Conversation
… 2 updates Bumps the security-scanners group with 2 updates in the / directory: [securego/gosec](https://github.com/securego/gosec) and [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog). Updates `securego/gosec` from 2.27.1 to 2.28.0 - [Release notes](https://github.com/securego/gosec/releases) - [Commits](securego/gosec@9e6a984...9e75c05) Updates `trufflesecurity/trufflehog` from 3.95.8 to 3.95.9 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@00155c9...27b0417) --- updated-dependencies: - dependency-name: securego/gosec dependency-version: 2.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-scanners - dependency-name: trufflesecurity/trufflehog dependency-version: 3.95.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: security-scanners ... Signed-off-by: dependabot[bot] <support@github.com>
…dates Bumps the actions-core group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-node](https://github.com/actions/setup-node) and [actions/setup-go](https://github.com/actions/setup-go). Updates `actions/checkout` from 6.0.3 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](actions/checkout@v6.0.3...v7.0.1) Updates `actions/setup-node` from 6 to 7 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) Updates `actions/setup-go` from 6 to 7 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-core - dependency-name: actions/setup-go dependency-version: 6.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-core - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-core ... Signed-off-by: dependabot[bot] <support@github.com>
Summary by CodeRabbit
WalkthroughThe PR refreshes pinned GitHub Actions across CI, security, release, deployment, and validation workflows. It also adds and documents GitOps layout, Kustomize, and ArgoCD naming inputs for the Go release workflow. ChangesWorkflow maintenance
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related issues
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
lerian-studio
added
size/M
🔍 PR Validation Summary✅ PR Mergeable — no blocking failures
|
🔍 Lint Analysis
❌ Failures (2)Action Lint
Pinned Actions
|
🛡️ CodeQL Analysis ResultsLanguages analyzed: Found 4 issue(s): 4 Medium
🔍 View full scan logs | 🛡️ Security tab |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/go-ci.yml:
- Around line 82-85: Pin every listed third-party action to its full commit SHA
in both .github/workflows/go-ci.yml (lines 82-85 and all other listed action
usages) and .github/workflows/go-fuzz.yml (lines 80-83 and all other listed
action usages), replacing mutable tags while retaining each release tag in an
inline comment.
In @.github/workflows/go-release.yml:
- Around line 200-203: Validate the `gitops_layout` workflow input against an
allowlist containing only `helmfile` and `kustomize` before invoking
`gitops-update.yml`; reject all other values, including typos, rather than
routing them through the helmfile path.
- Around line 455-456: Update the action version comments for the checkout steps
in .github/workflows/go-release.yml:455-456,
.github/workflows/lerian-lib-version-check.yml:87-88,
.github/workflows/pr-security-scan.yml:184-185,
.github/workflows/pr-validation.yml:51-52,
.github/workflows/release-notification.yml:126-127,
.github/workflows/release.yml:193-194,
.github/workflows/self-pr-validation.yml:51-52, and
.github/workflows/version-propagation.yml:62-63 to annotate the specified
actions/checkout SHA as v7.0.1; additionally annotate the specified
actions/setup-node SHA in .github/workflows/release.yml with v7.0.0.
In @.github/workflows/helm-release-notification.yml:
- Line 88: Update the inline action version comments at
.github/workflows/helm-release-notification.yml:88,
.github/workflows/gptchangelog.yml:65, :142, and :260,
.github/workflows/helm-alpha-release.yml:56, and
.github/workflows/helm-update-chart.yml:170 to # v7.0.1 for actions/checkout;
update .github/workflows/helm-update-chart.yml:211 to # v7 for actions/setup-go.
Do not change the pinned action references.
In @.github/workflows/pr-security-scan.yml:
- Around line 184-185: Disable persisted checkout credentials by adding
persist-credentials: false to the checkout steps in
.github/workflows/pr-security-scan.yml (lines 184-185), every validation
checkout in .github/workflows/pr-validation.yml (lines 51-52) and
.github/workflows/self-pr-validation.yml (lines 51-52), and the notification
checkout in .github/workflows/release-notification.yml (lines 126-127). Do not
modify release workflows that perform Git writes.
