Dummy gated release

[shrutiburman]

Fixes

A short description of what this PR does.

Checklist

• I acknowledge that all my contributions will be made under the project's license
• I have made a material change to the repo (functionality, testing, spelling, grammar)
• I have read the Contribution Guidelines and my PR follows them
• I have titled the PR appropriately
• I have updated my branch with the main branch
• I have added tests that prove my fix is effective or that my feature works
• I have added the necessary documentation about the functionality in the appropriate .md file
• I have added inline documentation to the code I modified

If you have questions, please file a support ticket, or create a GitHub Issue in this repository.

[semgrep-code-twilio]

Semgrep identified an issue in your code:

GitHub Actions step uses mutable version tag v5 instead of a pinned commit SHA, allowing the action owner to silently inject malicious code on the next workflow run.

More details about this

The step uses: actions/setup-python@v5 references the setup-python action using a mutable version tag (v5), which can be silently repointed by the action's maintainer without your knowledge.

Attack scenario:

1. An attacker compromises the GitHub account of the setup-python action maintainer or the repository itself
2. They force-push a malicious commit and retag v5 to point to this compromised version
3. The next time your workflow runs, GitHub checks out the updated v5 tag—now pointing to the attacker's code
4. The malicious setup-python action executes with your job's credentials and environment variables (including ARTIFACTORY_URL and id-token)
5. The attacker steals credentials, injects malware into your Python environment, or exfiltrates your code

This mirrors real attacks like the 2023 trivy-action compromise, where a retagged version caused widespread supply-chain damage.

Pin this to a specific commit SHA (e.g., actions/setup-python@8ade135a41bc03ea155e62e844d188df1ea18608) so only that exact code executes.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	- uses: actions/setup-python@v5
	- uses: actions/setup-python@42375524ee3024772b628e6502261f4095c0c007 # v5
	with:
	python-version: ${{ matrix.python-version }}
	- uses: actions/setup-python@42375524ee3024772b628e6502261f4095c0c007 # v5
	with:
	python-version: "3.12"

View step-by-step instructions

1. Replace the mutable GitHub Action tag with a full 40-character commit SHA in the uses line for actions/setup-python.
   Change actions/setup-python@v5 to actions/setup-python@<full-40-character-commit-sha>, for example actions/setup-python@<sha> # v5.

2. Keep the version as a comment after the SHA so the workflow stays readable and future updates are easier.
   Use the format uses: actions/setup-python@<sha> # v5.

3. Apply the same change to each occurrence of this action in the workflow, since both jobs currently use actions/setup-python@v5.

4. Get the correct commit SHA from the official actions/setup-python release for v5, and pin to that exact commit instead of the tag name. Pinning to a commit SHA prevents the action reference from being silently changed later.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

Need help with this issue? Consult our appsec team or ask in #help-appsec on Slack.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[semgrep-code-twilio]

Semgrep identified an issue in your code:

Mutable version tag on actions/checkout@v4 could be silently updated to malicious code by an attacker who gains control of the repository, compromising your workflow execution.

More details about this

The step uses actions/checkout@v4, which pins to a mutable version tag instead of a specific commit SHA. An attacker who gains control of the actions/checkout repository could update the v4 tag to point to malicious code. When your workflow runs, GitHub would automatically fetch and execute this compromised version without any notification.

For example, if an attacker pushed malicious code to actions/checkout and moved the v4 tag to that commit, the next time this workflow runs it would:

1. Execute the attacker's code in the uses: actions/checkout@v4 step
2. Have access to your repository's code via the fetch-depth: 0 checkout
3. Potentially exfiltrate secrets, modify your source code, or inject backdoors

