ci: pin actions - #113
Conversation
📝 WalkthroughWalkthroughThis PR pins third-party GitHub Actions used across ci.yml, coverage.yml, dependabot-reviewer.yml, and lint.yml workflows to specific commit SHAs instead of mutable tag references, with no changes to job structure, triggers, or commands. ChangesGitHub Actions SHA Pinning
Estimated code review effort: 1 (Trivial) | ~5 minutes Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 36: The CI workflow’s actions/checkout step is leaving persisted
credentials enabled even though the job only runs build/test commands. Update
the checkout configuration in the workflow to disable persisted checkout
credentials, using the existing actions/checkout reference in the CI job so the
default token is not written to .git/config.
In @.github/workflows/coverage.yml:
- Line 19: The checkout step in the coverage workflow leaves the GitHub token
available to later steps, which should be disabled for this job. Update the
actions/checkout usage in the workflow to turn off credential persistence so
repository code can run without exposing the checkout token. Use the checkout
step itself as the target for the fix.
In @.github/workflows/lint.yml:
- Line 22: The lint workflow checkout step is still persisting Git credentials
by default; update each actions/checkout step in the lint jobs to disable
credential persistence. Use the checkout step in the lint workflow as the target
and add persist-credentials set to false so these jobs only perform a local
clone without storing the token in git config.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7cfe0553-4e77-476f-abd8-83cc45861a55
📒 Files selected for processing (4)
.github/workflows/ci.yml.github/workflows/coverage.yml.github/workflows/dependabot-reviewer.yml.github/workflows/lint.yml
|
|
||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the workflow around the referenced line and locate any git-related steps.
git ls-files .github/workflows/ci.yml
echo "----"
cat -n .github/workflows/ci.yml | sed -n '1,220p'
echo "----"
rg -n "checkout|persist-credentials|git (push|fetch|submodule|tag|commit)|actions/checkout" .github/workflows/ci.ymlRepository: x52dev/contracts
Length of output: 2500
Disable persisted checkout credentials. This job only runs build/test commands, so the default token in .git/config is unnecessary and widens the impact of any compromised step.
Suggested change
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 36-36: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 36, The CI workflow’s actions/checkout step
is leaving persisted credentials enabled even though the job only runs
build/test commands. Update the checkout configuration in the workflow to
disable persisted checkout credentials, using the existing actions/checkout
reference in the CI job so the default token is not written to .git/config.
Source: Linters/SAST tools
| name: Coverage | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Map the workflow file structure first
ast-grep outline .github/workflows/coverage.yml --view expanded || true
# Show the relevant workflow section with line numbers
cat -n .github/workflows/coverage.yml | sed -n '1,220p'
# Find later steps that execute repository code or use git credentials
rg -n "persist-credentials|checkout|run:|npm|yarn|pnpm|python|pytest|coverage|git " .github/workflows/coverage.ymlRepository: x52dev/contracts
Length of output: 2284
Disable checkout credential persistence.
This job runs repository code after checkout, so the checkout token is unnecessary and should not be left available to later steps.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 19-19: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/coverage.yml at line 19, The checkout step in the coverage
workflow leaves the GitHub token available to later steps, which should be
disabled for this job. Update the actions/checkout usage in the workflow to turn
off credential persistence so repository code can run without exposing the
checkout token. Use the checkout step itself as the target for the fix.
Source: Linters/SAST tools
|
|
||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== lint workflow =="
cat -n .github/workflows/lint.yml | sed -n '1,220p'
echo
echo "== workflow permissions references =="
rg -n --hidden -S 'permissions:|persist-credentials|actions/checkout@' .github/workflowsRepository: x52dev/contracts
Length of output: 4036
Disable checkout credential persistence in the lint jobs.
actions/checkout still stores the token in git config by default. These jobs only need a local checkout, so set persist-credentials: false on each checkout step in this file.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 22-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/lint.yml at line 22, The lint workflow checkout step is
still persisting Git credentials by default; update each actions/checkout step
in the lint jobs to disable credential persistence. Use the checkout step in the
lint workflow as the target and add persist-credentials set to false so these
jobs only perform a local clone without storing the token in git config.
Source: Linters/SAST tools
1 participant
Pins GitHub Actions workflow refs with pinact.
Summary by CodeRabbit