ref-confusion in setup-task

[philpennock]

This is probably me being stupid, but I'm confused by a ref-confusion complaint I get.
(zizmor --version says zizmor 1.3.0, was installed via cargo install --locked zizmor)

If we have a GitHub Actions step:

      - name: Install Task
        uses: arduino/setup-task@v2

then with GH_TOKEN defined, we get:

warning[ref-confusion]: git ref for action with ambiguous ref type
  --> .github/workflows/export-dashboards.yml:25:9
   |
25 |         uses: arduino/setup-task@v2
   |         --------------------------- uses a ref that's provided by both the branch and tag namespaces
   |
   = note: audit confidence → High

(And no, we're not pinning actions to specific checksums, we're not set up to be tracking and getting security updates if we do that, so do not yet intend to make that switch.)

When I check in that arduino/setup-task action repo, there are branches v1 and v2 and git tag -l has:

1.0.2
v1.0.0
v1.0.1
v1.0.3
v2.0.0

So I'm confused about where the ref confusion is coming from. AFAICT, @v2 must be a branch in refs/heads/ and can't be in refs/tags/

What am I missing, please?

[woodruffw]

Hmm, that's interesting. That might be a false positive, or a quirk of GitHub's tags API - I can see that you only have v2 as a branch so there should be no finding here. I'll be able to triage this more tonight.

[philpennock]

Thanks, that's reassuring. For clarity, we are downstream unrelated consumers of this third-party task and folks decided to trust the arduino community as stewards rather than making our own installer (but we have a related TODO to fix it). So I can't do anything about tags in the action we're depending upon.

[woodruffw]

No problem! I was able to reproduce this locally and it does look like GitHub's tags API genuinely being funky:

Branch:

$ gh api /repos/arduino/setup-task/git/ref/heads/v2

{
  "ref": "refs/heads/v2",
  "node_id": "MDM6UmVmMzYzNTg5ODA2OnJlZnMvaGVhZHMvdjI=",
  "url": "https://api.github.com/repos/arduino/setup-task/git/refs/heads/v2",
  "object": {
    "sha": "b91d5d2c96a56797b48ac1e0e89220bf64044611",
    "type": "commit",
    "url": "https://api.github.com/repos/arduino/setup-task/git/commits/b91d5d2c96a56797b48ac1e0e89220bf64044611"
  }
}

Tag:

$ gh api /repos/arduino/setup-task/git/refs/tags/v2

[
  {
    "ref": "refs/tags/v2.0.0",
    "node_id": "MDM6UmVmMzYzNTg5ODA2OnJlZnMvdGFncy92Mi4wLjA=",
    "url": "https://api.github.com/repos/arduino/setup-task/git/refs/tags/v2.0.0",
    "object": {
      "sha": "24c5e13bce349197642746563945fcdf9355e8f4",
      "type": "tag",
      "url": "https://api.github.com/repos/arduino/setup-task/git/tags/24c5e13bce349197642746563945fcdf9355e8f4"
    }
  }
]

So in this case, it looks like GitHub does some string/prefix matching on their end, and returns the v2.0.0 tag even though I've only asked it for v2.

I don't really understand why that is, although it might be because /{owner}/{repo}/git/refs/{ref} is a legacy undocumented alias for the "matching references" API, whereas /{owner}/{repo}/git/ref/{ref} is intended for exact lookups.

A quick try supports that theory:

$ gh api /repos/arduino/setup-task/git/ref/tags/v2.0.0

{
  "ref": "refs/tags/v2.0.0",
  "node_id": "MDM6UmVmMzYzNTg5ODA2OnJlZnMvdGFncy92Mi4wLjA=",
  "url": "https://api.github.com/repos/arduino/setup-task/git/refs/tags/v2.0.0",
  "object": {
    "sha": "24c5e13bce349197642746563945fcdf9355e8f4",
    "type": "tag",
    "url": "https://api.github.com/repos/arduino/setup-task/git/tags/24c5e13bce349197642746563945fcdf9355e8f4"
  }
}

TL;DR: The current ref-confusion audit is possibly using the GitHub API incorrectly. I'll be able to confirm that in a bit; if so the fix should be pretty simple!

[woodruffw]

I've opened this as a bug with #518.