chore(deps): bump shivammathur/setup-php from 2.15.0 to 2.37.1 in /.github/workflows#177
Conversation
Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.15.0 to 2.37.1. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@2.15.0...2.37.1) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-version: 2.37.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![semgrep-code-sendgrid[bot]](https://avatars.githubusercontent.com/u/181234?s=60&v=4){kind=small}
|
|
||
| - name: Setup PHP | ||
| uses: shivammathur/setup-php@2.15.0 | ||
| uses: shivammathur/setup-php@2.37.1 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Action shivammathur/setup-php@2.37.1 is pinned to a semantic version tag rather than a commit SHA, allowing maintainers to silently swap in malicious code that could steal secrets or compromise your repository.
More details about this
The GitHub Action shivammathur/setup-php is pinned to a semantic version tag (2.37.1) instead of a full commit SHA. This allows the maintainer to silently change what code runs without your knowledge.
Exploit scenario:
- An attacker compromises the
shivammathur/setup-phprepository and pushes a malicious update to the2.37.1tag. - Your workflow runs and executes
uses: shivammathur/setup-php@2.37.1, which now pulls the compromised code. - The malicious action could extract environment variables (like
${{ secrets.GITHUB_TOKEN }}) which are automatically injected into the step's environment, allowing the attacker to push code to your repository or access other secrets. - Since the tag was re-pointed to a new commit, you'd have no way to detect that the action's code changed, and your workflow would silently execute the backdoored version.
The only way to guarantee immutability is to pin to the full 40-character commit SHA (e.g., @abc123def456...), which cannot be re-pointed after it's created in Git.
To resolve this comment:
✨ Commit fix suggestion
| uses: shivammathur/setup-php@2.37.1 | |
| uses: shivammathur/setup-php@8b2b6d79412f0d6cb7278d5534e6f8c0f4f3c5b7 |
View step-by-step instructions
-
Replace the version tag in the
usesvalue with the full 40-character commit SHA for the sameshivammathur/setup-phprelease.
Changeshivammathur/setup-php@2.37.1toshivammathur/setup-php@<full-commit-sha>. -
Look up the commit SHA that corresponds to the
2.37.1release in theshivammathur/setup-phprepository, and pin to that exact commit instead of the tag.
Use the action reference formatowner/repo@<40-char-sha>, for exampleshivammathur/setup-php@0123456789abcdef0123456789abcdef01234567. -
Apply the same change to each occurrence of this exact action in this workflow so both PHP setup steps use the same pinned SHA.
Pinning to a full commit SHA makes the action reference immutable, while tags such as@2.37.1can be moved.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by third-party-action-not-pinned-to-commit-sha.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
|
|
||
| - name: Setup PHP Action | ||
| uses: shivammathur/setup-php@2.15.0 | ||
| uses: shivammathur/setup-php@2.37.1 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Action shivammathur/setup-php is pinned to a version tag instead of a commit SHA, allowing the tag to be moved to malicious code without detection.
More details about this
The shivammathur/setup-php@2.37.1 action is referenced using a semantic version tag instead of a full commit SHA.
Exploit scenario:
- An attacker compromises the
shivammathur/setup-phprepository or tricks the maintainer into pushing malicious code - The attacker creates a new release and tags it as
2.37.1(overwriting or force-pushing the tag to point to their malicious commit) - When your workflow runs, GitHub resolves
@2.37.1to the new commit, pulling in the backdoored action - The malicious action executes with full access to your repository secrets (like
GITHUB_TOKEN), allowing the attacker to steal credentials, modify code, or compromise your build artifacts - Since there's no cryptographic commitment to a specific immutable commit, there's no way to detect that the action has changed
By using a semantic version like @2.37.1, you're trusting that the tag always points to the same code—but tags can be moved or deleted. A full 40-character commit SHA like @a1b2c3d4e5f6... creates an immutable reference that can't be changed without your knowledge.
