Skip to content

Bump actions/setup-go from 6 to 7 #3547

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
GromNaN merged 1 commit into from
Jul 27, 2026
Merged

Bump actions/setup-go from 6 to 7 #3547

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/validate-skills.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:
fetch-depth: 0

- name: Set up Go
uses: actions/setup-go@v6
uses: actions/setup-go@v7

@semgrep-code-mongodb semgrep-code-mongodb Bot Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

actions/setup-go@v7 uses a movable tag, so a repointed v7 release could run attacker-controlled code in this CI job.

More details about this

actions/setup-go@v7 pulls the setup-go action by a movable tag, not a specific commit. If the owner of actions/setup-go or anyone who gains control of that repository retags v7 to a different commit, this workflow will run the new code during the Set up Go step before go install and the validation scripts execute.

A plausible attack looks like this:

  1. An attacker compromises the repository that publishes actions/setup-go and repoints the v7 tag to a malicious commit.
  2. A pull request that touches skills/** or this workflow triggers Validate Skills.
  3. GitHub resolves uses: actions/setup-go@v7 to the attacker-controlled commit and runs it on the ubuntu-latest runner.
  4. That malicious action can read the checked-out repository from the earlier actions/checkout@v7 step, inspect workflow data like ${{ github.base_ref }}, and tamper with later commands such as go install github.com/agent-ecosystem/skill-validator/...@latest or the validate-skills.sh run.
  5. The attacker now has code execution inside your CI job and can silently alter validation results or exfiltrate any data available to this workflow's token and workspace.

Because the reference here is @v7, the exact code that runs can change over time without any change in this repository.

To resolve this comment:

✨ Commit fix suggestion

  1. Replace the mutable action reference with a full 40-character commit SHA in the uses line for this step.
    Change uses: actions/setup-go@v7 to uses: actions/setup-go@<full-commit-sha> # v7.

  2. Use the commit SHA from the exact actions/setup-go release you intend to keep using, not the version tag alone.
    For example, the final format should look like uses: actions/setup-go@8f1526c3... # v7.

  3. Keep the version comment after the SHA so future updates are easier to review.
    Pinning to a commit SHA prevents the action owner from silently moving v7 to different code later.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

🛟 Help? Slack #semgrep-help or go/semgrep-help.

Resolution Options:

  • Fix the code
  • Reply /fp $reason (if security gap doesn’t exist)
  • Reply /ar $reason (if gap is valid but intentional; add mitigations/monitoring)
  • Reply /other $reason (e.g., test-only)

You can view more details about this finding in the Semgrep AppSec Platform.

with:
go-version: stable
cache: false
Expand Down
Loading