Harden GitHub Actions: pin SHAs + persist-credentials#393
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughThis PR pins all third-party GitHub Actions across CI/CD, testing, deployment, and release workflows to specific commit SHAs instead of floating major version tags. The Fly composite action and most checkout steps are also hardened with ChangesGitHub Actions Workflow Hardening
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Release VersionsApp patch: ChangelogChanged
|
|
Updates to Preview Branch (harden-actions-pin-shas) ↗︎
Tasks are run on every commit but only new migration files are pushed.
View logs for this Workflow Run ↗︎. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Contributor
|
🐝 Review App Deployed Homepage: https://hover-pr-393.fly.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/fly-deploy.yml:
- Line 321: The workflow step using the 1password action (uses:
1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0)
currently allows the action to install the `op` CLI at runtime with an implicit
“latest” resolution; update each load-secrets-action step (the occurrences with
that exact uses string) to add a with: block that pins the CLI by adding
version: <pinned-op-version>, ensuring the action still uses the pinned action
SHA but also installs a fixed `op` CLI version.
In @.github/workflows/review-apps.yml:
- Line 77: The 1Password action step (uses:
1password/load-secrets-action@581a835f...) doesn't pin the underlying 1Password
CLI/tool version; update the step(s) that reference
1password/load-secrets-action (the uses entries at the two locations) to include
the action input that pins the CLI (e.g., add a with: op-version:
"<desired-cli-version>" or the action's documented equivalent input) and set the
same explicit CLI version value for both occurrences so the workflow resolves a
fixed 1Password CLI/tool version reproducibly.
In @.github/workflows/test-grafana-annotation.yml:
- Line 26: The workflow currently uses 1password/load-secrets-action which
leaves the `op` CLI unpinned; update the job steps to first install a pinned
`op` using the `1password/install-cli-action` with a specific `version` (e.g.,
set the desired semver) and only after that run `1password/load-secrets-action`
so it will use the already-installed CLI; ensure the install step appears before
the load-secrets step and keep the existing load-secrets `uses:
1password/load-secrets-action@581a835f...` but remove any expectation that it
pins `op`.
In @.github/workflows/test.yml:
- Line 152: The workflow uses the pinned action identifier
1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 but does
not pin the OP CLI binary; for each occurrence of this action (the steps that
include "uses:
1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0" and
"with: export-env: true") add a "with: version: <exact OP CLI version>" field
(e.g., version: 2.31.1) to ensure the installed op CLI is deterministic and
consistent across runs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 9a3a85ac-2708-4947-8ed1-b4378af72596
📒 Files selected for processing (11)
.github/actions/fly-setup/action.yml.github/workflows/auto-release.yml.github/workflows/changelog-check.yml.github/workflows/cleanup-orphaned-apps.yml.github/workflows/fly-deploy.yml.github/workflows/release-cli.yml.github/workflows/review-apps.yml.github/workflows/test-grafana-annotation.yml.github/workflows/test.yml.github/workflows/webflow-extension.ymlCHANGELOG.md
simonsmallchua
added a commit
that referenced
this pull request
May 27, 2026
Harden GitHub Actions: pin SHAs + persist-credentials
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dedicated supply-chain hardening pass for CI, completing the work deferred from #392 (flagged by CodeRabbit/zizmor).
# vXcomment for readability, following the existingflyctl-actions@<sha>/build-push-action@<sha>precedent. Coversactions/checkout,actions/setup-go,actions/setup-node,actions/github-script,actions/upload-artifact,actions/download-artifact,actions/cache,golangci/golangci-lint-action,codecov/codecov-action,codecov/test-results-action,supabase/setup-cli,1password/load-secrets-action, andgoreleaser/goreleaser-action. No@vNtag refs remain.persist-credentials: falseon 27 of 28actions/checkoutsteps. These jobs authenticate to Fly/registry separately and don't need the persisted git token.Intentional exception
auto-release.yml's checkout is SHA-pinned but keeps credentials persisted. It passestoken: ${{ env.PAT_TOKEN }}precisely so it cangit push --force-with-lease origin mainand push release tags to bypass branch protection. Settingpersist-credentials: falsethere would break the release automation, so it is the legitimate exception.Validation
yaml.safe_load.git ls-remote ... <tag> <tag>^{}(dereferenced commit for annotated tags).Test plan
Need help on this PR? Tag
@codesmithwith what you need. Autofix is disabled.Summary by CodeRabbit