In @.github/workflows/s3-upload.yml:
- Line 129: Update the checkout step using actions/checkout to pin it to an
immutable commit SHA instead of the mutable v7.0.1 tag, and set
persist-credentials to false so the repository token is not retained in Git
configuration.
In @.github/workflows/typescript-ci.yml:
- Around line 86-89: Update every actions/checkout and actions/setup-node
reference in the typescript CI workflow to use its matching immutable commit SHA
instead of the v7.0.1 or v7 tags, while retaining the existing version comment
alongside each SHA.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 36d6428f-6a12-4efb-932d-f98676860cdb
📒 Files selected for processing (30)
.github/workflows/api-dog-e2e-tests.yml.github/workflows/backmerge.yml.github/workflows/build.yml.github/workflows/dispatch-helm.yml.github/workflows/end-to-end-tests.yml.github/workflows/frontend-pr-analysis.yml.github/workflows/gitops-update.yml.github/workflows/go-ci.yml.github/workflows/go-fuzz.yml.github/workflows/go-lambda-release.yml.github/workflows/go-pr-analysis.yml.github/workflows/go-release.yml.github/workflows/go-security.yml.github/workflows/gptchangelog.yml.github/workflows/helm-alpha-release.yml.github/workflows/helm-release-notification.yml.github/workflows/helm-update-chart.yml.github/workflows/js-release.yml.github/workflows/lerian-lib-version-check.yml.github/workflows/pr-security-scan.yml.github/workflows/pr-validation.yml.github/workflows/release-notification.yml.github/workflows/release.yml.github/workflows/s3-upload.yml.github/workflows/self-pr-validation.yml.github/workflows/typescript-build.yml.github/workflows/typescript-ci.yml.github/workflows/typescript-release.yml.github/workflows/version-propagation.ymldocs/go-release-workflow.md
| uses: actions/checkout@v7.0.1 | ||
|
|
||
| - name: Set up Go | ||
| uses: actions/setup-go@v6 | ||
| uses: actions/setup-go@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for f in .github/workflows/go-ci.yml .github/workflows/go-fuzz.yml; do
echo "===== $f ====="
nl -ba "$f" | sed -n '1,320p' | sed -n '/uses:/p'
echo
doneRepository: LerianStudio/github-actions-shared-workflows
Length of output: 262
🏁 Script executed:
python3 - <<'PY'
from pathlib import Path
for path in [Path('.github/workflows/go-ci.yml'), Path('.github/workflows/go-fuzz.yml')]:
print(f'===== {path} =====')
for i, line in enumerate(path.read_text().splitlines(), 1):
if 'uses:' in line:
print(f'{i:4}: {line}')
print()
PYRepository: LerianStudio/github-actions-shared-workflows
Length of output: 1218
Pin all third-party actions to commit SHAs in both workflows.
actions/checkout, actions/setup-go, actions/upload-artifact, actions/download-artifact, fgrosse/go-coverage-report, golangci/golangci-lint-action, and tcort/github-action-markdown-link-check are still referenced by mutable tags here. Replace each with a full SHA and keep the release tag in a comment.
.github/workflows/go-ci.yml.github/workflows/go-fuzz.yml
🧰 Tools
🪛 zizmor (1.26.1)
[error] 82-82: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 85-85: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
📍 Affects 2 files
.github/workflows/go-ci.yml#L82-L85(this comment).github/workflows/go-fuzz.yml#L80-L83
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/go-ci.yml around lines 82 - 85, Pin every listed
third-party action to its full commit SHA in both .github/workflows/go-ci.yml
(lines 82-85 and all other listed action usages) and
.github/workflows/go-fuzz.yml (lines 80-83 and all other listed action usages),
replacing mutable tags while retaining each release tag in an inline comment.
