Repository navigation
chore: Pin release-please-action to full commit SHA - #27
Closed
semgrep-code-launchdarkly[bot] wants to merge 3 commits into
Closed
semgrep-code-launchdarkly[bot] wants to merge 3 commits into
semgrep-code-launchdarkly[bot] wants to merge 3 commits into
Conversation
Pin the `googleapis/release-please-action` to a full commit SHA to mitigate supply chain attack risks. ## Changes - Pin `googleapis/release-please-action@v4` to commit SHA `7987652d64b54f048af0955c00c6c20444d67d5a` - Add version comment (`# v4`) for maintainability ## Why Using a version tag like `v4` means the workflow references a mutable pointer that could be changed by a bad actor who gains access to the action's repository. Pinning to the full 40-character commit SHA ensures the workflow uses an immutable reference, requiring an attacker to generate a SHA-1 collision to inject malicious code. ## Semgrep Finding Details An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. @pkaeding@launchdarkly.com requested Semgrep Assistant generate this pull request to fix [a finding](https://semgrep.dev/orgs/launchdarkly/findings/726547317).
keelerm84
reviewed
Mar 20, 2026
|
|
||
| steps: | ||
| - uses: googleapis/release-please-action@v4 | ||
| - uses: googleapis/release-please-action@7987652d64b54f048af0955c00c6c20444d67d5a # v4 |
Member
There was a problem hiding this comment.
I think this is the same issue as the other PR. Should be 16a9c90856f42705d54a6fda1823352bdc62cf38 for the latest v4.4 release.
jsonbailey
approved these changes
Oct 21, 2026
jsonbailey
marked this pull request as ready for review
October 21, 2026 19:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pin the
googleapis/release-please-actionto a full commit SHA to mitigate supply chain attack risks.Changes
googleapis/release-please-action@v4to commit SHA7987652d64b54f048af0955c00c6c20444d67d5a# v4) for maintainabilityWhy
Using a version tag like
v4means the workflow references a mutable pointer that could be changed by a bad actor who gains access to the action's repository. Pinning to the full 40-character commit SHA ensures the workflow uses an immutable reference, requiring an attacker to generate a SHA-1 collision to inject malicious code.Semgrep Finding Details
An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
@pkaeding@launchdarkly.com requested Semgrep Assistant generate this pull request to fix a finding.
Note
Overview
Pins
googleapis/release-please-actionin the release workflow to a full 40-character commit SHA (with a# v4comment) instead of a mutable version tag likev4.This is a supply-chain hardening change for
.github/workflows/release-please.ymlonly; release behavior should stay the same while the action reference becomes immutable.Reviewed by Cursor Bugbot for commit 714ff5f. Bugbot is set up for automated code reviews on this repo. Configure here.