Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add MkDocs documentation with GitHub Pages deployment #52
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Uh oh!
There was an error while loading. Please reload this page.
Add MkDocs documentation with GitHub Pages deployment #52
Changes from all commits
1724a7cf8e706b20fd2e30d12640fe4a634d0b69181b437dbFile filter
Filter by extension
Conversations
Uh oh!
There was an error while loading. Please reload this page.
Jump to
Uh oh!
There was an error while loading. Please reload this page.
There are no files selected for viewing
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Semgrep identified an issue in your code:
GitHub Actions step uses mutable version tag
@v4instead of pinned commit SHA, allowing attackers to silently redirect the action to malicious code.More details about this
The
actions/checkoutstep uses version tag@v4instead of a pinned commit SHA. Version tags and branch references in GitHub Actions can be silently repointed by the action's owner to malicious code without any update to your workflow file. This enables supply-chain attacks where a compromised maintainer could redirect@v4to inject malicious code that exfiltrates repository secrets or modifies your build output.Exploit scenario:
actions/checkoutrepository and force-pushes thev4tag to point to a commit containing malicious codeGITHUB_TOKEN, allowing the attacker to read your repository secrets or push backdoors to your main branchPin to a full 40-character commit SHA (e.g.,
actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608) to ensure you always run the exact version you tested.To resolve this comment:
✨ Commit fix suggestion
View step-by-step instructions
uses: actions/checkout@v4withuses: actions/checkout@<commit-sha>where<commit-sha>is the full 40-character commit hash you found in step 1 (for example:uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608).v4,v3,main, or similar).Pinning to a full commit SHA ensures the workflow always uses the same, reviewed code and protects against supply-chain attacks resulting from upstream changes.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasonsAlternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Semgrep identified an issue in your code:
GitHub Actions step
actions/setup-python@v5uses a mutable version tag that could be silently redirected to malicious code by an attacker, enabling supply-chain attacks on your build pipeline.More details about this
The GitHub Actions workflow uses
actions/setup-python@v5, which references a mutable major version tag instead of a pinned commit SHA.How an attacker could exploit this:
setup-pythonrepository or the account that maintains it.v5tag to point to a malicious commit containing backdoor code, perhaps a script that exfiltrates repository secrets likeGITHUB_TOKENor environment variables.v5tag without any warning or verification.setup-python@v5action runs in your workflow with full access to your repository's secrets and the ability to execute arbitrary commands.This exact scenario happened with the
trivy-actionandkics-github-actioncompromises, where attackers gained control of version tags and silently injected malicious code into thousands of workflows.To resolve this comment:
✨ Commit fix suggestion
View step-by-step instructions
uses: actions/setup-python@v5with a specific 40-character commit SHA that corresponds to the version you want to use. For example, change it touses: actions/setup-python@<commit-sha>and add a comment with the version for reference, like# v5.x.x.uses: actions/setup-python@a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0 # v5.0.0.Pinning actions to a full-length commit SHA protects against supply-chain attacks because the action code cannot be changed by the action owner without you knowing.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasonsAlternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Semgrep identified an issue in your code:
GitHub Actions workflow uses version tag
v4instead of a pinned commit SHA, allowing the action to be swapped by an attacker who compromises the repository. Pinning to a full commit SHA ensures immutability and prevents malicious code injection.More details about this
The GitHub Actions workflow uses
peaceiris/actions-gh-pagespinned only to thev4version tag instead of a specific commit SHA. Version tags can be moved or retagged by the maintainer, meaning the same tag could point to different code over time.Exploit scenario:
peaceiris/actions-gh-pagesrepository (or gains write access to it).v4, replacing the code that currently runs in your workflow.uses: peaceiris/actions-gh-pages@v4line pulls the attacker's code instead.secrets.GITHUB_TOKENandpublish_dir: ./site, allowing the attacker to steal your GitHub token, modify your site content, or compromise your repository and other actions.By pinning to a full commit SHA (like
uses: peaceiris/actions-gh-pages@a3523ae0e4cd1f5299b8aa5e37255467ec0de1ad), you lock to an immutable version that cannot be changed even if the repository is compromised.To resolve this comment:
✨ Commit fix suggestion
View step-by-step instructions
$ git ls-remote https://github.com/peaceiris/actions-gh-pages.git v4.uses: peaceiris/actions-gh-pages@v4withuses: peaceiris/actions-gh-pages@<commit-sha>, where<commit-sha>is the full 40-character commit hash.For example:
uses: peaceiris/actions-gh-pages@abcdef1234567890abcdef1234567890abcdef12# v4.0.0, to clarify which release you are pinning.Pinning to a specific commit ensures that your workflow cannot be modified by upstream changes or supply chain attacks unless you explicitly update the SHA.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasonsAlternatively, triage in Semgrep AppSec Platform to ignore the finding created by third-party-action-not-pinned-to-commit-sha.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Semgrep identified an issue in your code:
The
peaceiris/actions-gh-pages@v4step uses a mutable version tag that could be silently repointed to malicious code, compromising theGITHUB_TOKENpassed to it and enabling repository takeover.More details about this
The GitHub Actions workflow step
uses: peaceiris/actions-gh-pages@v4references the action using a mutable version tag (v4) instead of a pinned commit SHA.Exploit scenario:
peaceiris/actions-gh-pagesrepository on GitHub (or socially engineers the maintainer).v4tag to point to a malicious commit containing code that exfiltrates${{ secrets.GITHUB_TOKEN }}(which is passed to this action).GITHUB_TOKENwithcontents: writepermissions and can push malicious code to your repository, modify your documentation site, or access other repositories you have access to.This is especially dangerous here because the action receives
github_token: ${{ secrets.GITHUB_TOKEN }}, giving the compromised action full write access to your repository. Similar attacks have already occurred in the wild (e.g., trivy-action and kics-github-action compromises).To resolve this comment:
✨ Commit fix suggestion
View step-by-step instructions
uses: peaceiris/actions-gh-pages@v4withuses: peaceiris/actions-gh-pages@<commit-sha>, where<commit-sha>is the commit you copied. For example:uses: peaceiris/actions-gh-pages@13b7eb9eebd81f2444ea0ae2ebc6aa270d9f1a38 # v4.0.0.# v4.0.0, after the commit SHA.Pinning to a commit SHA ensures your workflow always uses the trusted code, even if someone changes or repoints the tag or branch.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasonsAlternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.