Sources: Coding guidelines, Linters/SAST tools
| gitops_layout: | ||
| description: 'GitOps layout strategy: "helmfile" (default, current behavior) or "kustomize".' | ||
| type: string | ||
| default: 'helmfile' |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
set -euo pipefail
printf '\n== go-release around inputs ==\n'
sed -n '180,240p' .github/workflows/go-release.yml
printf '\n== go-release around forwarding ==\n'
sed -n '660,720p' .github/workflows/go-release.yml
printf '\n== go-release around checkout reference ==\n'
rg -n "actions/checkout|# v6|# v7|checkout@" .github/workflows/go-release.yml
printf '\n== gitops-update workflow ==\n'
sed -n '1,240p' .github/workflows/gitops-update.ymlRepository: LerianStudio/github-actions-shared-workflows
Length of output: 19445
🏁 Script executed:
set -euo pipefail
printf '\n== gitops_layout references in gitops-update.yml ==\n'
rg -n "gitops_layout|helmfile|kustomize" .github/workflows/gitops-update.yml
printf '\n== validation / case logic near layout handling ==\n'
sed -n '240,520p' .github/workflows/gitops-update.yml
printf '\n== later sections with layout-specific steps ==\n'
sed -n '520,920p' .github/workflows/gitops-update.ymlRepository: LerianStudio/github-actions-shared-workflows
Length of output: 36473
Reject unsupported gitops_layout values before calling gitops-update.yml. This input is free-form, so typos fall through to the helmfile path and skip the yaml_key_mappings check. Add allowlist validation here so only helmfile and kustomize are accepted; that is a breaking change for callers using any other value.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/go-release.yml around lines 200 - 203, Validate the
`gitops_layout` workflow input against an allowlist containing only `helmfile`
and `kustomize` before invoking `gitops-update.yml`; reject all other values,
including typos, rather than routing them through the helmfile path.
| - name: Checkout repository | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
rg -n 'uses: actions/(checkout|setup-node)@|# v[0-9]' .github/workflowsRepository: LerianStudio/github-actions-shared-workflows
Length of output: 24092
🏁 Script executed:
#!/bin/bash
set -euo pipefail
resolve_tag_commit() {
local repo="$1" tag="$2"
ref_json=$(gh api "repos/$repo/git/refs/tags/$tag")
type=$(jq -r '.object.type' <<<"$ref_json")
sha=$(jq -r '.object.sha' <<<"$ref_json")
if [[ "$type" == "tag" ]]; then
gh api "repos/$repo/git/tags/$sha" --jq '.object.sha'
else
echo "$sha"
fi
}
for spec in \
"actions/checkout v7.0.1 3d3c42e5aac5ba805825da76410c181273ba90b1" \
"actions/setup-node v7.0.0 820762786026740c76f36085b0efc47a31fe5020"
do
set -- $spec
repo=$1 tag=$2 pinned=$3
tag_commit=$(resolve_tag_commit "$repo" "$tag")
echo "$repo@$tag -> $tag_commit"
echo "pinned -> $pinned"
if [[ "$tag_commit" == "$pinned" ]]; then
echo "MATCH"
else
echo "DIFF"
fi
gh api "repos/$repo/commits/$pinned" --jq '.sha' >/dev/null
doneRepository: LerianStudio/github-actions-shared-workflows
Length of output: 436
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for file_range in \
".github/workflows/go-release.yml:445-470" \
".github/workflows/lerian-lib-version-check.yml:80-95" \
".github/workflows/pr-security-scan.yml:176-195" \
".github/workflows/pr-validation.yml:45-60" \
".github/workflows/release-notification.yml:118-132" \
".github/workflows/release.yml:185-205" \
".github/workflows/self-pr-validation.yml:45-60" \
".github/workflows/version-propagation.yml:56-70"
do
file=${file_range%%:*}
range=${file_range#*:}
echo "===== $file ($range) ====="
sed -n "$range" "$file" | cat -n
doneRepository: LerianStudio/github-actions-shared-workflows
Length of output: 289
🌐 Web query:
actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 v7.0.1 actions/setup-node 820762786026740c76f36085b0efc47a31fe5020 v7.0.0
💡 Result:
The specific commits and versions you provided for the GitHub Actions are identified as follows: 1. actions/checkout: The commit 3d3c42e5aac5ba805825da76410c181273ba90b1 corresponds to the v7.0.1 release [1][2][3]. This release was published on July 20, 2026, and includes various updates such as skipping unsafe PR checks when using default inputs, trimming only ASCII whitespace for branches, and escaping values passed to --unset [1][4]. 2. actions/setup-node: The commit 820762786026740c76f36085b0efc47a31fe5020 corresponds to the v7.0.0 release [5][6]. This release was published on July 14, 2026, and introduced significant changes including a migration to ESM, improved dependency management, and new output capabilities such as cache-primary-key and cache-matched-key [5][7][6]. In GitHub Actions workflows, pinning these actions to specific commit SHAs (as shown in your examples) is a best practice for security and stability, ensuring the workflow uses the exact version of the code intended regardless of future updates to tag references [8].
