Skip to content

Commit e47d165

Browse files
AntonioVentiliigithub-actions[bot]bitdivine
authored
fix(devops): do not persist credentials in checkout action (#5543)
# Motivation An apparently known security issue of `actions/checkout` is the default of `persist-credentials` set to `true`. It was requested to the Github developers to change it (see actions/checkout#485), but it does not seem that it is a plan in the short-terms. So, for now we solve it our way. # Changes - Set `persist-credentials` to `false` in all the uses of `actions/checkout`. - Created new action to `add-and-commit` since the existing `EndBug/add-and-commit` one does not work well if we do not persist the credentials according to [documentation](https://github.com/EndBug/add-and-commit?tab=readme-ov-file#about-actionscheckout) (see EndBug/add-and-commit#673 too). # Tests CIs work as they are supposed to. --------- Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Max <bitdivine@users.noreply.github.com>
1 parent 8625cc0 commit e47d165

19 files changed

+125
-14
lines changed

‎.github/actions/add-and-commit/action.yml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Add and Commit
2+
description: Set git remote and commit changes (e.g., formatting)
3+
4+
inputs:
5+
add:
6+
description: Files to add
7+
required: false
8+
default: '.'
9+
message:
10+
description: Commit message
11+
required: true
12+
token:
13+
description: GitHub token
14+
required: true
15+
16+
runs:
17+
using: 'composite'
18+
steps:
19+
- name: Set git remote silently and locally
20+
run: |
21+
git config url."https://github-actions:$GITHUB_TOKEN@github.com/".insteadOf "https://github.com/"
22+
env:
23+
GITHUB_TOKEN: ${{ inputs.token }}
24+
shell: bash
25+
26+
- name: Commit format
27+
uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
28+
with:
29+
add: ${{ inputs.add }}
30+
default_author: github_actions
31+
message: ${{ inputs.message }}
32+
33+
- name: Unset local git remote config
34+
run: |
35+
git config --unset-all url."https://github-actions:${GITHUB_TOKEN}@github.com/".insteadOf || true
36+
git config --unset-all url."https://github.com/".insteadOf || true
37+
env:
38+
GITHUB_TOKEN: ${{ inputs.token }}
39+
shell: bash

‎.github/workflows/auto-update-i18n.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ jobs:
2626
repository: ${{ github.event.pull_request.head.repo.full_name }}
2727
ref: ${{ github.event.pull_request.head.ref }}
2828
token: ${{ steps.app-token.outputs.token }}
29+
persist-credentials: false
2930

3031
- name: Prepare
3132
uses: ./.github/actions/prepare
@@ -44,8 +45,7 @@ jobs:
4445
4546
- name: Commit i18n
4647
if: steps.check_changes.outputs.changes_detected == 'true'
47-
uses: EndBug/add-and-commit@v9
48+
uses: ./.github/actions/add-and-commit
4849
with:
49-
add: .
50-
default_author: github_actions
5150
message: '🤖 Updated i18n files'
51+
token: ${{ steps.app-token.outputs.token }}

‎.github/workflows/backend-checks.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ jobs:
2626
contents: read
2727
steps:
2828
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
29+
with:
30+
persist-credentials: false
2931
- uses: actions/cache@v4
3032
with:
3133
path: |
@@ -42,6 +44,8 @@ jobs:
4244
contents: read
4345
steps:
4446
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
47+
with:
48+
persist-credentials: false
4549
- run: sudo snap install yq
4650
- name: Dependencies are defined in the workspace
4751
run: ./scripts/lint.cargo-workspace-dependencies.sh
@@ -54,6 +58,8 @@ jobs:
5458
contents: read
5559
steps:
5660
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
61+
with:
62+
persist-credentials: false
5763
- uses: ./.github/actions/needs_success
5864
with:
5965
needs: '${{ toJson(needs) }}'

‎.github/workflows/backend-tests.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ jobs:
2727
steps:
2828
- name: Checkout
2929
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
30+
with:
31+
persist-credentials: false
3032

3133
- name: Build Base Docker Image
3234
uses: ./.github/actions/docker-build-base
@@ -45,6 +47,8 @@ jobs:
4547
steps:
4648
- name: Checkout
4749
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
50+
with:
51+
persist-credentials: false
4852

4953
- name: Build canister WASM
5054
uses: ./.github/actions/docker-build-backend
@@ -60,6 +64,8 @@ jobs:
6064
needs: ['docker-build']
6165
steps:
6266
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
67+
with:
68+
persist-credentials: false
6369

6470
- uses: actions/cache@v4
6571
with:
@@ -87,6 +93,8 @@ jobs:
8793
contents: read
8894
steps:
8995
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
96+
with:
97+
persist-credentials: false
9098
- uses: ./.github/actions/needs_success
9199
with:
92100
needs: '${{ toJson(needs) }}'

‎.github/workflows/binding-checks.yml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,13 @@ jobs:
3434
repository: ${{ github.event.pull_request.head.repo.full_name }}
3535
ref: ${{ github.event.pull_request.head.ref }}
3636
token: ${{ steps.app-token.outputs.token }}
37+
persist-credentials: false
3738

3839
- name: Checkout code
3940
if: steps.check_can_add_commit.outputs.can_add_commit == 'false'
4041
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
42+
with:
43+
persist-credentials: false
4144

