Bump actions/setup-go from 6 to 7#35
Conversation
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![semgrep-code-mongodb[bot]](https://avatars.githubusercontent.com/u/45120?s=60&v=4){kind=small}
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/setup-go@v6 | ||
| - uses: actions/setup-go@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
actions/setup-go@v7 uses a mutable tag, so this CI job may run different action code later if v7 is repointed.
More details about this
actions/setup-go@v7 pulls the action by a mutable tag, not a specific commit. If the v7 tag is ever moved to a different commit, this unit-test job will run whatever code that new action version contains before ./scripts/check/unit-test.sh executes.
A plausible attack looks like this:
- An attacker gains the ability to publish a new commit under the
actions/setup-gorepository or repoint thev7tag. - On the next workflow run, the step
uses: actions/setup-go@v7fetches and runs that attacker-controlled commit. - That action runs inside your GitHub Actions job, where it can read the checked-out repository, inspect workflow inputs, and access job data before your tests start.
- The malicious action could modify the Go toolchain setup, alter files used by
./scripts/check/unit-test.sh, or exfiltrate values available to the job to an external server.
Because this workflow trusts v7 by name, the code that runs in CI can change without any change to this repository.
To resolve this comment:
✨ Commit fix suggestion
-
Replace the mutable action tag in the workflow step with a full 40-character commit SHA.
Changeuses: actions/setup-go@v7touses: actions/setup-go@<full-commit-sha> # v7. -
Pin the SHA to the exact release you intend to use by looking up the commit for the current
v7release in theactions/setup-gorepository.
Theuses:value should look likeactions/setup-go@0123456789abcdef0123456789abcdef01234567 # v7. -
Keep the version as an inline comment after the SHA so future updates are easier to review.
Pinning to a commit SHA prevents the action owner from silently moving the tag to different code later. -
Apply the same fix to the other third-party action references in this workflow that still use tags, such as
actions/checkout@v4andcodecov/codecov-action@v5, by replacing each tag with its corresponding full commit SHA.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
🛟 Help? Slack #semgrep-help or go/semgrep-help.
Resolution Options:
- Fix the code
- Reply
/fp $reason(if security gap doesn’t exist) - Reply
/ar $reason(if gap is valid but intentional; add mitigations/monitoring) - Reply
/other $reason(e.g., test-only)
You can view more details about this finding in the Semgrep AppSec Platform.
Bumps actions/setup-go from 6 to 7.
Release notes
Sourced from actions/setup-go's releases.
... (truncated)
Commits
b7ad1dachore(deps): bump@actions/cacheto 6.2.0 (#771)0778a10Migrate to ESM and upgrade dependencies (#763)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)