ci: Replace curl-pipe-bash with getsentry/action-setup-cli for sentry-cli install - #529
Merged
Conversation
…-cli install Replace insecure `curl | bash` installation of sentry-cli with the official `getsentry/action-setup-cli` GitHub Action. ## Changes - Removed `curl -sL https://sentry.io/get-cli/ | bash` from the test workflow - Added `getsentry/action-setup-cli@v2` as a pinned GitHub Action step ## Why Piping curl output directly into bash allows arbitrary code execution if the remote server is compromised or the URL is hijacked. Using the official GitHub Action avoids this risk by relying on GitHub's action distribution infrastructure and pinned versions. ## Semgrep Finding Details A `run:` step pipes the output of `curl` or `wget` directly into a shell interpreter. This is the "curl | bash" install pattern — if the remote server is compromised or the URL is hijacked, an attacker can execute arbitrary code in your CI runner. Consider downloading the file first, verifying its checksum or signature, and then executing it. alex.tarasov@sentry.io requested this Autofix PR for [this finding](https://semgrep.dev/orgs/sentry/findings/876396253) from the detection rule [yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell](https://semgrep.dev/r/yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell).
getsentry/action-setup-cli@v2 doesn't resolve to any existing tag — this action was hallucinated by Semgrep Autofix and has since been built and published for real, at v1. Reference it by pinned SHA (with the tag as a comment, matching the other action references in this file) instead of the nonexistent v2. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Merged
2 tasks
oioki
marked this pull request as ready for review
August 6, 2026 09:06
oioki
requested review from
NinjaLikesCheez,
itaybre,
philipphofmann,
philprime and
runningcode
as code owners
August 6, 2026 09:06
runningcode
approved these changes
Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace insecure
curl | bashinstallation of sentry-cli withgetsentry/action-setup-cli.Changes
curl -sL https://sentry.io/get-cli/ | bashfrom the test workflowgetsentry/action-setup-cli@70d7e587b84c2e78cf4d37cd33d7b74fb3729c1b # v1Why
Piping curl output directly into bash allows arbitrary code execution if the remote server is compromised or the URL is hijacked.
action-setup-clidownloads thesentry-clirelease asset for the runner's OS/arch and verifies its sha256 against the digest GitHub recorded for that asset via the Releases API, before adding it toPATH. It only usesgh(preinstalled and pre-authenticated on GitHub-hosted runners) — nocurl.Background
This PR was originally opened by Semgrep Autofix, which suggested a
getsentry/action-setup-cli@v2reference — a plausible-looking but nonexistent action and version. That action has since been built for real and published atv1; this PR now points at it.Finding
Semgrep finding from rule yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell.
Refs VULN-2324