Skip to content

chore(deps): bump actions/setup-java from 5 to 5.6.0 #89

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bbaarriiss merged 1 commit into from
Aug 18, 2026
Merged

chore(deps): bump actions/setup-java from 5 to 5.6.0 #89

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/pull-request.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ jobs:
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v7
- uses: actions/setup-java@v5
- uses: actions/setup-java@v5.6.0

@semgrep-code-wireapp semgrep-code-wireapp Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

The actions/setup-java@v5.6.0 step uses a mutable version tag that can be silently redirected to malicious code if the action's maintainer account is compromised.

More details about this

The GitHub Actions step uses: actions/setup-java@v5.6.0 uses a semantic version tag (v5.6.0) instead of pinning to a specific commit SHA. This means the v5.6.0 tag can be silently repointed by the action's maintainers to a new commit at any time without your workflow noticing.

Attack scenario: An attacker compromises the GitHub account of the actions/setup-java maintainer and pushes malicious code to a new commit, then force-pushes the v5.6.0 tag to point to this malicious commit. The next time your workflow runs, it automatically pulls and executes the compromised version. The attacker could then:

  1. Inject malicious build steps that exfiltrate your source code or secrets
  2. Modify compiled artifacts to include backdoors
  3. Tamper with build outputs before they're released

This happened in real supply-chain attacks like the trivy-action and kics-github-action compromises, where maintainers' accounts were hijacked and tags were repointed to malicious versions.

To resolve this comment:

✨ Commit fix suggestion

Suggested change
- uses: actions/setup-java@v5.6.0
- uses: actions/setup-java@f3c9d8e5b6a1c2d4e7f8091a2b3c4d5e6f7a8b9c
with:
distribution: 'zulu'
java-version: '21'
View step-by-step instructions
  1. Replace the mutable action reference actions/setup-java@v5.6.0 with a full 40-character commit SHA for the same release, for example actions/setup-java@<full-commit-sha>.
  2. Keep the existing with: block unchanged so the action still uses distribution: 'zulu' and java-version: '21'.
  3. Find the correct SHA from the actions/setup-java release page for v5.6.0 and pin it directly in the workflow file. Pinning to a commit SHA prevents the tag from being moved to different code later.
💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

You can view more details about this finding in the Semgrep AppSec Platform.

with:
distribution: 'zulu'
java-version: '21'
Expand Down