4245
- uses: dorny/paths-filter@v3
4346
id: changes
@@ -106,11 +109,10 @@ jobs:
106109
107110
- name: Commit bindings
108111
if: steps.changes.outputs.src == 'true' && steps.check_can_add_commit.outputs.can_add_commit == 'true' && steps.check_changes.outputs.changes_detected == 'true'
109-
uses: EndBug/add-and-commit@v9
112+
uses: ./.github/actions/add-and-commit
110113
with:
111-
add: .
112-
default_author: github_actions
113114
message: '🤖 Apply bindings changes'
115+
token: ${{ steps.app-token.outputs.token }}
114116

115117
- name: Provide diff
116118
if: steps.changes.outputs.src == 'true' && steps.check_can_add_commit.outputs.can_add_commit == 'false' && steps.check_changes.outputs.changes_detected == 'true'
@@ -127,6 +129,8 @@ jobs:
127129
contents: read
128130
steps:
129131
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
132+
with:
133+
persist-credentials: false
130134
- uses: ./.github/actions/needs_success
131135
with:
132136
needs: '${{ toJson(needs) }}'

‎.github/workflows/bump-version.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ jobs:
3434

3535
- name: Checkout repository
3636
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
37+
with:
38+
persist-credentials: false
3739

3840
- name: Prepare
3941
uses: ./.github/actions/prepare

‎.github/workflows/deploy-to-environment.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ jobs:
118118
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
119119
with:
120120
fetch-depth: 2
121+
persist-credentials: false
121122

122123
- name: Set Environment Variables Based on Network
123124
run: |

‎.github/workflows/devops-checks.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ jobs:
1616
steps:
1717
- name: Checkout code
1818
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
19+
with:
20+
persist-credentials: false
1921

2022
- name: Install shellcheck
2123
run: ./scripts/setup shellcheck

‎.github/workflows/e2e-tests.yml

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ jobs:
2323
steps:
2424
- name: Checkout
2525
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
26+
with:
27+
persist-credentials: false
2628

2729
- name: Fetch base branch
2830
run: |
@@ -54,13 +56,16 @@ jobs:
5456
- name: Checkout
5557
if: ${{ github.event_name != 'pull_request' }}
5658
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
59+
with:
60+
persist-credentials: false
5761

5862
- name: Checkout for pull request
5963
if: ${{ github.event_name == 'pull_request' }}
6064
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
6165
with:
6266
repository: ${{ github.event.pull_request.head.repo.full_name }}
6367
ref: ${{ github.event.pull_request.head.ref }}
68+
persist-credentials: false
6469

6570
- name: Build oisy-backend WASM
6671
uses: ./.github/actions/oisy-backend
@@ -93,6 +98,8 @@ jobs:
9398
- name: Checkout
9499
if: ${{ github.event_name != 'pull_request' }}
95100
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
101+
with:
102+
persist-credentials: false
96103

97104
- name: Checkout for pull request
98105
if: ${{ github.event_name == 'pull_request' }}
@@ -101,6 +108,7 @@ jobs:
101108
repository: ${{ github.event.pull_request.head.repo.full_name }}
102109
ref: ${{ github.event.pull_request.head.ref }}
103110
token: ${{ steps.app-token.outputs.token }}
111+
persist-credentials: false
104112

105113
- name: Download WASM artifact
106114
uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
@@ -191,6 +199,8 @@ jobs:
191199
- name: Checkout
192200
if: ${{ github.event_name != 'pull_request' }}
193201
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
202+
with:
203+
persist-credentials: false
194204

195205
- name: Checkout for pull request
196206
if: ${{ github.event_name == 'pull_request' }}
@@ -199,6 +209,7 @@ jobs:
199209
repository: ${{ github.event.pull_request.head.repo.full_name }}
200210
ref: ${{ github.event.pull_request.head.ref }}
201211
token: ${{ steps.app-token.outputs.token }}
212+
persist-credentials: false
202213

203214
- name: Set snapshot status from previous jobs
204215
run: |
@@ -234,12 +245,12 @@ jobs:
234245
fi
235246
236247
- name: Commit and push updates
237-
uses: EndBug/add-and-commit@v9
248+
uses: ./.github/actions/add-and-commit
238249
if: env.FINAL_CHANGES == 'true' && github.ref != 'refs/heads/main'
239250
with:
240251
add: e2e
241-
default_author: github_actions
242252
message: '🤖 Update E2E snapshots'
253+
token: ${{ steps.app-token.outputs.token }}
243254

244255
- name: Stage Changes on main
245256
if: env.FINAL_CHANGES == 'true' && github.ref == 'refs/heads/main'

‎.github/workflows/formatting-checks.yml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,10 +46,13 @@ jobs:
4646
repository: ${{ github.event.pull_request.head.repo.full_name }}
4747
ref: ${{ github.event.pull_request.head.ref }}
4848
token: ${{ steps.app-token.outputs.token }}
49+
persist-credentials: false
4950

5051
- name: Checkout code
5152
if: steps.check_can_add_commit.outputs.can_add_commit == 'false'
5253
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
54+
with:
55+
persist-credentials: false
5356

5457
- name: Install rust
5558
uses: ./.github/actions/install-rust
@@ -77,11 +80,10 @@ jobs:
7780
7881
- name: Commit format
7982
if: steps.check_can_add_commit.outputs.can_add_commit == 'true' && steps.check_changes.outputs.changes_detected == 'true'
80-
uses: EndBug/add-and-commit@v9
83+
uses: ./.github/actions/add-and-commit
8184
with:
82-
add: .
83-
default_author: github_actions
8485
message: '🤖 Apply formatting changes'
86+
token: ${{ steps.app-token.outputs.token }}
8587

8688
- name: Provide diff
8789
if: steps.check_can_add_commit.outputs.can_add_commit == 'false' && steps.check_changes.outputs.changes_detected == 'true'

0 commit comments

Comments
 (0)