Citations:
- 1: https://github.com/actions/checkout/releases/tag/v7.0.1
- 2: actions/checkout@v7.0.0...v7.0.1
- 3: actions/checkout@9c091bb...3d3c42e
- 4: https://github.com/actions/checkout/releases
- 5: https://github.com/actions/setup-node/releases/tag/v7.0.0
- 6: https://github.com/actions/setup-node/releases
- 7: actions/setup-node@v6...v7
- 8: https://github.com/rvagg/ghreview/blob/79af32548f62acb07180e488285552b49b35f997/.github/workflows/test-and-release.yml
🌐 Web query:
"3d3c42e5aac5ba805825da76410c181273ba90b1" actions/checkout "820762786026740c76f36085b0efc47a31fe5020" actions/setup-node
💡 Result:
The provided strings are full-length, 40-character SHA-1 commit hashes used to pin specific versions of GitHub Actions for security and consistency [1][2][3]. By referencing a commit SHA instead of a mutable tag (like @v7), you ensure that your workflow runs exactly the same code every time, protecting your builds against potential upstream changes or malicious tag updates [1][2][3]. The specific hashes are: 1. 3d3c42e5aac5ba805825da76410c181273ba90b1: This commit hash corresponds to the actions/checkout repository, specifically associated with the preparations for the v7.0.1 release [4][5][6]. 2. 820762786026740c76f36085b0efc47a31fe5020: This commit hash belongs to the actions/setup-node repository. It represents the commit that migrated the action to ESM (ECMAScript Modules) and upgraded its dependencies, aligning with the v7.0.0 release [7][8][9]. It is a recommended best practice to use these full-length commit SHAs in your workflow YAML files, often while keeping the human-readable version tag as a trailing comment to facilitate dependency management and clarity [1][2][9]. For example: - uses: actions/checkout@3d3c42e # v7.0.1 - uses: actions/setup-node@8207627 # v7.0.0
Citations:
- 1: https://www.romainlespinasse.dev/posts/github-actions-commit-sha-pinning/
- 2: https://starsling.dev/best-practices/github-actions/pin-action-shas
- 3: https://www.stepsecurity.io/blog/pinning-github-actions-for-enhanced-security-a-complete-guide
- 4: actions/checkout@9c091bb...3d3c42e
- 5: actions/checkout@v4.3.1...3d3c42e
- 6: actions/checkout@de0fac2...3d3c42e
- 7: actions/setup-node@53b8394...8207627
- 8: actions/setup-node@48b55a0...8207627
- 9: https://github.com/OrbintSoft/sshakku/blob/a3042e0a0b0238ed049ccf63bc01c160710dec41/.github/workflows/linting.yml
Update the action version comments.
actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1should be annotated# v7.0.1in.github/workflows/go-release.yml,.github/workflows/lerian-lib-version-check.yml,.github/workflows/pr-security-scan.yml,.github/workflows/pr-validation.yml,.github/workflows/release-notification.yml,.github/workflows/release.yml,.github/workflows/self-pr-validation.yml, and.github/workflows/version-propagation.yml.actions/setup-node@820762786026740c76f36085b0efc47a31fe5020should be annotated# v7.0.0in.github/workflows/release.yml.
