Pin CI action and tool versions#523
Merged
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (11)
📝 WalkthroughWalkthroughThis PR pins all GitHub Actions across nine CI/CD workflows to specific commit SHAs instead of floating version tags for determinism and supply chain security. Rust toolchain is updated to 1.95.0 and Java to 21.0.11 across affected workflows. sccache installations now verify SHA-256 checksums before extraction. The frontend package.json pins ChangesCI/CD Workflow and Dependency Pinning
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Deploying maple with
|
| Latest commit: |
d01b979
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://cf269819.maple-ca8.pages.dev |
| Branch Preview URL: | https://harden-ci-pinning.maple-ca8.pages.dev |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/zapstore-publish.yml (1)
16-20:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winConsider adding
persist-credentials: falsefor defense in depth.The checkout action does not explicitly set
persist-credentials: false. While sparse-checkout limits exposure, explicitly disabling credential persistence provides additional protection against potential credential leakage in supply chain attack scenarios.🔒 Recommended security hardening
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: + persist-credentials: false sparse-checkout: |🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/zapstore-publish.yml around lines 16 - 20, The checkout step using "actions/checkout@..." currently sets sparse-checkout but doesn't disable credential persistence; update the checkout action block (the step that uses actions/checkout and sets sparse-checkout) to include persist-credentials: false under the with: section to prevent Git credentials from being persisted to the workspace.
🧹 Nitpick comments (3)
.github/workflows/android-build.yml (1)
14-14: ⚡ Quick winHarden checkout by disabling persisted Git credentials.
Line 14 can set
persist-credentials: falseto reduce token exposure and align with your PR workflows.🔐 Suggested patch
- - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/android-build.yml at line 14, The checkout step currently uses actions/checkout@... without disabling persisted credentials; update the actions/checkout step (the line with "uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5") to add the input persist-credentials: false so GitHub tokens are not stored in the workspace, lowering token exposure during the android-build workflow..github/workflows/mobile-build.yml (1)
14-14: ⚡ Quick winHarden checkout by disabling persisted Git credentials.
Line 14 should set
persist-credentials: falsefor least-privilege consistency.🔐 Suggested patch
- - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/mobile-build.yml at line 14, The checkout step using "uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5" should be hardened by adding "persist-credentials: false" under that step; locate the checkout step and add the persist-credentials key (with boolean false) as a sibling to uses so the action doesn't persist Git credentials to subsequent steps..github/workflows/desktop-build.yml (1)
17-17: ⚡ Quick winHarden checkout by disabling persisted Git credentials.
Line 17 and Line 123 should set
persist-credentials: falsefor tighter token handling.🔐 Suggested patch
- - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false @@ - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: falseAlso applies to: 123-123
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/desktop-build.yml at line 17, The checkout steps using "uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5" need to be hardened by adding "persist-credentials: false" to their step inputs; locate the two checkout occurrences (the one at the top using that actions/checkout reference and the second occurrence around the other build job) and add the persist-credentials: false key under each checkout step so the runner does not persist the workflow token into the checked-out repository.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/frontend-tests.yml:
- Line 16: The checkout step "uses:
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5" should explicitly
disable credential persistence; update that step to include a "with:" block
containing "persist-credentials: false" so runner-scoped GitHub token
credentials are not left in the workspace and cannot be leaked to artifacts or
caches.
In @.github/workflows/release.yml:
- Line 16: The checkout steps are persisting the default GITHUB_TOKEN to local
git config; update each actions/checkout invocation (the steps using
actions/checkout@... shown at the occurrences around the existing checkout
lines) to disable credential persistence by adding persist-credentials: false
under the step's with: block for every checkout (the occurrences at the
currently flagged spots), ensuring the workflow still checks out code but does
not write the token into local git config.
In @.github/workflows/rust-tests.yml:
- Around line 19-21: The inline comment saying "# stable" is misleading because
the action is pinned to a specific commit
(dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8) and the
toolchain is explicitly set to "1.95.0"; update the comment to accurately state
that the action is pinned to a specific SHA and the workflow uses Rust 1.95.0
(or remove the comment entirely) so readers aren’t misled into thinking it
tracks the floating "stable" channel.
