[smatting]

No description provided.

[semgrep-code-wireapp]

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

🧼 Fixed in commit 7a3344c 🧼

[semgrep-code-wireapp]

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

🚀 Fixed in commit 7a3344c 🚀

[semgrep-code-wireapp]

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

🧹 Fixed in commit 7a3344c 🧹

[semgrep-code-wireapp]

Semgrep found 1 run-shell-injection finding:

• .github/workflows/publish.yml
  • L155-192 - Triage

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

[screendriver]

I think this can be removed?

[screendriver]

Should we rename the filename and the name of the workflow?

[screendriver]

Suggested change

	runs-on: ubuntu-latest
	runs-on: ubuntu-24.04

[semgrep-code-wireapp]

Semgrep identified an issue in your code:

GitHub Actions step uses mutable tag @v1 instead of a pinned commit SHA, allowing attackers who control the action to inject malicious code that exfiltrates your GitHub App credentials.

More details about this

The GitHub Actions step references actions/create-github-app-token@v1, which uses a mutable version tag instead of a pinned commit SHA. An attacker with control of the actions/create-github-app-token repository could update the v1 tag to point to a malicious version at any time. Here's how this could be exploited:

1. Attacker gains access to the actions/create-github-app-token repository (either through compromised maintainer credentials or by forking it)
2. Attacker updates the v1 tag to point to a new commit containing malicious code
3. Next time this workflow runs, GitHub Actions downloads and executes the malicious version instead of the legitimate one
4. The malicious code runs with access to ${{ secrets.WIRE_ONPREM_AUTOMATION_APP_ID }} and ${{ secrets.WIRE_ONPREM_AUTOMATION_PRIVATE_KEY }} — your GitHub App credentials
5. Attacker uses the stolen credentials to create tokens and manipulate repositories under wireapp organization, or trigger unauthorized dispatches to wireapp/wire-gov-bundles

This is a supply-chain attack: your workflow trusts an external action that can be silently modified. The v1 tag is mutable and controlled by whoever maintains that action.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	uses: actions/create-github-app-token@v1
	uses: actions/create-github-app-token@4c8f2d7c5b9d6a1e3f0b2c4d6e8f1a3b5c7d9e0f

View step-by-step instructions

1. Replace the mutable GitHub Action tag in the uses line with a full 40-character commit SHA.
   Change uses: actions/create-github-app-token@v1 to uses: actions/create-github-app-token@<full-40-char-commit-sha>.

2. Get the SHA from the actions/create-github-app-token repository release or commit that matches the version you intend to use.
   For example, keep the same action but pin it to a specific revision instead of a moving tag like v1.

3. Keep the rest of the step unchanged, including with: inputs such as app-id, private-key, and owner.
   Pinning to a commit SHA prevents the action owner from silently changing what code runs under the same tag.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

_{You can view more details about this finding in the Semgrep AppSec Platform.}