Skip to content

build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 #98

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 #98

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,4 +30,4 @@ jobs:
run: python -m build

- name: Publish package
uses: pypa/[email protected].0
uses: pypa/[email protected].2

@semgrep-app-olist semgrep-app-olist Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

pypa/[email protected] is a mutable tag, so a moved tag could make this release job run attacker-controlled code with PyPI publish access.

More details about this

Publish package runs pypa/[email protected], which is a tag, not a full 40-character commit SHA. If the v1.14.2 tag is ever moved to different code, this release workflow would automatically run that new code with this job’s id-token: write permission when a GitHub release is published.

A plausible attack looks like this:

  1. An attacker compromises the pypa/gh-action-pypi-publish repository or the maintainer account that controls the v1.14.2 tag.
  2. They repoint v1.14.2 to a malicious commit that still looks like the real publish action.
  3. When someone publishes a release, the deploy job reaches uses: pypa/[email protected] and pulls the attacker’s code instead of the code you previously reviewed.
  4. That malicious action runs inside your workflow after Build package and can read the built distribution files, the repository checkout from actions/checkout, and the job’s OIDC token access from permissions: id-token: write.
  5. The attacker could then use that access to publish a tampered package to PyPI under your project name, for example a backdoored olist-loafer release that downstream users would install.

Because the reference is mutable, the code executed during release can change without any change in this repository.

To resolve this comment:

✨ Commit fix suggestion

Suggested change
uses: pypa/[email protected]
uses: pypa/gh-action-pypi-publish@8ade135a41bc03ea155e62e844d188df1ea18608 # v1.14.2
View step-by-step instructions

  1. Replace the mutable action tag with a full 40-character commit SHA in the uses line for the publish step.
    Change uses: pypa/[email protected] to uses: pypa/gh-action-pypi-publish@<full-40-character-commit-sha>.

  2. Get the SHA from the pypa/gh-action-pypi-publish repository release or tag that you intend to trust, and make sure it is the exact commit behind v1.14.2.
    The final value should look like uses: pypa/gh-action-pypi-publish@8ade135a41bc03ea155e62e844d188df1ea18608.

  3. Keep the version in a comment next to the SHA if you want the workflow to stay readable.
    For example, use uses: pypa/gh-action-pypi-publish@<full-40-character-commit-sha> # v1.14.2. Pinning to a commit prevents the action owner from silently moving the tag to different code later.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

You can view more details about this finding in the Semgrep AppSec Platform.