Skip to content

[CJS-13028] Migrate Node 12 → 22.23.4 + runtime bump (CVE-2026-111497) #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Grant Matthews (grantmatthews18) wants to merge 1 commit into from
Closed

[CJS-13028] Migrate Node 12 → 22.23.4 + runtime bump (CVE-2026-111497) #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 7 additions & 20 deletions .github/workflows/run_tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,30 +1,17 @@
# This workflow will do a clean install of node dependencies and run tests on the version of Node specified
# in the .nvmrc file.
# Reference: https://docs.github.com/en/actions/language-and-framework-guides/github-actions-for-javascript-and-typescript

name: Run Tests

on:
push:
branches: [ main ]
branches: [main]
pull_request:

jobs:
test:
runs-on: ubuntu-latest

steps:
- name: Checkout branch
uses: actions/checkout@v2

- name: Read .nvmrc
run: echo ::set-output name=NVMRC::$(cat .nvmrc)
id: nvm

- name: Setup Node
uses: actions/setup-node@v1
with:
node-version: '${{ steps.nvm.outputs.NVMRC }}'

- run: npm ci
- run: npm test
- uses: actions/checkout@v4

@arnica-github-connector arnica-github-connector Bot Oct 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Static Code Analysis Risk: Software and Data Integrity Failures - GitHub actions artipacked vulnerability

By default, actions/checkout persists a GitHub token in the checked-out repository's .git/config file so subsequent git operations can authenticate. This token typically has write access to repository contents. The credential remains on the runner filesystem for all subsequent steps, meaning a compromised or malicious step could exfiltrate it. Additionally, if an actions/upload-artifact step packages the workspace -- including the .git directory -- into an artifact, the credential becomes downloadable by anyone with access. While the default GITHUB_TOKEN expires after the workflow run completes, this pattern is especially dangerous when a repository configures long-lived credentials such as personal access tokens (PATs) or deploy keys, which would remain valid well beyond the run.

Recommendation: Add persist-credentials: false in a with block directly under the actions/checkout uses line to prevent the token from being written to .git/config. If later steps need authenticated git operations, pass the token as a step-level environment variable (e.g., env: with GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}) rather than persisting it in the repository config where every subsequent step can access it.

Severity: Medium ⚠️
Status: Open 🔴

References:

  1. https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens/

More details:

🌻 View in Arnica

Take action by replying with an [arnica] command 💬

Actions

Use [arnica] or [a] to interact with the Arnica bot to acknowledge or dismiss code risks.

To acknowledge the finding as a valid code risk: [arnica] ack <acknowledge additional details>

To dismiss the risk with a reason: [arnica] dismiss <fp|accept|capacity> <dismissal reason>

Examples

  • [arnica] ack This is a valid code risk and I'm looking into it

  • [arnica] dismiss fp Dismissed - Risk Not Accurate: (i.e. False Positive)

  • [arnica] dismiss accept Dismiss - Risk Accepted: Allow the risk to exist in the system

  • [arnica] dismiss capacity Dismiss - No Capacity: This will need to wait for a future sprint

- uses: actions/setup-node@v4
with:
node-version-file: '.nvmrc'
- run: npm ci
- run: npm test
2 changes: 1 addition & 1 deletion .nvmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
12
22.23.4
2 changes: 1 addition & 1 deletion action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,5 +52,5 @@ outputs:
error_reason:
description: 'Set to error reason if upload fails'
runs:
using: 'node12'
using: 'node20'
main: 'dist/index.js'
Loading
Loading