chore(deps): Bump docker/login-action from 4 to 4.5.1 - #125
chore(deps): Bump docker/login-action from 4 to 4.5.1#125dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [docker/login-action](https://github.com/docker/login-action) from 4 to 4.5.1. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v4...v4.5.1) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.5.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
the
github_actions
![semgrep-code-wireapp[bot]](https://avatars.githubusercontent.com/u/16047324?s=60&v=4){kind=small}
|
|
||
| - name: Login to Quay.io | ||
| uses: docker/login-action@v4 | ||
| uses: docker/login-action@v4.5.1 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
The docker/login-action@v4.5.1 step uses a mutable version tag instead of a pinned commit SHA, allowing the action owner to silently inject malicious code that would execute with access to your secrets.
More details about this
The GitHub Actions step uses: docker/login-action@v4.5.1 references the action using a mutable version tag (v4.5.1) instead of a pinned commit SHA. This creates a supply-chain attack risk: the owner of docker/login-action could silently push new code to the v4.5.1 tag at any time, and your workflow would automatically execute that new code without any warning or visibility.
Exploit scenario:
- An attacker compromises the
docker/login-actionrepository on GitHub - The attacker pushes malicious code to the
v4.5.1tag (e.g., code that exfiltrates theQUAY_ROBOT_TOKENsecret passed into this step viawith.password) - On your next workflow run, your workflow silently pulls and executes the compromised
v4.5.1version - The malicious code in the step runs with access to your secrets and registry credentials, allowing the attacker to push backdoored container images to your
quay.io/wire/github-apprepository - Your users pull and run the backdoored image, compromising their systems
This is the exact attack pattern seen in real incidents like the trivy-action and kics-github-action compromises.
To resolve this comment:
✨ Commit fix suggestion
| uses: docker/login-action@v4.5.1 | |
| uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 |
View step-by-step instructions
-
Replace the mutable action version in the
usesline with a full 40-character commit SHA fordocker/login-action.
Changeuses: docker/login-action@v4.5.1touses: docker/login-action@<full-commit-sha>. -
Resolve the SHA from the exact action release you want to keep using, so the workflow behavior stays the same while the reference becomes immutable.
For example, pin the currentv4.5.1release commit from thedocker/login-actionrepository and useuses: docker/login-action@0123456789abcdef0123456789abcdef01234567. -
Keep the rest of the step unchanged, including the existing
with:values forregistry,username, andpassword.
Pinning to a commit SHA prevents the action owner from silently moving the referenced version to different code later. -
Alternatively, if you intentionally want to upgrade to a newer action release instead of keeping
v4.5.1, first choose that release, then pinuses:to the full 40-character commit SHA for that release rather than to a tag like@v4or@v4.5.1.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
You can view more details about this finding in the Semgrep AppSec Platform.
Bumps docker/login-action from 4 to 4.5.1.
Release notes
Sourced from docker/login-action's releases.
... (truncated)
Commits
a5e9150Merge pull request #1048 from docker/dockerhub-oidc-supporta482ba4build(deps): bump the codeql-actions group with 2 updates9e3d36echore: update generated content14d6a79docker hub oidc support03c8510Merge pull request #1044 from docker/dependabot/npm_and_yarn/docker/actions-t...ad8a81fMerge pull request #1046 from docker/dependabot/npm_and_yarn/brace-expansion-...6d219a4[dependabot skip] chore: update generated contentb320069build(deps): bump@docker/actions-toolkitfrom 0.92.0 to 0.93.008d3680[dependabot skip] chore: update generated content381f5a4Merge pull request #1042 from docker/dependabot/github_actions/codeql-actions...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)