build(deps): bump actions/setup-node from 6.4.0 to 7.0.0

[dependabot]

Bumps actions/setup-node from 6.4.0 to 7.0.0.

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[semgrep-code-wireapp]

Semgrep identified an issue in your code:

GitHub Actions step actions/setup-node@v7.0.0 uses a mutable tag that could be repointed by a malicious actor to inject backdoored code into your build and deployment pipeline.

More details about this

The actions/setup-node@v7.0.0 step uses a mutable semantic version tag (v7.0.0) instead of a pinned commit SHA. Since v7.0.0 is just a tag, the maintainer of actions/setup-node can repoint it to a different commit at any time without warning.

Exploit scenario:

1. An attacker compromises the GitHub account of the actions/setup-node maintainer or gains write access to their repository.
2. The attacker moves the v7.0.0 tag to point to a malicious commit that contains backdoored Node.js setup logic.
3. Your workflow runs and executes uses: actions/setup-node@v7.0.0, which now silently pulls the attacker's malicious commit.
4. The malicious action exfiltrates your id-token (which you explicitly granted write permission to via permissions: id-token: write), allowing the attacker to assume your repository's identity and publish compromised packages to npm or modify your release.
5. Your npm package gets published with backdoored code, affecting all downstream users who install it.

This mirrors real attacks like the 2023 compromises of trivy-action and kics-github-action.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	uses: actions/setup-node@v7.0.0
	uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v7.0.0

View step-by-step instructions

1. Replace the mutable action reference with a full 40-character commit SHA in the matched step.
   Change uses: actions/setup-node@v7.0.0 to uses: actions/setup-node@<full-commit-sha> # v7.0.0.

2. Pin the SHA to the exact commit for the v7.0.0 release from the action’s GitHub repository, not a short SHA and not the tag alone.
   This prevents the action from changing if the tag is later moved.

3. Keep the version as an inline comment after the SHA, such as # v7.0.0, so the pinned release is still easy to track during future updates.

4. If this workflow also uses other third-party actions with tag-based references in nearby steps, pin those the same way, for example uses: actions/checkout@<full-commit-sha> # v7.0.0.

Alternatively, if you need to update to a newer action release, pin that newer release’s commit SHA instead of using a version tag like @v7.0.0 directly.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[semgrep-code-wireapp]

Semgrep identified an issue in your code:

GitHub Actions step uses mutable version tag v7.0.0, allowing the action maintainer to silently redirect the tag to malicious code.

More details about this

The GitHub Actions step references actions/setup-node@v7.0.0, which uses a semantic version tag. Version tags like v7.0.0 can be silently repointed by the action maintainer at any time, meaning an attacker who compromises the actions/setup-node repository could move the v7.0.0 tag to point to a malicious commit.

Here's how this attack would work:

1. An attacker gains access to the actions/setup-node repository (through compromised credentials or social engineering)
2. The attacker modifies the commit at the v7.0.0 tag to inject malicious code—for example, code that exfiltrates ${{ secrets.GITHUB_TOKEN }} or environment variables
3. Your workflow runs and executes uses: actions/setup-node@v7.0.0, which now runs the attacker's malicious code
4. The attacker can access your repository secrets, modify your code, or compromise your build artifacts
5. You don't notice because the tag name appears unchanged—it's just silently pointing to the compromised commit

This is a real threat: the trivy-action and kics-github-action projects were both compromised this way. The tag you're using should be pinned to a specific 40-character commit SHA (like actions/setup-node@8ade135a41bc03ea155e62e844d188df1ea18608) so the exact code executed is immutable and controlled by you, not the maintainer.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	uses: actions/setup-node@v7.0.0
	uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v7.0.0

View step-by-step instructions

1. Replace the mutable version tag in the uses line with the full 40-character commit SHA for the same actions/setup-node release.
   Change uses: actions/setup-node@v7.0.0 to uses: actions/setup-node@<40-character-commit-sha> # v7.0.0.

2. Keep the version as an inline comment after the SHA so future updates are easier to track, for example uses: actions/setup-node@<sha> # v7.0.0.

3. Get the correct SHA from the actions/setup-node release or commit page, and make sure the value after @ is exactly 40 lowercase hex characters. Pinning to a commit SHA prevents the action owner from silently moving the referenced version to different code.

Alternatively, if you need to stay on a newer action release, update to that release first and then pin that exact release’s commit SHA instead of using the tag directly.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

_{You can view more details about this finding in the Semgrep AppSec Platform.}