chore(deps): update actions/checkout action to v7 - #161
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![semgrep-code-twilio-labs[bot]](https://avatars.githubusercontent.com/u/45860984?s=60&v=4){kind=small}
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Actions step uses mutable version tag @v7 instead of a pinned commit SHA, allowing the action owner to silently update it to malicious code.
More details about this
The GitHub Actions workflow uses actions/checkout@v7, which pins to a mutable version tag instead of a specific commit. An attacker who maintains the actions/checkout repository could silently update the v7 tag to point to a malicious commit, and your workflow would automatically run the compromised version without any warning.
Exploit scenario:
- An attacker compromises the GitHub account maintaining
actions/checkoutor gains control of the repository. - They force-push the
v7tag to point to a commit containing malicious code (e.g., code that exfiltrates secrets or modifies your build artifacts). - The next time your workflow runs, the
uses: actions/checkout@v7step downloads and executes the compromised version. - The attacker now has access to your repository code, secrets, and can modify build outputs that get deployed to users.
This is a supply-chain attack vector that has been exploited in real incidents (e.g., trivy-action and kics-github-action compromises).
To resolve this comment:
✨ Commit fix suggestion
| uses: actions/checkout@v7 | |
| prettier: | |
| name: Prettier | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.7 | |
| - name: Setup node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '16' | |
| - name: Install | |
| run: yarn install | |
| - name: Run ESlint | |
| run: yarn prettier | |
| cypress: | |
| name: Cypress | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.7 | |
| - name: Setup node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '18' | |
| - name: Install | |
| run: yarn install | |
| - name: Run Cypress tests | |
| run: yarn ci-test-dev |
View step-by-step instructions
- Replace the mutable action reference
actions/checkout@v7with a full 40-character commit SHA for the exactactions/checkoutrelease you want to use. - Keep the version as a comment next to the SHA so the workflow stays readable, for example:
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.7. - Apply the same change to each
actions/checkout@v7step in this workflow, including theprettierandcypressjobs. - Choose the SHA from the official
actions/checkoutrelease you intend to trust, not from a branch or tag page. Pinning to a commit SHA prevents the action owner from changing what runs later without changing your workflow file.
Alternatively, if you must stay on a newer checkout release for compatibility, replace @v7 with the 40-character commit SHA for that specific newer release and keep the version comment, for example # v7.x.y.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Using mutable tag @v7 for actions/checkout allows attackers who compromise the action repository to inject malicious code into your CI/CD pipeline without warning.
More details about this
The GitHub Actions step references actions/checkout@v7, which uses a mutable version tag instead of a pinned commit SHA. This allows the maintainers of the actions/checkout action to silently update what code runs in your CI/CD pipeline without any warning.
Here's how an attacker could exploit this:
- Compromise the action repository: An attacker gains access to the
actions/checkoutrepository (through credential theft, insider threat, etc.). - Repoint the tag: They update the
v7tag to point to a malicious commit instead of the legitimate one. - Injection into your workflow: The next time your PR workflow runs, it automatically downloads and executes the attacker's malicious code—in this case, code that runs on your
ubuntu-latestrunner with access to your repository. - Data exfiltration or code tampering: The attacker's injected code could steal your repository secrets, modify your codebase, or compromise your build artifacts.
This is exactly what happened in real-world incidents like the trivy-action and kics-github-action compromises, where attackers used mutable tag references to inject malicious code into thousands of projects' CI/CD pipelines.
Since this pattern appears three times in your workflow (in the eslint, prettier, and cypress jobs), all three are vulnerable.
To resolve this comment:
✨ Commit fix suggestion
| uses: actions/checkout@v7 | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.7 |
View step-by-step instructions
-
Replace the mutable action reference with a full 40-character commit SHA for
actions/checkout.
Changeuses: actions/checkout@v7to a pinned form such asuses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.7. -
Apply the same change to each
Checkout codestep in this workflow so none of them use@v7. -
Keep the version comment after the SHA, for example
# v4.1.7, so it is still clear which release the pinned commit came from.
Alternatively, if you need a newer checkout release than the example above, pin that specific release to its published 40-character commit SHA instead of using a tag like @v7.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
The actions/checkout action uses a mutable v7 tag that can be silently updated by the repository owner, enabling supply-chain attacks. Pin it to a full commit SHA instead.
More details about this
The actions/checkout@v7 step uses a mutable major version tag instead of a pinned commit SHA. An attacker who compromises the actions/checkout repository or has write access to it could push a malicious commit to the v7 branch, and your workflow would automatically run that compromised code without any warning.
Attack scenario:
- An attacker gains commit access to the actions/checkout repository (or persuades maintainers to merge malicious code)
- They push a commit that exfiltrates repository secrets or modifies build artifacts to the v7 branch
- The next time your CI/CD pipeline runs, GitHub Actions silently pulls the updated v7 tag, which now points to the malicious commit
- Your workflow runs the compromised checkout action, exposing secrets stored in
${{ secrets }}or allowing the attacker to inject malware into your build output - Any downstream jobs that use artifacts from this step now have corrupted or backdoored code
This mirrors real-world compromises like trivy-action and kics-github-action, where mutable tags were exploited for supply-chain attacks.
To resolve this comment:
✨ Commit fix suggestion
| uses: actions/checkout@v7 | |
| name: PR-Checks | |
| on: pull_request | |
| jobs: | |
| eslint: | |
| name: ESlint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.7 | |
| - name: Setup node | |
| uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 | |
| with: | |
| node-version: '16' | |
| - name: Install | |
| run: yarn install | |
| - name: Run ESlint | |
| run: yarn lint | |
| prettier: | |
| name: Prettier | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.7 | |
| - name: Setup node | |
| uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 | |
| with: | |
| node-version: '16' | |
| - name: Install | |
| run: yarn install | |
| - name: Run ESlint | |
| run: yarn prettier | |
| cypress: | |
| name: Cypress | |
| runs-on: ubuntu-latest | |
| steps: |
View step-by-step instructions
- Replace the mutable GitHub Action tag with a full 40-character commit SHA in each
uses:line that currently referencesactions/checkout@v7. - Keep the version as an inline comment so the workflow stays readable, for example:
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.7 - Update every occurrence in this workflow, including both
Checkout codesteps shown here, so none of them use@v7anymore. Pinning to a commit SHA prevents the action owner from silently changing what code runs under the same tag. - Apply the same fix to the other third-party actions in this workflow that still use tags, such as
actions/setup-node@v4, by replacing each tag with that action's published 40-character commit SHA and optionally keeping the version in a comment like# v4.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
This PR contains the following updates:
v4→v7Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
v6.1.0Compare Source
v6.0.3Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v6Compare Source
v5.1.0Compare Source
v5.0.1Compare Source
v5.0.0Compare Source
v5Compare Source
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.