Skip to content

chore(deps): update actions/setup-python action to v7 #199

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
open-turo-bot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update actions/setup-python action to v7 #199

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ jobs:
with:
fetch-depth: 0
- name: Setup python
uses: actions/setup-python@v6
uses: actions/setup-python@v7

@semgrep-app semgrep-app Bot Jul 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

actions/setup-python@v7 follows a mutable tag, so this workflow may execute changed action code if v7 is repointed. A compromised or retagged action could run in test-pre-installed and steal repository data or CI credentials.

More details about this

actions/setup-python@v7 in the Setup python step is only pinned to the v7 tag, so this job will run whatever code that tag points to at execution time. If someone who can publish or retag actions/setup-python moves v7 to a malicious release, this workflow would download and execute that new action on ubuntu-latest before pip install pre-commit, letting it read the checked-out repository, steal GITHUB_TOKEN or other job secrets, and send them out over the network.

A plausible attack flow here is: 1) an attacker compromises the action publisher or release process for actions/setup-python; 2) they repoint v7 to code that looks normal but adds a step to exfiltrate environment variables; 3) your test-pre-installed job reaches uses: actions/setup-python@v7 and runs the attacker's code; 4) that code can access the workspace created after actions/checkout@v7, inspect repository contents, and use available credentials to tamper with CI behavior or access other systems tied to this workflow.

To resolve this comment:

✨ Commit fix suggestion

Suggested change
uses: actions/setup-python@v7
uses: actions/setup-python@42375524c7d973b1c34b2f43362901d2b83bc45f # setup-python v7
View step-by-step instructions

  1. Replace the version tag in the workflow step with the full commit SHA for the exact actions/setup-python release you want to use.
    Change uses: actions/setup-python@v7 to uses: actions/setup-python@<40-character-commit-sha>.

  2. Keep the action version intent clear by pinning to the commit that corresponds to the current v7 release, for example from the actions/setup-python release page or repository tags.

  3. Add a short comment next to the pinned reference if helpful, such as # setup-python v7, so future updates are easier while still keeping the action immutable. Pinning to a commit SHA prevents the referenced action code from changing unexpectedly.

Alternatively, if you need easier dependency updates, use a tool such as Dependabot to update uses: actions/setup-python@<sha> automatically while still keeping the workflow pinned to a specific commit.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by unpinned-github-action-strict.

You can view more details about this finding in the Semgrep AppSec Platform.

with:
python-version-file: ".python-version"
- name: Install pre-commit
Expand Down
2 changes: 1 addition & 1 deletion action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ runs:
- name: Setup python
# Only run this if we don't already have a pre-commit on the PATH
if: env.PYTHON_BIN == null && env.PRE_COMMIT_BIN == null && steps.pre-commit-config.outputs.exists != 'false'
uses: actions/setup-python@v6
uses: actions/setup-python@v7
- name: Determine node version
id: node-version
shell: bash
Expand Down
Loading