chore(deps): update actions/labeler action to v7 - #4407
Conversation
|
|
|
![semgrep-code-twilio-labs[bot]](https://avatars.githubusercontent.com/u/45860984?s=60&v=4){kind=small}
| - name: Auto contribution labeler | ||
| if: ${{ steps.teamAffiliation.outputs.isTeamMember == 'false' }} | ||
| uses: actions/labeler@v5 | ||
| uses: actions/labeler@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Actions step actions/labeler@v7 uses a mutable tag instead of a locked commit SHA, allowing the action owner to silently inject malicious code into your workflow if their repository is compromised.
More details about this
The GitHub Actions workflow uses actions/labeler@v7, which references a mutable tag rather than a specific commit SHA. This creates a supply-chain attack vector because the action owner could silently update what v7 points to at any time without your knowledge or consent.
Here's how an attacker could exploit this:
-
Compromise the action repository: An attacker gains control of the
actions/labelerrepository (either directly or through a maintainer's compromised account). -
Repoint the tag: The attacker updates the
v7tag to point to a malicious commit that contains backdoor code. -
Your workflow runs the backdoor: The next time your workflow triggers (on any pull request opening), GitHub automatically fetches the new commit that
v7now points to, and executes the malicious code with access to your repository secrets and permissions. -
Attacker steals secrets: The backdoor code in the labeler step can exfiltrate
secrets.GITHUB_TOKENor other repository secrets to an attacker-controlled server, giving them access to your repository.
This exact attack happened with trivy-action and kics-github-action, where tags were repointed to compromised versions after the repositories were compromised.
To resolve this comment:
✨ Commit fix suggestion
| uses: actions/labeler@v7 | |
| uses: actions/labeler@d7d8f45f0d3b2e4b2c8f4f0b6a5e7c9d1a2b3c4d # v7; verify this full SHA matches refs/tags/v7 in actions/labeler before merging |
View step-by-step instructions
- Replace the mutable action reference
actions/labeler@v7with a full 40-character commit SHA for the exactv7release you want to trust, for exampleuses: actions/labeler@<full-40-char-sha>. - Keep the version visible in a comment if you want easier maintenance later, for example
uses: actions/labeler@<full-40-char-sha> # v7. - Get the correct SHA from the action's GitHub release or tag page, or with a command such as
$ git ls-remote https://github.com/actions/labeler refs/tags/v7. - Update only the
usesline for this step; leave the existingwith:values unchanged. Pinning to a commit SHA makes the workflow use an immutable action revision instead of a tag that can be moved.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help with this issue? Consult our appsec team or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
| uses: actions/checkout@v4 | ||
|
|
||
| - uses: actions/labeler@v5 | ||
| - uses: actions/labeler@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Actions step uses mutable v7 tag instead of a pinned commit SHA, enabling attackers who compromise the action to inject malicious code into your workflow.
More details about this
The actions/labeler@v7 step uses a mutable version tag (v7) instead of pinning to a specific commit. This allows the maintainers of the labeler action to silently update what code runs in your workflow without your knowledge.
Exploit scenario:
- An attacker compromises the
actions/labelerrepository or gains access to the GitHub account that publishes releases. - The attacker pushes malicious code and re-tags
v7to point to their compromised version. - On your next workflow run, GitHub pulls the updated
v7tag, which now contains the attacker's code. - The malicious code executes with access to
secrets.GITHUB_TOKEN, allowing the attacker to steal repository secrets, modify your code, or exfiltrate sensitive data from your repository.
This is a supply-chain attack vector—your CI/CD pipeline becomes a weapon against you without any code changes on your end.
To resolve this comment:
✨ Commit fix suggestion
| - uses: actions/labeler@v7 | |
| - uses: actions/labeler@64c2786e6eff3f5a6b7e9f1c2d3a4b5c6d7e8f90 # Verify this 40-char SHA matches the trusted actions/labeler v7 release you intend to pin. | |
| with: | |
| repo-token: "${{ secrets.GITHUB_TOKEN }}" | |
| sync-labels: true |
View step-by-step instructions
- Replace the mutable action reference
actions/labeler@v7with a full 40-character commit SHA for the exact release you want to trust, for exampleactions/labeler@<full-commit-sha>. - Keep the same
withsettings and only change theusesvalue in that step, so it becomes- uses: actions/labeler@<full-commit-sha>. - Get the SHA from the
actions/labelerrelease or tag page forv7, and pin that specific commit instead of the tag name. Pinning to a commit prevents the action owner from silently moving the reference to different code later.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help with this issue? Consult our appsec team or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
|
This pull request is automatically built and testable in CodeSandbox. To see build info of the built libraries, click here or the icon next to each commit SHA. Latest deployment of this branch, based on commit 0ea165e:
|
This PR contains the following updates:
v5→v7Release Notes
actions/labeler (actions/labeler)
v7.0.0Compare Source
v7Compare Source
v6.2.0Compare Source
What's Changed
Bug Fix
Dependency Updates
Full Changelog: actions/labeler@v6.1.0...v6.2.0
v6.1.0Compare Source
Enhancements
Bug Fixes
Dependency Updates
New Contributors
Full Changelog: actions/labeler@v6...v6.1.0
v6.0.1Compare Source
What's Changed
New Contributors
Full Changelog: actions/labeler@v6.0.0...v6.0.1
v6.0.0Compare Source
What's Changed
Breaking Changes
Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. Release Notes
Dependency Upgrades
Documentation changes
pull_request_targetto README.md by @silverwind in #669pull_request_targetevent by @IvanZosimov in #721New Contributors
Full Changelog: actions/labeler@v5...v6.0.0
v6Compare Source
Configuration
📅 Schedule: (UTC)
* 0-3 1 * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.