📍 Affects 8 files
.github/workflows/go-release.yml#L455-L456(this comment).github/workflows/lerian-lib-version-check.yml#L87-L88.github/workflows/pr-security-scan.yml#L184-L185.github/workflows/pr-validation.yml#L51-L52.github/workflows/release-notification.yml#L126-L127.github/workflows/release.yml#L193-L194.github/workflows/self-pr-validation.yml#L51-L52.github/workflows/version-propagation.yml#L62-L63
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/go-release.yml around lines 455 - 456, Update the action
version comments for the checkout steps in
.github/workflows/go-release.yml:455-456,
.github/workflows/lerian-lib-version-check.yml:87-88,
.github/workflows/pr-security-scan.yml:184-185,
.github/workflows/pr-validation.yml:51-52,
.github/workflows/release-notification.yml:126-127,
.github/workflows/release.yml:193-194,
.github/workflows/self-pr-validation.yml:51-52, and
.github/workflows/version-propagation.yml:62-63 to annotate the specified
actions/checkout SHA as v7.0.1; additionally annotate the specified
actions/setup-node SHA in .github/workflows/release.yml with v7.0.0.
Source: Coding guidelines
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4 | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
git ls-remote --tags https://github.com/actions/checkout.git \
refs/tags/v4 refs/tags/v6 refs/tags/v7.0.1
git ls-remote --tags https://github.com/actions/setup-go.git \
refs/tags/v6 refs/tags/v7Repository: LerianStudio/github-actions-shared-workflows
Length of output: 456
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for file in \
.github/workflows/helm-release-notification.yml \
.github/workflows/gptchangelog.yml \
.github/workflows/helm-alpha-release.yml \
.github/workflows/helm-update-chart.yml
do
echo "===== $file ====="
nl -ba "$file" | sed -n '1,260p' | rg -n "actions/(checkout|setup-go)@|# v[0-9]"
doneRepository: LerianStudio/github-actions-shared-workflows
Length of output: 279
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for file in \
.github/workflows/helm-release-notification.yml \
.github/workflows/gptchangelog.yml \
.github/workflows/helm-alpha-release.yml \
.github/workflows/helm-update-chart.yml
do
echo "===== $file ====="
sed -n '1,260p' "$file" | grep -nE 'actions/(checkout|setup-go)@|# v[0-9]'
doneRepository: LerianStudio/github-actions-shared-workflows
Length of output: 1325
Update the stale action version comments.
actions/checkout is pinned to v7.0.1 in the listed workflows, but the inline comments still say # v4/# v6; actions/setup-go is pinned to v7, but the comment says # v6.
.github/workflows/helm-release-notification.yml#L88.github/workflows/gptchangelog.yml#L65,#L142,#L260.github/workflows/helm-alpha-release.yml#L56.github/workflows/helm-update-chart.yml#L170.github/workflows/helm-update-chart.yml#L211(actions/setup-go→# v7)
📍 Affects 4 files
.github/workflows/helm-release-notification.yml#L88-L88(this comment).github/workflows/gptchangelog.yml#L65-L65.github/workflows/gptchangelog.yml#L142-L142.github/workflows/gptchangelog.yml#L260-L260.github/workflows/helm-alpha-release.yml#L56-L56.github/workflows/helm-update-chart.yml#L170-L170.github/workflows/helm-update-chart.yml#L211-L211
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/helm-release-notification.yml at line 88, Update the
inline action version comments at
.github/workflows/helm-release-notification.yml:88,
.github/workflows/gptchangelog.yml:65, :142, and :260,
.github/workflows/helm-alpha-release.yml:56, and
.github/workflows/helm-update-chart.yml:170 to # v7.0.1 for actions/checkout;
update .github/workflows/helm-update-chart.yml:211 to # v7 for actions/setup-go.
Do not change the pinned action references.
| - name: Checkout Repository | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable persisted checkout credentials in read-only workflows.
.github/workflows/pr-security-scan.yml#L184-L185: addpersist-credentials: falseto both scanning checkouts..github/workflows/pr-validation.yml#L51-L52: add it to every validation checkout..github/workflows/release-notification.yml#L126-L127: add it to the notification checkout..github/workflows/self-pr-validation.yml#L51-L52: add it to every self-validation checkout.
The release workflows that perform Git writes are intentionally excluded.
