chore(deps): bump shivammathur/setup-php from 2.15.0 to 2.37.1 in /.github/workflows#125
Conversation
Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.15.0 to 2.37.1. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@2.15.0...2.37.1) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-version: 2.37.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![semgrep-code-sendgrid[bot]](https://avatars.githubusercontent.com/u/181234?s=60&v=4){kind=small}
|
|
||
| - name: Setup PHP | ||
| uses: shivammathur/setup-php@2.15.0 | ||
| uses: shivammathur/setup-php@2.37.1 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
The setup-php action is pinned to a version tag instead of a commit SHA, allowing tag manipulation attacks if the upstream repository is compromised.
More details about this
The setup-php action is pinned to a version tag (2.37.1) rather than a full-length commit SHA. Version tags can be moved or deleted by the action maintainer, potentially allowing a malicious actor to force your workflow to run a backdoored version of the action if they compromise the repository.
Exploit scenario:
- An attacker gains access to the
shivammathur/setup-phprepository and modifies the code to inject a backdoor (e.g., stealing secrets or credentials). - The attacker then moves the
2.37.1tag to point to a malicious commit with their backdoor code. - The next time your workflow runs, it checks out
uses: shivammathur/setup-php@2.37.1, which now resolves to the attacker's compromised code instead of the original. - The backdoor executes during your build step—for example, exfiltrating
${{ secrets.GITHUB_TOKEN }}that's available in the workflow environment, allowing the attacker to push malicious code to your repository.
Pinning to an immutable commit SHA (like @abc123def456...) ensures that even if the tag is moved, your workflow always runs the exact code you verified.
To resolve this comment:
✨ Commit fix suggestion
| uses: shivammathur/setup-php@2.37.1 | |
| - name: Setup PHP Action | |
| # Replace the placeholder below with the verified full 40-character commit SHA for shivammathur/setup-php release 2.37.1 from the action's GitHub tag/release page. | |
| uses: shivammathur/setup-php@<full-40-character-commit-sha-for-2.37.1> | |
| with: | |
| php-version: ${{ matrix.php }} | |
| id: php | |
| - name: Setup PHP | |
| # Replace the placeholder below with the verified full 40-character commit SHA for shivammathur/setup-php release 2.37.1 from the action's GitHub tag/release page. | |
| uses: shivammathur/setup-php@<full-40-character-commit-sha-for-2.37.1> | |
| with: | |
| php-version: '8.1' | |
| id: php |
View step-by-step instructions
- Replace the third-party action reference
shivammathur/setup-php@2.37.1with a full 40-character commit SHA that corresponds to the2.37.1release, for exampleshivammathur/setup-php@<full-commit-sha>. - Keep the same action name and inputs, and only change the value after
@. This makes the workflow use an immutable action revision instead of a mutable tag. - Get the correct SHA from the action's GitHub release or tag page for version
2.37.1, and pin both occurrences shown here:uses: shivammathur/setup-php@<full-commit-sha>in the test jobuses: shivammathur/setup-php@<full-commit-sha>in the deploy job
- Avoid short SHAs or version tags such as
@v2,@main, or@2.37.1, because they can be moved to a different commit later.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by third-party-action-not-pinned-to-commit-sha.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
|
|
||
| - name: Setup PHP Action | ||
| uses: shivammathur/setup-php@2.15.0 | ||
| uses: shivammathur/setup-php@2.37.1 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Action is pinned to a mutable version tag instead of an immutable commit SHA, allowing attackers to inject malicious code if they compromise the repository.
More details about this
The GitHub Action shivammathur/setup-php is pinned to a version tag (2.37.1) instead of a full commit SHA. This creates a security risk because tags can be re-pushed or overwritten by an attacker who gains access to the repository.
Here's how an attacker could exploit this:
- The attacker gains write access to the
shivammathur/setup-phprepository (through credential theft, social engineering, or compromised CI/CD access) - They inject malicious code into the action (for example, adding a reverse shell or credential stealer into the PHP setup script)
- They force-push the
2.37.1tag to point to their malicious commit instead of the original one - The next time your workflow runs, GitHub Actions fetches the tag
2.37.1and downloads the attacker's malicious version - The malicious code executes in your CI/CD pipeline with access to your repository secrets (like
GITHUB_TOKEN) and can steal credentials, inject backdoors into your code, or compromise your build artifacts
Using a full commit SHA (e.g., uses: shivammathur/setup-php@a1e9c3c1d7e8b9f7e8c5d4a2b1c9d8e7f6a5b4c3) makes the reference immutable—even if someone re-pushes the tag, your workflow will continue using the exact commit you specified.
