build(deps): bump actions/add-to-project from 0.5.0 to 2.0.0 - #115
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/add-to-project](https://github.com/actions/add-to-project) from 0.5.0 to 2.0.0. - [Release notes](https://github.com/actions/add-to-project/releases) - [Commits](actions/add-to-project@v0.5.0...v2.0.0) --- updated-dependencies: - dependency-name: actions/add-to-project dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![semgrep-code-wireapp[bot]](https://avatars.githubusercontent.com/u/16047324?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/add-to-project@v0.5.0 | ||
| - uses: actions/add-to-project@v2.0.0 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
The workflow runs actions/add-to-project from mutable tag v2.0.0, so a tag change could execute attacker-controlled code with ADD_TO_PROJECT_PAT.
More details about this
actions/add-to-project@v2.0.0 is a mutable release tag, not an immutable commit reference. The action owner—or an attacker who compromises that repository—could move v2.0.0 to a malicious commit without changing this workflow.
A plausible attack would be:
- An attacker repoints the
v2.0.0tag inactions/add-to-projectto code that still appears to add issues to the project but also reads${{ secrets.ADD_TO_PROJECT_PAT }}. - Someone opens an issue, triggering the
add-to-projectjob through theissuesworkflow event. - The runner executes the newly tagged action with the
github-tokenvalue supplied fromsecrets.ADD_TO_PROJECT_PAT. - The malicious action sends that token to an attacker-controlled endpoint, allowing the attacker to use the PAT's GitHub permissions to access or modify project and repository data.
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
You can view more details about this finding in the Semgrep AppSec Platform.
Bumps actions/add-to-project from 0.5.0 to 2.0.0.
Release notes
Sourced from actions/add-to-project's releases.
... (truncated)
Commits
5afcf98Merge pull request #712 from salmanmkc/node24ffed68fMerge main and update action runtime to Node 2427022a1Merge pull request #777 from actions/dependabot/npm_and_yarn/types/node-25.5.0cc89d2eMerge pull request #778 from actions/dependabot/npm_and_yarn/globals-17.4.0ef8e6ffMerge pull request #779 from actions/dependabot/npm_and_yarn/eslint-plugin-je...eb406b3Merge pull request #780 from actions/dependabot/npm_and_yarn/handlebars-4.7.9bb8d4d7Bump handlebars from 4.7.8 to 4.7.9a6fcf8bBump eslint-plugin-jest from 29.12.1 to 29.15.1b35f5d3Bump globals from 17.0.0 to 17.4.0036fea0Bump@types/nodefrom 25.0.3 to 25.5.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)