T08 · Insecure Dependencies
Warning
- Location
- references/ci-workflow.yml:16
- Finding
- GitHub Actions Referenced by Mutable Version Tags## Vulnerability Details **File Location**: `references/ci-workflow.yml`, lines 16-43 **Vulnerability Type**: CI/CD supply-chain exposure through mutable action references **Risk Level**: Medium ### Vulnerable Code ```yaml steps: - uses: actions/checkout@v4 - name: Install uv uses: astral-sh/setup-uv@v4 with: enable-cache: true - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v5 with: python-version: ${{ matrix.python-version }} - name: Install dependencies run: uv sync --all-extras --dev - name: Run linters run: | uv run ruff check src/ tests/ uv run ruff format --check src/ tests/ uv run mypy src/ - name: Run tests run: uv run pytest tests/ -v --cov=src --cov-report=xml - name: Upload coverage uses: codecov/codecov-action@v4 if: matrix.python-version == '3.11' with: file: ./coverage.xml ``` ### Technical Analysis The workflow references `actions/checkout`, `astral-sh/setup-uv`, `actions/setup-python`, and `codecov/codecov-action` using mutable major-version tags. Unlike full commit hashes, tags can be moved or replaced by the upstream repository. Consequently, the code executed by a future workflow run may differ from the code originally reviewed. GitHub Actions execute code on the CI runner. If an upstream action repository or release process is compromised and one of these tags is redirected to malicious code, the altered action would execute automatically during subsequent workflow runs. ### Attack Path 1. An attacker compromises an upstream action repository, maintainer account, release process, or tag-management mechanism. 2. The attacker moves a referenced major-version tag, such as `v4` or `v5`, to a malicious commit. 3. A push or pull request triggers this ...[truncated 880 chars]
- Remediation
- ## Remediation Suggestions - Pin every third-party action to a reviewed, immutable full commit SHA rather than a mutable tag. - Retain the release version in a comment for maintainability, for example: ```yaml - uses: actions/checkout@REVIEWED_FULL_COMMIT_SHA # v4 ``` - Review action updates before changing pinned hashes, using an automated dependency update service where appropriate. - Explicitly configure least-privilege workflow permissions, such as: ```yaml permissions: contents: read ``` - Grant additional permissions only to the individual jobs that require them. - Avoid exposing secrets to untrusted pull-request workflows and use protected environments for privileged operations. - Audit all transitive action dependencies and prefer actions maintained by trusted publishers.