This is a supply-chain attack vector that was exploited in real incidents like the trivy-action and kics-github-action compromises.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	- uses: actions/checkout@v4
	name: Test Release (Dry Run)
	on:
	workflow_dispatch:
	inputs:
	python-version:
	description: "Python version to test with (or 'all' for full matrix)"
	required: false
	default: "3.12"
	env:
	ARTIFACTORY_URL: ${{ vars.ARTIFACTORY_URL }}
	jobs:
	test:
	name: Test - Python ${{ matrix.python-version }}
	runs-on: ${{ github.repository_owner == 'twilio-internal' && 'ubuntu-x64' || 'ubuntu-latest' }}
	timeout-minutes: 20
	permissions:
	contents: read
	id-token: write
	strategy:
	fail-fast: false
	matrix:
	python-version: ${{ github.event.inputs.python-version == 'all' && fromJson('["3.8","3.9","3.10","3.11","3.12","3.13"]') || fromJson(format('["{0}"]', github.event.inputs.python-version)) }}
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
	with:
	fetch-depth: 0
	- name: Authenticate with Artifactory
	uses: ./.github/actions/artifactory-oidc
	- uses: actions/setup-python@v5
	with:
	python-version: ${{ matrix.python-version }}
	- name: Install dependencies
	run: |
	pip install virtualenv --upgrade
	make install test-install
	- name: Run tests
	run: make test-with-coverage
	deploy-dry-run:
	name: Deploy (Dry Run - No Publish)
	needs: [test]
	runs-on: ${{ github.repository_owner == 'twilio-internal' && 'ubuntu-x64' || 'ubuntu-latest' }}
	environment: pypi
	permissions:
	contents: read
	id-token: write
	attestations: write
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

View step-by-step instructions

1. Replace the mutable GitHub Action tag with a full 40-character commit SHA in the uses value.
   Change actions/checkout@v4 to a pinned commit such as actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.

2. Apply the same change to the other actions/checkout@v4 step in this workflow so both checkout steps use a commit SHA instead of a version tag.

3. Keep the version comment after the SHA, for example # v4, so the pinned action version is still easy to identify. Pinning to a commit SHA prevents the action owner from silently changing what code runs under the same tag.

4. Leave the local action reference uses: ./.github/actions/artifactory-oidc unchanged, because local actions are not pinned through remote Git references.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

Need help with this issue? Consult our appsec team or ask in #help-appsec on Slack.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[semgrep-code-twilio]

Semgrep identified an issue in your code:

GitHub Actions step uses mutable version tag v4 instead of immutable commit SHA, allowing maintainer updates to silently change executed code and enabling supply-chain attacks.

More details about this

The actions/checkout@v4 step uses a mutable version tag instead of pinning to a specific commit. Version tags like v4 can be silently repointed by the action's maintainer without your knowledge. An attacker who compromises the actions/checkout repository could update the v4 tag to point to malicious code, which would then execute in your workflow.

Here's a concrete attack scenario:

1. An attacker compromises GitHub's actions/checkout repository
2. They update the v4 tag to point to a new commit containing malicious code (e.g., stealing secrets from $GITHUB_ENV or exfiltrating repository contents)
3. The next time your workflow runs with uses: actions/checkout@v4, the malicious version executes automatically
4. The attacker now has access to your repository's environment variables, source code, and credentials used during the workflow
5. This matches real-world supply chain attacks like the trivy-action and kics-github-action compromises mentioned in security advisories

The same risk applies to actions/setup-python@v5 and any other action using mutable references elsewhere in your workflow.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	- uses: actions/checkout@v4
	- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

View step-by-step instructions

1. Replace the mutable GitHub Action reference uses: actions/checkout@v4 with a full 40-character commit SHA for the same action version, for example uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.
2. Keep the existing with: settings such as fetch-depth: 0 exactly as they are, and only change the value after uses:.
3. Apply the same pinning format to the other flagged actions/checkout step in this workflow if it also uses @v4 instead of a commit SHA. Pinning to a commit SHA prevents the action owner from silently changing what code runs for that version tag.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

Need help with this issue? Consult our appsec team or ask in #help-appsec on Slack.

_{You can view more details about this finding in the Semgrep AppSec Platform.}