fix(template): suppress intentional mutable-action-tag SAST finding#68
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds # nosemgrep suppression comments to several GitHub Actions steps in the php-modernization.yml template to prevent SAST tools from flagging the intentional use of mutable major tags. The reviewer recommends specifying the exact Semgrep rule ID (github-actions-mutable-action-tag) instead of using blanket # nosemgrep suppressions to avoid accidentally silencing other unrelated security or quality findings on those lines.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
Pull request overview
Suppresses the github-actions-mutable-action-tag SAST finding in the PHP modernization GitHub Actions workflow template by documenting intentional mutable major tags and adding inline # nosemgrep markers, aligning with the template’s “copy then pin” design.
Changes:
- Expanded the template header to explain why mutable major tags are intentional in this template and how consumers should handle pinning.
- Added inline
# nosemgrepsuppressions to the fiveuses: …@vNaction references to silence the SAST rule.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The org SAST (opengrep --config auto) started enforcing github-actions-mutable-action-tag and flags the five @vn tags in this CI template on every PR. The mutable majors are an intentional, documented default for a copy-paste template (consumers pin on copy — see the header), so suppress the finding inline with `# nosemgrep` and a rationale rather than pinning the template itself. Verified with a local `opengrep --config auto --severity WARNING` re-scan: 5 findings -> 0. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
811de4b to
1024316
Compare
|
Summary
Suppress the
github-actions-mutable-action-tagSAST finding on the fiveuses: …@vNlines in the CI template, using inline# nosemgrepwith a rationale rather than pinning the template to SHAs.Why not pin
The template's own header documents the mutable major tags as intentional convenient defaults, with instructions for consumers to pin to a SHA on copy. It is a copy-paste starting point, not a live workflow, so pinning the template contradicts its design and adds Renovate churn. The
# nosemgrepmarkers record that the mutable default is deliberate; the header now says to drop the marker when pinning.Context
The org SAST (
opengrep --config auto --error --severity WARNING, fromnetresearch/typo3-ci-workflows) recently began enforcing this rule, so it now fails on every PR to this repo — including the unrelated docs PR #67. This unblocks both.Verification
opengrep --config auto --severity WARNING skills/— 5 findings → 0 after the change.yamllint -c .yamllint.ymlon the template — clean.Test plan