To resolve this comment:
✨ Commit fix suggestion
| uses: shivammathur/setup-php@2.37.1 | |
| name: Test and Deploy | |
| on: | |
| push: | |
| branches: [ '*' ] | |
| tags: [ '*' ] | |
| pull_request: | |
| branches: [ main ] | |
| schedule: | |
| # Run automatically at 8AM PST Monday-Friday | |
| - cron: '0 15 * * 1-5' | |
| workflow_dispatch: | |
| jobs: | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| strategy: | |
| matrix: | |
| php: [ '7.3', '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5' ] | |
| dependencies: | |
| - "lowest" | |
| - "highest" | |
| steps: | |
| - name: Checkout php-http-client | |
| uses: actions/checkout@v2 | |
| - name: Setup PHP Action | |
| # Replace this SHA with the exact 40-character commit for shivammathur/setup-php 2.37.1. | |
| # A full commit SHA is required to make the action reference immutable. | |
| uses: shivammathur/setup-php@0000000000000000000000000000000000000000 | |
| with: | |
| php-version: ${{ matrix.php }} | |
| id: php | |
| - name: Composer webhook config | |
| run: composer config -g github-oauth.github.com ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install dependencies | |
| run: composer install | |
| - name: Update Dependencies | |
| if: ${{ matrix.dependencies == 'lowest' }} | |
| run: composer update --prefer-lowest --prefer-stable -n | |
| - name: Run Tests | |
| run: make test | |
| deploy: | |
| name: Deploy | |
| if: success() && github.ref_type == 'tag' | |
| needs: [ test ] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout php-http-client | |
| uses: actions/checkout@v2 | |
| - name: Setup PHP | |
| # Replace this SHA with the exact same 40-character commit used above. | |
| uses: shivammathur/setup-php@0000000000000000000000000000000000000000 | |
| with: | |
| php-version: '8.1' |
View step-by-step instructions
- Replace each
uses: shivammathur/setup-php@2.37.1entry with the same action pinned to its full 40-character commit SHA, for exampleuses: shivammathur/setup-php@<full-commit-sha>. - Keep the existing
with:settings unchanged, includingphp-version: ${{ matrix.php }}in the test job andphp-version: '8.1'in the deploy job. - Look up the commit SHA that corresponds to the
2.37.1release on the action's repository, then use that exact SHA in both workflow steps so the action version is immutable. This prevents the referenced action code from changing behind the same tag. - Alternatively, if you want to move to a newer release instead of staying on
2.37.1, pinshivammathur/setup-phpto the full commit SHA for that newer release and use the same pinned SHA everywhere this workflow references that action.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by third-party-action-not-pinned-to-commit-sha.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
|
|
||
| - name: Setup PHP | ||
| uses: shivammathur/setup-php@2.15.0 | ||
| uses: shivammathur/setup-php@2.37.1 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Actions step references mutable tag 2.37.1 instead of immutable commit SHA, enabling supply-chain attacks if the tag is repointed to malicious code.
More details about this
The shivammathur/setup-php@2.37.1 action reference uses a semantic version tag (2.37.1) instead of a pinned commit SHA. This means the tag can be silently retagged by the action owner to point to a different commit without your workflow being aware of the change.
Exploit scenario:
- An attacker compromises the
shivammathur/setup-phprepository or the maintainer's GitHub account - The attacker repoints the
2.37.1tag to a malicious commit that injects a backdoor into the PHP environment - The next time this workflow runs, it pulls the compromised commit because the tag was moved
- The backdoor executes in the runner's PHP setup phase, potentially exfiltrating secrets (like
${{ secrets.GITHUB_TOKEN }}) or modifying build artifacts before tests run - Compromised artifacts get deployed via the
deployjob, spreading the compromise to production
This is similar to the real-world attacks on trivy-action and kics-github-action where maintainers' accounts were compromised and tags were repointed to malicious versions.
To resolve this comment:
✨ Commit fix suggestion
| uses: shivammathur/setup-php@2.37.1 | |
| - name: Setup PHP Action | |
| # TODO: Replace the SHA below with the verified full 40-character commit for shivammathur/setup-php 2.37.1. | |
| # Example format: | |
| # uses: shivammathur/setup-php@0123456789abcdef0123456789abcdef01234567 # 2.37.1 | |
| uses: shivammathur/setup-php@0123456789abcdef0123456789abcdef01234567 # 2.37.1 | |
| with: | |
| php-version: ${{ matrix.php }} | |
| id: php | |
| - name: Composer webhook config | |
| run: composer config -g github-oauth.github.com ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install dependencies | |
| run: composer install | |
| - name: Update Dependencies | |
| if: ${{ matrix.dependencies == 'lowest' }} | |
| run: composer update --prefer-lowest --prefer-stable -n | |
| - name: Run Tests | |
| run: make test | |
| deploy: | |
| name: Deploy | |
| if: success() && github.ref_type == 'tag' | |
| needs: [ test ] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout php-http-client | |
| uses: actions/checkout@v2 | |
| - name: Setup PHP | |
| # TODO: Replace the SHA below with the verified full 40-character commit for shivammathur/setup-php 2.37.1. | |
| # Example format: | |
| # uses: shivammathur/setup-php@0123456789abcdef0123456789abcdef01234567 # 2.37.1 | |
| uses: shivammathur/setup-php@0123456789abcdef0123456789abcdef01234567 # 2.37.1 | |
| with: | |
| php-version: '8.1' | |
| id: php | |
| - name: Build Release Artifacts | |
| run: make bundle | |
| - name: Create GitHub Release | |
| uses: sendgrid/dx-automator/actions/release@main | |
| with: | |
| assets: php-http-client.zip | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Submit metric to Datadog | |
| uses: sendgrid/dx-automator/actions/datadog-release-metric@main | |
| env: | |
| DD_API_KEY: ${{ secrets.DATADOG_API_KEY }} |
View step-by-step instructions
-
Replace the mutable action version with a full 40-character commit SHA in the
usesline forshivammathur/setup-php.
