chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.0 #326
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -24,8 +24,8 @@ | |||||
| uses: actions/checkout@v6 | ||||||
|
|
||||||
| - name: Setup pnpm | ||||||
|
Contributor
There was a problem hiding this comment.
This workflow uses a mutable tag reference (
Suggested change
Prompt To Fix With AIThis is a comment left during a code review.
Path: .github/workflows/deploy-docs.yml
Line: 26
Comment:
**No SHA pin on `deploy-docs.yml`**
This workflow uses a mutable tag reference (`@v6.0.0`) while all other workflows in this PR use a full commit SHA. If the tag is ever force-pushed, this workflow would silently run a different version. Consider pinning to the same SHA used elsewhere (`08c4be7e2e672a47d11bd04269e27e5f3e8529cb`).
```suggestion
uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6.0.0
```
How can I resolve this? If you propose a fix, please make it concise. |
||||||
| uses: pnpm/action-setup@v6.0.0 | ||||||
|
|
||||||
|
Check notice on line 28 in .github/workflows/deploy-docs.yml
|
||||||
|
There was a problem hiding this comment. 🟣 deploy-docs.yml uses pnpm/action-setup@v6.0.0 (a mutable tag) while all 8 other workflows updated in this PR use the pinned commit SHA 08c4be7e2e672a47d11bd04269e27e5f3e8529cb. This is a pre-existing issue — deploy-docs.yml was already using mutable tags for all its actions (checkout@v6, setup-node@v6, wrangler-action@v3, github-script@v8) before this PR — but since this PR touched this exact line, it was an opportunity to bring it in line with the pinned-hash approach used everywhere else. Consider updating to: uses: pnpm/action-setup@08c4be7 # v6.0.0 Extended reasoning...What the bug is: deploy-docs.yml line 28 uses pnpm/action-setup@v6.0.0 — a mutable semver tag — while all 8 other workflow files updated in this same PR use the pinned commit hash 08c4be7e2e672a47d11bd04269e27e5f3e8529cb. A mutable tag means the tag can be force-pushed to point to different commit content at any time, so the action that actually runs can silently change without the workflow file changing. The specific code path: In deploy-docs.yml, the "Setup pnpm" step resolves pnpm/action-setup@v6.0.0 at runtime. GitHub Actions resolves this to whatever commit the v6.0.0 tag points to at execution time. If the tag is moved (e.g., in response to a supply chain compromise), all future runs of this workflow will execute attacker-controlled code with the workflow's permissions (contents: read, deployments: write, pull-requests: write). Why existing code doesn't prevent it: The other 8 workflows were correctly updated to use the immutable SHA 08c4be7e2e672a47d11bd04269e27e5f3e8529cb, which resolves to exactly one specific git object and can never be silently changed. deploy-docs.yml was not given the same treatment — it was only bumped from @v5 to @v6.0.0, both being mutable references. Furthermore, deploy-docs.yml uses mutable tags for all its other actions as well: checkout@v6, setup-node@v6, cloudflare/wrangler-action@v3, and github-script@v8. Pre-existing nature: This is a pre-existing issue. The entire deploy-docs.yml file used mutable tags before this PR. The PR updated pnpm/action-setup from @v5 to @v6.0.0 but did not fix the underlying security posture, whereas the other 8 files were properly pinned. Impact: The deploy-docs workflow has write access to deployments and pull-requests, making it a higher-value target. A compromised mutable action tag could exfiltrate secrets (CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID), post malicious PR comments, or manipulate Cloudflare Pages deployments. How to fix: Replace the mutable tag with the pinned hash that is already used across all other workflows: - name: Setup pnpm
uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6.0.0Ideally, all other mutable action references in this file (checkout@v6, setup-node@v6, wrangler-action@v3, github-script@v8) should also be pinned to their respective commit SHAs. Step-by-step proof:
|
||||||
| - name: Setup Node.js | ||||||
| uses: actions/setup-node@v6 | ||||||
| with: | ||||||
|
|
||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The SHA now points to v6.0.0 but the inline comment still reads
# v4. The same pattern appears indocs-check.yml,docs-seo-aeo.yml,prepare-release.yml,release-on-tag.yml,release.yml(both jobs), andstable-release.yml. Onlyci.ymlwas updated correctly. Consider updating the comments to# v6.0.0across all affected files for consistency withci.yml.Prompt To Fix With AI