harden: github actions step uses a mutable tag or branc... in...

[anupamme]

Summary

Harden input handling in plugins/sapui5-linter/skills/sapui5-linter/templates/github-actions-lint.yml (flagged by semgrep).

Vulnerability

Field	Value
ID	yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
Severity	HIGH
Scanner	semgrep
Rule	yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
File	plugins/sapui5-linter/skills/sapui5-linter/templates/github-actions-lint.yml:27
Assessment	Defensive hardening

Description: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Threat Model Context

This is a private Node.js application (not published to npm). Vulnerabilities affect this application's own runtime only.

Changes

• plugins/sapui5-linter/skills/sapui5-linter/templates/github-actions-lint.yml

Behavior Preservation

The change is scoped to 1 file on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

This patch removes an exploit primitive — a code pattern that, while not independently exploitable today, could be chained with other weaknesses by automated exploit-development tooling. Proactive removal of such primitives raises the bar against increasingly capable automated attack tools.

---

Automated security fix by OrbisAI Security

Summary by CodeRabbit

• Security & Maintenance
  • Improved GitHub Actions workflow security by pinning third-party actions to immutable commit versions.
  • Added version comments to make the pinned action releases easier to identify and maintain.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d2e3dfd1-4ab7-4bf0-8bf3-bcd6c40e8c62

📥 Commits

Reviewing files that changed from the base of the PR and between fd81fb7 and 624d6d2.

📒 Files selected for processing (1)

• plugins/sapui5-linter/skills/sapui5-linter/templates/github-actions-lint.yml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

The lint workflow template now pins GitHub Actions to full commit SHAs. Version comments identify the pinned action releases.

Changes

GitHub Actions pinning

Layer / File(s)	Summary
Pin workflow actions plugins/sapui5-linter/skills/sapui5-linter/templates/github-actions-lint.yml	The workflow pins actions/checkout, actions/setup-node, and both actions/upload-artifact steps to full commit SHAs with version comments.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: 🔵 Low · up to 624d6

The workflow now uses immutable commits instead of mutable action tags, reducing the chance that upstream tag changes alter CI code unexpectedly. The PR is mergeable with owner awareness that the selected commits should be verified against the intended official releases.

Suggested reviewers: secondsky

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title identifies the GitHub Actions mutable-reference security issue, but it is truncated and incomplete. The title does not clearly state that the action references are pinned to commit SHAs.	Replace the truncated title with a complete, concise title such as "harden: pin GitHub Actions to commit SHAs".

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}