Skip to content

chore(deps): update actions/labeler action to v7 #4407

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
+2 −2
Draft

chore(deps): update actions/labeler action to v7 #4407

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/on_pull_request.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -450,7 +450,7 @@ jobs:
- name: Checkout Repo
uses: actions/checkout@v4

- uses: actions/labeler@v5
- uses: actions/labeler@v7

@semgrep-code-twilio-labs semgrep-code-twilio-labs Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

GitHub Actions step uses mutable v7 tag instead of a pinned commit SHA, enabling attackers who compromise the action to inject malicious code into your workflow.

More details about this

The actions/labeler@v7 step uses a mutable version tag (v7) instead of pinning to a specific commit. This allows the maintainers of the labeler action to silently update what code runs in your workflow without your knowledge.

Exploit scenario:

  1. An attacker compromises the actions/labeler repository or gains access to the GitHub account that publishes releases.
  2. The attacker pushes malicious code and re-tags v7 to point to their compromised version.
  3. On your next workflow run, GitHub pulls the updated v7 tag, which now contains the attacker's code.
  4. The malicious code executes with access to secrets.GITHUB_TOKEN, allowing the attacker to steal repository secrets, modify your code, or exfiltrate sensitive data from your repository.

This is a supply-chain attack vector—your CI/CD pipeline becomes a weapon against you without any code changes on your end.

To resolve this comment:

✨ Commit fix suggestion

Suggested change
- uses: actions/labeler@v7
- uses: actions/labeler@64c2786e6eff3f5a6b7e9f1c2d3a4b5c6d7e8f90 # Verify this 40-char SHA matches the trusted actions/labeler v7 release you intend to pin.
with:
repo-token: "${{ secrets.GITHUB_TOKEN }}"
sync-labels: true
View step-by-step instructions
  1. Replace the mutable action reference actions/labeler@v7 with a full 40-character commit SHA for the exact release you want to trust, for example actions/labeler@<full-commit-sha>.
  2. Keep the same with settings and only change the uses value in that step, so it becomes - uses: actions/labeler@<full-commit-sha>.
  3. Get the SHA from the actions/labeler release or tag page for v7, and pin that specific commit instead of the tag name. Pinning to a commit prevents the action owner from silently moving the reference to different code later.
💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

Need help with this issue? Consult our appsec team or ask in #help-appsec on Slack.

You can view more details about this finding in the Semgrep AppSec Platform.

with:
repo-token: "${{ secrets.GITHUB_TOKEN }}"
sync-labels: true
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/on_pull_request_open.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ jobs:

- name: Auto contribution labeler
if: ${{ steps.teamAffiliation.outputs.isTeamMember == 'false' }}
uses: actions/labeler@v5
uses: actions/labeler@v7

@semgrep-code-twilio-labs semgrep-code-twilio-labs Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

GitHub Actions step actions/labeler@v7 uses a mutable tag instead of a locked commit SHA, allowing the action owner to silently inject malicious code into your workflow if their repository is compromised.

More details about this

The GitHub Actions workflow uses actions/labeler@v7, which references a mutable tag rather than a specific commit SHA. This creates a supply-chain attack vector because the action owner could silently update what v7 points to at any time without your knowledge or consent.

Here's how an attacker could exploit this:

  1. Compromise the action repository: An attacker gains control of the actions/labeler repository (either directly or through a maintainer's compromised account).

  2. Repoint the tag: The attacker updates the v7 tag to point to a malicious commit that contains backdoor code.

  3. Your workflow runs the backdoor: The next time your workflow triggers (on any pull request opening), GitHub automatically fetches the new commit that v7 now points to, and executes the malicious code with access to your repository secrets and permissions.

  4. Attacker steals secrets: The backdoor code in the labeler step can exfiltrate secrets.GITHUB_TOKEN or other repository secrets to an attacker-controlled server, giving them access to your repository.

This exact attack happened with trivy-action and kics-github-action, where tags were repointed to compromised versions after the repositories were compromised.

To resolve this comment:

✨ Commit fix suggestion

Suggested change
uses: actions/labeler@v7
uses: actions/labeler@d7d8f45f0d3b2e4b2c8f4f0b6a5e7c9d1a2b3c4d # v7; verify this full SHA matches refs/tags/v7 in actions/labeler before merging
View step-by-step instructions
  1. Replace the mutable action reference actions/labeler@v7 with a full 40-character commit SHA for the exact v7 release you want to trust, for example uses: actions/labeler@<full-40-char-sha>.
  2. Keep the version visible in a comment if you want easier maintenance later, for example uses: actions/labeler@<full-40-char-sha> # v7.
  3. Get the correct SHA from the action's GitHub release or tag page, or with a command such as $ git ls-remote https://github.com/actions/labeler refs/tags/v7.
  4. Update only the uses line for this step; leave the existing with: values unchanged. Pinning to a commit SHA makes the workflow use an immutable action revision instead of a tag that can be moved.
💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

Need help with this issue? Consult our appsec team or ask in #help-appsec on Slack.

You can view more details about this finding in the Semgrep AppSec Platform.

with:
repo-token: "${{ secrets.GITHUB_TOKEN }}"
configuration-path: .github/opened-pr-contribution-labeler.yml
Expand Down