinned commit's release notes say the inputs changed.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

You can view more details about this finding in the Semgrep AppSec Platform.

@d-dot-one d-dot-one Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agree on this one.

Suggested change
- uses: kunalnagarco/action-cve@v1.17.3
- uses: kunalnagarco/action-cve@97cf2131ab6fc1c9892b431608fa3c686805a157 # v1.17.3

with:
token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
slack_webhook: ${{ secrets.SLACK_WEBHOOK }}
Expand Down
20 changes: 10 additions & 10 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ jobs:
MAYHEM_TOKEN: ${{ secrets.MAYHEM_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@d-dot-one d-dot-one Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All of these should be pinned to a SHA, not a tag. Tags are not guaranteed to be immutable.

Suggested change
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:
# fetch entire history to compute diffs between jobs
fetch-depth: 0
Expand All @@ -28,7 +28,7 @@ jobs:
# make sure the action works on a clean machine without building
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@d-dot-one d-dot-one Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

here too:

Suggested change
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:
# fetch entire history to compute diffs between jobs
fetch-depth: 0
Expand All @@ -44,7 +44,7 @@ jobs:
args: --image forallsecure/lighttpd:vulnerable --duration 60

- name: Upload SARIF file(s)
uses: github/codeql-action/upload-sarif@v3
uses: github/codeql-action/upload-sarif@v4

@d-dot-one d-dot-one Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't have a proper release outside of the bundle, so giving this one a pass

with:
sarif_file: out/sarif

Expand All @@ -57,7 +57,7 @@ jobs:
# make sure the action works on a clean machine without building
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@d-dot-one d-dot-one Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

here too:

Suggested change
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:
# fetch entire history to compute diffs between jobs
fetch-depth: 0
Expand All @@ -75,21 +75,21 @@ jobs:
args: --image forallsecure/lighttpd:vulnerable --duration 60

- name: Archive Coverage report
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7

@d-dot-one d-dot-one Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:
name: coverage-report
path: out/coverage/
if-no-files-found: error

- name: Archive JUnit results
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7

@d-dot-one d-dot-one Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:
name: mcode-junit
path: out/junit/
if-no-files-found: error

- name: Upload SARIF file(s)
uses: github/codeql-action/upload-sarif@v3
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: out/sarif

Expand All @@ -102,7 +102,7 @@ jobs:
# make sure the action works on a clean machine without building
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@d-dot-one d-dot-one Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:
# fetch entire history to compute diffs between jobs
fetch-depth: 0
Expand All @@ -125,7 +125,7 @@ jobs:
test-override-inputs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@d-dot-one d-dot-one Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:
# fetch entire history to compute diffs between jobs
fetch-depth: 0
Expand Down Expand Up @@ -154,7 +154,7 @@ jobs:
# make sure the action works on a clean machine without building
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@d-dot-one d-dot-one Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:
# fetch entire history to compute diffs between jobs
fetch-depth: 0
Expand Down
Loading