chore(deps): bump github/codeql-action from 4 to 4.37.1 - #837
chore(deps): bump github/codeql-action from 4 to 4.37.1#837dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4...v4.37.1) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![semgrep-code-mongodb[bot]](https://avatars.githubusercontent.com/u/45120?s=60&v=4){kind=small}
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v4 | ||
| uses: github/codeql-action/analyze@v4.37.1 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
github/codeql-action/analyze@v4.37.1 uses a mutable tag, so a repointed release tag could make this workflow run attacker-controlled code.
More details about this
Perform CodeQL Analysis pulls github/codeql-action/analyze using the tag v4.37.1, not a full 40-character commit SHA. If the owner of github/codeql-action or anyone who can publish that tag repoints v4.37.1 to a different commit, this workflow will run the new code automatically the next time this job starts.
A plausible attack looks like this:
- An attacker gains the ability to change the action release tag
v4.37.1ingithub/codeql-action/analyze. - Your workflow runs
uses: github/codeql-action/analyze@v4.37.1during thePerform CodeQL Analysisstep, so GitHub fetches whatever commit that tag points to at that moment. - The attacker-controlled action code executes inside this job with the workflow's permissions, including
security-events: writeand access to the checked-out repository from the earlieractions/checkoutstep. - That code could exfiltrate repository contents, read workflow-provided tokens, or submit fake analysis results while appearing to come from your normal CodeQL scan.
Because v4.37.1 is mutable, this step trusts future code changes outside this repository.
To resolve this comment:
✨ Commit fix suggestion
-
Replace the mutable action reference with a full 40-character commit SHA instead of the version tag.
Changeuses: github/codeql-action/analyze@v4.37.1touses: github/codeql-action/analyze@<full-commit-sha>. -
Keep the current version as a comment after the SHA so future updates stay readable.
For example, useuses: github/codeql-action/analyze@<full-commit-sha> # v4.37.1. -
Get the SHA from the official
github/codeql-actionrelease that corresponds tov4.37.1, and pin exactly that commit rather than a branch or tag name.
This prevents the referenced action code from changing unexpectedly without a workflow change.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
🛟 Help? Slack #semgrep-help or go/semgrep-help.
Resolution Options:
- Fix the code
- Reply
/fp $reason(if security gap doesn’t exist) - Reply
/ar $reason(if gap is valid but intentional; add mitigations/monitoring) - Reply
/other $reason(e.g., test-only)
You can view more details about this finding in the Semgrep AppSec Platform.
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v4 | ||
| uses: github/codeql-action/init@v4.37.1 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
github/codeql-action/init@v4.37.1 uses a mutable tag, so a retagged release could make this workflow run attacker-controlled code.
More details about this
github/codeql-action/init is referenced by the mutable tag v4.37.1 in the Initialize CodeQL step instead of a specific commit. If the owner of github/codeql-action or anyone who compromises that repository retags v4.37.1, this workflow will run different code on ubuntu-latest with this job's contents: read and security-events: write permissions.
A plausible attack looks like this:
- An attacker gains control of the
github/codeql-actionrepository or its release process. - They move the
v4.37.1tag sogithub/codeql-action/init@v4.37.1points to a new malicious commit. - When this workflow runs on
main, on the weeklyschedule, or viaworkflow_dispatch, the Initialize CodeQL step fetches and executes the attacker's code. - That code runs inside the
analyzejob and can read the checked-out repository from the earlieractions/checkout@v6step. - It can also misuse the job token allowed by
contents: readandsecurity-events: write, for example by exfiltrating repository contents or uploading fake CodeQL results to hide real problems.
To resolve this comment:
✨ Commit fix suggestion
-
Replace the mutable action reference with a full 40-character commit SHA in the
usesline for this step.
Changegithub/codeql-action/init@v4.37.1togithub/codeql-action/init@<40-character-commit-sha>. -
Keep the current version as a comment after the SHA so the pinned release is still clear.
For example:uses: github/codeql-action/init@<40-character-commit-sha> # v4.37.1 -
Pin the matching CodeQL analyze step to a full commit SHA as well, so both CodeQL steps use immutable references.
Changegithub/codeql-action/analyze@v4.37.1togithub/codeql-action/analyze@<40-character-commit-sha> # v4.37.1 -
Use the commit SHA published for the
v4.37.1release ofgithub/codeql-action, rather than a branch or tag name. This prevents the referenced code from changing without a workflow change. -
Alternatively, if you intentionally want to upgrade CodeQL at the same time, pin both steps to the new release’s commit SHA and update the trailing version comment to match.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
🛟 Help? Slack #semgrep-help or go/semgrep-help.
Resolution Options:
- Fix the code
- Reply
/fp $reason(if security gap doesn’t exist) - Reply
/ar $reason(if gap is valid but intentional; add mitigations/monitoring) - Reply
/other $reason(e.g., test-only)
You can view more details about this finding in the Semgrep AppSec Platform.
|
Looks like github/codeql-action is no longer a dependency, so this is no longer needed. |
Bumps github/codeql-action from 4 to 4.37.1.
Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
Commits
3492b7eChangeREMOTE_PATH_PREFIXtoremote=3654baaMerge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix2d682acMerge pull request #4017 from github/dependabot/github_actions/dot-github/wor...23f6a50Merge pull request #4009 from github/mbg/action-state/additions1ee3c75Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...e053684Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...6803c56Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.18507f88Add changelog notec31b06dUpdate default bundle to codeql-bundle-v2.26.1cc5c777RebuildDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)