To resolve this comment:
✨ Commit fix suggestion
| uses: shivammathur/setup-php@2.37.1 | |
| # TODO: Replace the placeholder below with the verified full 40-character commit SHA that the 2.37.1 tag points to in shivammathur/setup-php. | |
| # Example format: | |
| # uses: shivammathur/setup-php@0123456789abcdef0123456789abcdef01234567 | |
| uses: shivammathur/setup-php@REPLACE_WITH_VERIFIED_40_CHAR_COMMIT_SHA |
View step-by-step instructions
- Replace
shivammathur/setup-php@2.37.1with a full 40-character commit SHA for the exact action release you want to keep using. - Update each
uses:entry for this action in the workflow, for example changeuses: shivammathur/setup-php@2.37.1touses: shivammathur/setup-php@<full-40-char-commit-sha>. - Get the SHA from the
shivammathur/setup-phprepository by finding the commit that the2.37.1tag points to, and copy the full commit hash instead of the version tag. This makes the workflow use an immutable action revision. - Keep the rest of the step unchanged, including
with:andid:values, so only the action reference changes.
Alternatively, if you want to upgrade while fixing this, pin to the full commit SHA for a newer trusted release instead of the SHA behind 2.37.1.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by third-party-action-not-pinned-to-commit-sha.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
|
|
||
| - name: Setup PHP | ||
| uses: shivammathur/setup-php@2.15.0 | ||
| uses: shivammathur/setup-php@2.37.1 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Actions step uses a mutable semantic version tag (2.37.1) instead of a pinned commit SHA, allowing the action owner to silently inject malicious code into your workflow.
More details about this
The workflow uses shivammathur/setup-php@2.37.1, which pins to a semantic version tag instead of a specific commit SHA. An attacker who controls the shivammathur/setup-php repository could force-push the 2.37.1 tag to point to malicious code without warning.
Exploit scenario:
- An attacker gains control of the
shivammathur/setup-phprepository (or the maintainer's account gets compromised) - They force-push the
2.37.1tag to a new commit containing a backdoor that exfiltrates${{ secrets.GITHUB_TOKEN }} - Your workflow runs and fetches the updated tag, executing the malicious action
- The attacker uses the stolen token to push code to your repository or access other secrets
- This could be repeated across thousands of projects using this action, as happened with the trivy-action and kics-github-action compromises
The version tag 2.37.1 is mutable—it can be repointed by the repository owner at any time, making it unsafe for supply-chain security.
To resolve this comment:
✨ Commit fix suggestion
| uses: shivammathur/setup-php@2.37.1 | |
| # TODO: Replace the placeholder below with the verified 40-character commit SHA for shivammathur/setup-php tag 2.37.1 from the action's release/tag page. | |
| uses: shivammathur/setup-php@<FULL_40_CHARACTER_COMMIT_SHA> # 2.37.1 |
View step-by-step instructions
- Replace the mutable action reference
shivammathur/setup-php@2.37.1with a full 40-character commit SHA for the same release, for exampleshivammathur/setup-php@<full-commit-sha> # 2.37.1. - Keep the version as a YAML comment after the SHA so the pinned release is still easy to identify, such as
uses: shivammathur/setup-php@<full-commit-sha> # 2.37.1. - Get the correct SHA from the action's release or tag page before updating the workflow. Pinning to a commit SHA prevents the tag from being silently moved to different code later.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
|
|
||
| - name: Setup PHP Action | ||
| uses: shivammathur/setup-php@2.15.0 | ||
| uses: shivammathur/setup-php@2.37.1 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Actions step uses a mutable version tag (@2.37.1) that can be repointed to malicious code, allowing supply-chain attacks. Pin to a full commit SHA instead.
More details about this
The Setup PHP Action step references the shivammathur/setup-php action using a mutable version tag (@2.37.1) instead of a pinned commit SHA.
