Bump actions/stale from 10 to 11 - #35
Conversation
Bumps [actions/stale](https://github.com/actions/stale) from 10 to 11. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@v10...v11) --- updated-dependencies: - dependency-name: actions/stale dependency-version: '11' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![semgrep-code-mongodb[bot]](https://avatars.githubusercontent.com/u/45120?s=60&v=4){kind=small}
| pull-requests: write | ||
| steps: | ||
| - uses: actions/stale@v10 | ||
| - uses: actions/stale@v11 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
actions/stale@v11 uses a movable tag, so repointing v11 could make this scheduled job run attacker-controlled code with issue and PR write access.
More details about this
actions/stale@v11 is referenced by a movable tag, not an immutable commit. If the v11 tag is ever repointed, this scheduled workflow would start running different code every day with issues: write and pull-requests: write permissions.
A plausible attack looks like this:
- An attacker compromises the
actions/staleaction or gains permission to retagv11. - They move
v11to a malicious commit while keeping the sameuses: actions/stale@v11line in your workflow. - On the next nightly run (
cron: '0 0 * * *') or manual run (workflow_dispatch), GitHub fetches that new code because the workflow trusts thev11tag name. - The malicious action then runs inside this
stalejob with write access toissuesandpull-requests. - Using those granted permissions, it could mass-edit issues, auto-close legitimate reports, post misleading comments, or modify PR discussions to hide attacker activity.
Because the reference is mutable, the behavior of this job can change without any change in your repository.
To resolve this comment:
✨ Commit fix suggestion
-
Replace the mutable tag in the workflow step with a full 40-character commit SHA so the action cannot change without an explicit update.
Changeuses: actions/stale@v11touses: actions/stale@<full-40-char-commit-sha> # v11. -
Resolve the SHA from the
actions/stalerepository by opening thev11release or tag in GitHub and copying the commit hash thatv11currently points to.
Use that exact commit in theuses:line, for exampleuses: actions/stale@0123456789abcdef0123456789abcdef01234567 # v11. -
Keep the
# v11comment after the SHA so the pinned version is still easy to recognize during future updates. -
Alternatively, if you need automated dependency updates for GitHub Actions, enable a tool such as Dependabot for
github-actionsso it can open PRs whenactions/stalepublishes a newer trusted SHA.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
🛟 Help? Slack #semgrep-help or go/semgrep-help.
Resolution Options:
- Fix the code
- Reply
/fp $reason(if security gap doesn’t exist) - Reply
/ar $reason(if gap is valid but intentional; add mitigations/monitoring) - Reply
/other $reason(e.g., test-only)
You can view more details about this finding in the Semgrep AppSec Platform.
Bumps actions/stale from 10 to 11.
Release notes
Sourced from actions/stale's releases.
... (truncated)
Changelog
Sourced from actions/stale's changelog.
... (truncated)
Commits
4391f3dFix 24 high severity vulnerabilities by overriding brace-expansion to 5.0.8 (...eaf9131refactor: update imports to use ES module syntax and improve test structure (...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)