- name: Checkout
uses: actions/checkout@<sha>
with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout Repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 | |
| - name: Checkout Repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 184-185: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 4 files
.github/workflows/pr-security-scan.yml#L184-L185(this comment).github/workflows/pr-validation.yml#L51-L52.github/workflows/release-notification.yml#L126-L127.github/workflows/self-pr-validation.yml#L51-L52
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-security-scan.yml around lines 184 - 185, Disable
persisted checkout credentials by adding persist-credentials: false to the
checkout steps in .github/workflows/pr-security-scan.yml (lines 184-185), every
validation checkout in .github/workflows/pr-validation.yml (lines 51-52) and
.github/workflows/self-pr-validation.yml (lines 51-52), and the notification
checkout in .github/workflows/release-notification.yml (lines 126-127). Do not
modify release workflows that perform Git writes.
Source: Linters/SAST tools
| runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }} | ||
| steps: | ||
| - uses: actions/checkout@v6.0.3 | ||
| - uses: actions/checkout@v7.0.1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n 'uses:\s*actions/checkout@' .github/workflows/s3-upload.yml
if rg -nP 'uses:\s*actions/checkout@(?![0-9a-f]{40}\b)' .github/workflows/s3-upload.yml; then
echo "Checkout is not pinned to a commit SHA"
exit 1
fiRepository: LerianStudio/github-actions-shared-workflows
Length of output: 305
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the workflow around the checkout and upload steps.
cat -n .github/workflows/s3-upload.yml | sed -n '1,220p'
echo
echo '---'
echo 'Checkout release tag resolution (if gh is available)'
if command -v gh >/dev/null 2>&1; then
gh api repos/actions/checkout/git/refs/tags/v7.0.1 --jq '.object'
else
echo 'gh not available'
fiRepository: LerianStudio/github-actions-shared-workflows
Length of output: 9957
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Look for the upload pattern and any handling of hidden files or .git.
rg -n 'PATTERN|upload|.git|persist-credentials|checkout' .github/workflows/s3-upload.ymlRepository: LerianStudio/github-actions-shared-workflows
Length of output: 1758
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '220,300p' .github/workflows/s3-upload.yml | cat -nRepository: LerianStudio/github-actions-shared-workflows
Length of output: 2051
Pin actions/checkout and disable persisted credentials. actions/checkout@v7.0.1 is still a mutable tag, and the default persist-credentials leaves the repo token in .git/config, which this upload workflow can expose if the pattern matches repository metadata.
Suggested change
- - uses: actions/checkout@v7.0.1
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v7.0.1 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 129-129: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 129-129: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/s3-upload.yml at line 129, Update the checkout step using
actions/checkout to pin it to an immutable commit SHA instead of the mutable
v7.0.1 tag, and set persist-credentials to false so the repository token is not
retained in Git configuration.
Sources: Coding guidelines, Linters/SAST tools
| uses: actions/checkout@v7.0.1 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v6 | ||
| uses: actions/setup-node@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
if rg -nP 'uses:\s*actions/(checkout|setup-node)@(?![0-9a-f]{40}\b)' \
.github/workflows/typescript-ci.yml; then
echo "Found unpinned checkout/setup-node references"
exit 1
fiRepository: LerianStudio/github-actions-shared-workflows
Length of output: 554
Pin the GitHub Actions refs by commit SHA
.github/workflows/typescript-ci.yml still uses mutable tags for all actions/checkout and actions/setup-node calls (v7.0.1 / v7). Replace each reference with the matching commit SHA and keep the version comment.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 86-86: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 89-89: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/typescript-ci.yml around lines 86 - 89, Update every
actions/checkout and actions/setup-node reference in the typescript CI workflow
to use its matching immutable commit SHA instead of the v7.0.1 or v7 tags, while
retaining the existing version comment alongside each SHA.
Sources: Coding guidelines, Linters/SAST tools
2 participants
GitHub Actions Shared Workflows
Description
Type of Change
feat: New workflow or new input/output/step in an existing workflowfix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)perf: Performance improvement (e.g. caching, parallelism, reduced steps)refactor: Internal restructuring with no behavior changedocs: Documentation only (README, docs/, inline comments)ci: Changes to self-CI (workflows under.github/workflows/that run on this repo)chore: Dependency bumps, config updates, maintenancetest: Adding or updating testsBREAKING CHANGE: Callers must update their configuration after this PRBreaking Changes
None.
Testing
@this-branchor the beta tagCaller repo / workflow run:
Related Issues
Closes #