Bump actions/setup-go from 6 to 7 - #3547
Conversation
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![semgrep-code-mongodb[bot]](https://avatars.githubusercontent.com/u/45120?s=60&v=4){kind=small}
|
|
||
| - name: Set up Go | ||
| uses: actions/setup-go@v6 | ||
| uses: actions/setup-go@v7 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
actions/setup-go@v7 uses a movable tag, so a repointed v7 release could run attacker-controlled code in this CI job.
More details about this
actions/setup-go@v7 pulls the setup-go action by a movable tag, not a specific commit. If the owner of actions/setup-go or anyone who gains control of that repository retags v7 to a different commit, this workflow will run the new code during the Set up Go step before go install and the validation scripts execute.
A plausible attack looks like this:
- An attacker compromises the repository that publishes
actions/setup-goand repoints thev7tag to a malicious commit. - A pull request that touches
skills/**or this workflow triggers Validate Skills. - GitHub resolves
uses: actions/setup-go@v7to the attacker-controlled commit and runs it on theubuntu-latestrunner. - That malicious action can read the checked-out repository from the earlier
actions/checkout@v7step, inspect workflow data like${{ github.base_ref }}, and tamper with later commands such asgo install github.com/agent-ecosystem/skill-validator/...@latestor thevalidate-skills.shrun. - The attacker now has code execution inside your CI job and can silently alter validation results or exfiltrate any data available to this workflow's token and workspace.
Because the reference here is @v7, the exact code that runs can change over time without any change in this repository.
To resolve this comment:
✨ Commit fix suggestion
-
Replace the mutable action reference with a full 40-character commit SHA in the
usesline for this step.
Changeuses: actions/setup-go@v7touses: actions/setup-go@<full-commit-sha> # v7. -
Use the commit SHA from the exact
actions/setup-gorelease you intend to keep using, not the version tag alone.
For example, the final format should look likeuses: actions/setup-go@8f1526c3... # v7. -
Keep the version comment after the SHA so future updates are easier to review.
Pinning to a commit SHA prevents the action owner from silently movingv7to different code later.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
🛟 Help? Slack #semgrep-help or go/semgrep-help.
Resolution Options:
- Fix the code
- Reply
/fp $reason(if security gap doesn’t exist) - Reply
/ar $reason(if gap is valid but intentional; add mitigations/monitoring) - Reply
/other $reason(e.g., test-only)
You can view more details about this finding in the Semgrep AppSec Platform.
1 participant
Bumps actions/setup-go from 6 to 7.
Release notes
Sourced from actions/setup-go's releases.
... (truncated)
Commits
b7ad1dachore(deps): bump@actions/cacheto 6.2.0 (#771)0778a10Migrate to ESM and upgrade dependencies (#763)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)