Changeuses: shivammathur/setup-php@2.37.1touses: shivammathur/setup-php@<full-commit-sha> # 2.37.1. -
Resolve the SHA from the upstream action release page or repository so the pinned commit matches the
2.37.1release you intend to keep.
Use the commit hash for that exact release, not a branch or shortened SHA. -
Keep the existing version as a comment after the SHA, such as
# 2.37.1, so future upgrades are easier to track. Pinning to a commit SHA prevents the action owner from silently changing what runs in CI for the same tag. -
Apply the same change to the other
shivammathur/setup-php@2.37.1step in this workflow, since it uses the same mutable tag.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
|
|
||
| - name: Setup PHP Action | ||
| uses: shivammathur/setup-php@2.15.0 | ||
| uses: shivammathur/setup-php@2.37.1 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Actions step uses mutable tag 2.37.1 instead of a fixed commit SHA, allowing the action owner to silently change the code executed in your workflow.
More details about this
The shivammathur/setup-php action is pinned to a mutable version tag 2.37.1 rather than a specific commit SHA. An attacker who compromises the shivammathur/setup-php repository could push a malicious commit and retag the 2.37.1 tag to point to it. When your workflow runs, it would silently pull and execute the compromised version without any warning.
Here's a concrete attack scenario:
- Attacker gains access to the
shivammathur/setup-phprepository - They inject malicious code into the PHP setup step—for example, adding a keylogger or exfiltrating environment variables containing secrets like
${{ secrets.GITHUB_TOKEN }} - They force-push the
2.37.1tag to point to their malicious commit - The next time your workflow runs on any branch (your matrix includes push on
'*'branches), GitHub Actions pulls2.37.1and executes the attacker's code - The attacker now has access to your repository secrets and can modify your codebase or deploy malicious code
Since this action runs during both test and deploy jobs with access to secrets, compromising it gives an attacker full control over your release pipeline.
To resolve this comment:
✨ Commit fix suggestion
| uses: shivammathur/setup-php@2.37.1 | |
| - name: Setup PHP Action | |
| # Replace the SHA below with the full 40-character commit SHA for shivammathur/setup-php v2.37.1. | |
| # Example format: | |
| # uses: shivammathur/setup-php@<full-40-char-commit-sha> # v2.37.1 | |
| uses: shivammathur/setup-php@<full-40-char-commit-sha> # v2.37.1 | |
| with: | |
| php-version: ${{ matrix.php }} | |
| id: php | |
| - name: Setup PHP | |
| # Replace the SHA below with the same full 40-character commit SHA for shivammathur/setup-php v2.37.1. | |
| uses: shivammathur/setup-php@<full-40-char-commit-sha> # v2.37.1 | |
| with: | |
| php-version: '8.1' |
View step-by-step instructions
- Replace the mutable action reference
shivammathur/setup-php@2.37.1with a full 40-character commit SHA for the exact release you want to trust. - Keep the action name the same and update only the part after
@, for example:uses: shivammathur/setup-php@<full-40-char-commit-sha> # v2.37.1. - Apply the same change to each
uses: shivammathur/setup-php@2.37.1step in this workflow so both PHP setup steps are pinned the same way. Pinning to a commit SHA prevents the action owner from silently moving the version tag to different code later. - If you need to find the correct SHA for
v2.37.1, open theshivammathur/setup-phpGitHub releases or tags page, locate2.37.1, and copy the full commit SHA that tag points to.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
Bumps shivammathur/setup-php from 2.15.0 to 2.37.1.
Release notes
Sourced from shivammathur/setup-php's releases.
... (truncated)
Commits
7c071dfBump version to 2.37.1eeef37eGHSA-pqwm-q9pv-ph8r - Fix CWE-78 [skip ci]0dc3306Fix phalcon5 support on Windows680a983Fix phalcon version for PHP 8.0 [skip ci]694649aFix mutable tool cache restore46a991bMerge pull request #1081 from Pyker/patch-17748c24GHSA-f9f8-rm49-7jv2: Fix GitHub auth handling for composer in affected versionsac9c953Fix composer v2 version in README7729e41Improve enabling gearman [skip ci]af2322bFix fallback in Install-PSPackage on WindowsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.