- Line 16: The checkout step currently uses actions/checkout without disabling
credential persistence; update the checkout invocation (the actions/checkout@...
step) to include persist-credentials: false so GitHub token credentials are not
left in the workspace to reduce leakage risk—add the persist-credentials: false
key alongside any existing settings for the actions/checkout step.
In `@frontend/package.json`:
- Line 81: The `@types/bun` dependency is pinned to 1.3.13 which is newer than the
Bun runtime (bun@1.3.5); update the frontend/package.json entry for "`@types/bun`"
to a version that matches the runtime (e.g., "1.3.5") or alternatively upgrade
the runtime to bun@1.3.13 so types and runtime are aligned; modify the
"`@types/bun`" version string in package.json accordingly and run install to
validate.
---
Outside diff comments:
In @.github/workflows/zapstore-publish.yml:
- Around line 16-20: The checkout step using "actions/checkout@..." currently
sets sparse-checkout but doesn't disable credential persistence; update the
checkout action block (the step that uses actions/checkout and sets
sparse-checkout) to include persist-credentials: false under the with: section
to prevent Git credentials from being persisted to the workspace.
---
Nitpick comments:
In @.github/workflows/android-build.yml:
- Line 14: The checkout step currently uses actions/checkout@... without
disabling persisted credentials; update the actions/checkout step (the line with
"uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5") to add the
input persist-credentials: false so GitHub tokens are not stored in the
workspace, lowering token exposure during the android-build workflow.
In @.github/workflows/desktop-build.yml:
- Line 17: The checkout steps using "uses:
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5" need to be hardened
by adding "persist-credentials: false" to their step inputs; locate the two
checkout occurrences (the one at the top using that actions/checkout reference
and the second occurrence around the other build job) and add the
persist-credentials: false key under each checkout step so the runner does not
persist the workflow token into the checked-out repository.
In @.github/workflows/mobile-build.yml:
- Line 14: The checkout step using "uses:
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5" should be hardened by
adding "persist-credentials: false" under that step; locate the checkout step
and add the persist-credentials key (with boolean false) as a sibling to uses so
the action doesn't persist Git credentials to subsequent steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 0d1bf0ac-3f60-4737-b338-62ee7d554979
⛔ Files ignored due to path filters (1)
frontend/bun.lockis excluded by!**/*.lock
📒 Files selected for processing (11)
.github/workflows/android-build.yml.github/workflows/android-pr-build.yml.github/workflows/desktop-build.yml.github/workflows/desktop-pr-build.yml.github/workflows/frontend-tests.yml.github/workflows/mobile-build.yml.github/workflows/mobile-pr-build.yml.github/workflows/release.yml.github/workflows/rust-tests.yml.github/workflows/zapstore-publish.ymlfrontend/package.json
AnthonyRonning
force-pushed
the
harden-ci-pinning
branch
from
7692aeb to
d01b979
Compare
This was referenced May 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
uses:refs to the commit currently behind their existing tag or branch refs, with the original ref kept as an inline comment.stableto1.95.0, Temurin Java21to21.0.11, Go1.22.xto1.22.12, and@types/bunlatestto1.3.13.v0.8.2tarball while preserving existing cache keys and paths.Resolved refs
actions/checkout@v434e114876b0b11c390a56381ad16ebd13914f8d5oven-sh/setup-bun@v1f4d14e03ff726c06358e5557344e1da148b56cf7dtolnay/rust-toolchain@stable29eef336d9b2848a0b548edc03f92a220660cdb8actions/cache@v40057852bfaa89a56745cba8c7296529d2fc39830irgaly/xcode-cache@v14141f139f00e335c6e1031fb93e667181f86146fmaxim-lobanov/setup-xcode@v1ed7a3b1fda3918c0306d1b724322adc0b8cc0a90actions/upload-artifact@v4ea165f8d65b6e75b540449e92b4886f43607fa02tauri-apps/tauri-action@v084b9d35b5fc46c1e45415bdb6144030364f7ebc5actions/setup-java@v4c1e323688fd81a25caa38c78aa6df2d33d3e20d9android-actions/setup-android@v39fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407nttld/setup-ndk@v1.5.0afb4c9964b521afb97c864b7d40b11e6911bd410actions/setup-go@v540f1582b2485089dde7abd97c1529aa768e1baffValidation
git diff --checkjq empty frontend/package.json.github/workflows/*.ymlvia the existing frontendyamlpackagebun run build,bun testSummary by CodeRabbit