SecOps #1389: [Sécurité] Vulnérabilité de code : .github/workflows/go.yml:35 (yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag) - Qwarks Connect - Redmine

Actions

SecOps #1389

open

[Sécurité] Vulnérabilité de code : .github/workflows/go.yml:35 (yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag)

SecOps #1389: [Sécurité] Vulnérabilité de code : .github/workflows/go.yml:35 (yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag)

Added by Client Dashboard 20 days ago. Updated 11 days ago.

Status:

Submitted

Priority:

Normal

Assignee:

Start date:

07/15/2026

Due date:

% Done:

Estimated time:

spec_ref:

build_status:

build_number:

ci_run_url:

scan_status:

scan_report_url:

deploy_status:

preprod_url:

deployed_at:

branch:

pr_url:

security_key:

.github/workflows/go.yml:35_yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

severity:

medium

paused:

Description

**Sévérité** : MEDIUM
**Source** : Semgrep
`vuln-medium`
**Emplacement** : .github/workflows/go.yml:35
**Règle** : yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

### Extrait de code
```
requires login
```

### Lien CVE
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

CD Updated by Client Dashboard 20 days ago Actions
Copy link
#1

Vulnérabilité `.github/workflows/go.yml:35_yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).