Attack scenario:
- An attacker compromises the
shivammathur/setup-phprepository or the maintainer's account. - The attacker re-tags the
2.37.1release to point to a malicious commit that injects code (e.g., stealing secrets from the environment, exfiltrating source code, or modifying build artifacts). - Your workflow runs and pulls the compromised action code. The action receives access to
${{ secrets.GITHUB_TOKEN }}and environment variables with sensitive data. - The malicious code executes during the
Setup PHPstep before any of your legitimate build steps run, giving it full access to your CI/CD environment. - The attacker can steal credentials, modify your compiled output, or inject backdoors into your dependencies.
Even though 2.37.1 looks specific, the tag can be silently moved to a different commit at any time. This is how the trivy-action and kics-github-action compromises occurred in real attacks.
To resolve this comment:
✨ Commit fix suggestion
| uses: shivammathur/setup-php@2.37.1 | |
| name: Test and Deploy | |
| on: | |
| push: | |
| branches: [ '*' ] | |
| tags: [ '*' ] | |
| pull_request: | |
| branches: [ main ] | |
| schedule: | |
| # Run automatically at 8AM PST Monday-Friday | |
| - cron: '0 15 * * 1-5' | |
| workflow_dispatch: | |
| jobs: | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| strategy: | |
| matrix: | |
| php: [ '7.3', '7.4', '8.0', '8.1' ] | |
| dependencies: | |
| - "lowest" | |
| - "highest" | |
| steps: | |
| - name: Checkout smtpapi-php | |
| uses: actions/checkout@v2 | |
| - name: Setup PHP Action | |
| # NOTE: Replace the SHA below with the exact 40-character commit for shivammathur/setup-php v2.37.1 from the upstream release/tag page. | |
| uses: shivammathur/setup-php@<FULL_40_CHARACTER_COMMIT_SHA_FOR_V2_37_1> # v2.37.1 | |
| with: | |
| php-version: ${{ matrix.php }} | |
| id: php | |
| - name: Composer webhook config | |
| run: composer config -g github-oauth.github.com ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install dependencies | |
| run: composer install | |
| - name: Update Dependencies | |
| if: ${{ matrix.dependencies == 'lowest' }} | |
| run: composer update --prefer-lowest --prefer-stable -n | |
| - name: Run Tests | |
| run: make test | |
| deploy: | |
| name: Deploy | |
| if: success() && github.ref_type == 'tag' | |
| needs: [ test ] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout smtpapi-php | |
| uses: actions/checkout@v2 | |
| - name: Setup PHP | |
| # NOTE: Use the same exact pinned commit SHA as above for shivammathur/setup-php v2.37.1. | |
| uses: shivammathur/setup-php@<FULL_40_CHARACTER_COMMIT_SHA_FOR_V2_37_1> # v2.37.1 | |
| with: | |
| php-version: '8.1' | |
| id: php |
View step-by-step instructions
- Replace the mutable action reference with a full 40-character commit SHA for
shivammathur/setup-phpinstead of the version tag@2.37.1. - Keep the human-readable version as a comment after the SHA, for example:
uses: shivammathur/setup-php@<full-40-char-commit-sha> # v2.37.1 - Get the correct commit SHA from the
v2.37.1release page or tag in the action's repository, then use that exact SHA in the workflow. Pinning to a commit SHA prevents the tag from being moved to different code later. - Update the other
shivammathur/setup-php@2.37.1step in this workflow the same way so both job steps use the same pinned commit.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
Need help with this issue? Consult our Semgrep Findings Documentation or ask in #help-appsec on Slack.
You can view more details about this finding in the Semgrep AppSec Platform.
Bumps shivammathur/setup-php from 2.15.0 to 2.37.1.
Release notes
Sourced from shivammathur/setup-php's releases.
... (truncated)
Commits
7c071dfBump version to 2.37.1eeef37eGHSA-pqwm-q9pv-ph8r - Fix CWE-78 [skip ci]0dc3306Fix phalcon5 support on Windows680a983Fix phalcon version for PHP 8.0 [skip ci]694649aFix mutable tool cache restore46a991bMerge pull request #1081 from Pyker/patch-17748c24GHSA-f9f8-rm49-7jv2: Fix GitHub auth handling for composer in affected versionsac9c953Fix composer v2 version in README7729e41Improve enabling gearman [skip ci]af2322bFix fallback in Install-PSPackage on WindowsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.