Adding an example for standalone security-review Github Action#103
Adding an example for standalone security-review Github Action#103
Conversation
shrishabh
requested review from
QuanZhang-William,
capachino,
evanotero,
heltonduarte and
pedrour
as code owners
|
🤖 Hi @shrishabh, I've received your request, and I'm working on it now! You can track my progress in the logs for more details. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
📋 Review Summary
This pull request introduces a new example GitHub Actions workflow for running Gemini security analysis. The workflow is well-structured and provides a good starting point for users.
🔍 General Feedback
- The use of pinned actions for
create-github-app-tokenandcheckoutis a good security practice. - The workflow correctly uses concurrency controls to prevent multiple runs.
- A high-severity issue was found regarding the use of
@mainfor therun-gemini-cliaction, which should be addressed.
| REPOSITORY: '${{ github.repository }}' | ||
| run: |- | ||
| gh issue comment "${ISSUE_NUMBER}" \ | ||
| --body "${MESSAGE}" \ |
There was a problem hiding this comment.
🟠 For security and stability, it's recommended to pin the version of the google-github-actions/run-gemini-cli action to a specific release tag instead of using @main. This prevents unexpected breaking changes or malicious code from being introduced into your workflow.
| --body "${MESSAGE}" \ | |
| uses: 'google-github-actions/run-gemini-cli@v1' # ratchet:exclude |
| shell: 'bash' | ||
|
|
||
| jobs: | ||
| review: |
There was a problem hiding this comment.
🟢 For better stability and to ensure consistent builds, consider pinning the runner version to a specific version (e.g., ubuntu-22.04) instead of using ubuntu-latest.
| review: | |
| runs-on: 'ubuntu-22.04' |
| @@ -0,0 +1,128 @@ | |||
| name: '🔎 Gemini Review & Security Analysis' | |||
There was a problem hiding this comment.
Should we put the file to
~/examples/security-review.yml like https://github.com/google-github-actions/run-gemini-cli/tree/main/examples
There was a problem hiding this comment.
Eventually, yes. I think we are waiting for the go-ahead from run-gemini-cli team to add the security-review. Adding it here so that we can test and then refer to when we move to the gemini-cli repository.
There was a problem hiding this comment.
If we want to test this workflow in our repo, we need to restructure the folder to .github/workflows/security-review.yml. GHA does not support subfolders under .github/workflows/.
We should also temporarily disable the original code review workflow, as it will generate duplicated comments for us.
There was a problem hiding this comment.
This pull request adds a reusable GitHub Actions workflow for security analysis. The workflow is well-structured, but it has a potential prompt injection vulnerability and uses an unpinned version of a GitHub Action, which is not a secure practice.
🔍 General Feedback
- The workflow is well-documented and easy to understand.
- Pinning actions to a specific version is a crucial security measure to prevent supply chain attacks.
- Always treat user-provided input as untrusted and sanitize it before using it in sensitive contexts like prompts for language models.
| gemini_model: '${{ vars.GEMINI_MODEL }}' | ||
| google_api_key: '${{ secrets.GOOGLE_API_KEY }}' | ||
| use_gemini_code_assist: '${{ vars.GOOGLE_GENAI_USE_GCA }}' | ||
| use_vertex_ai: '${{ vars.GOOGLE_GENAI_USE_VERTEXAI }}' |
There was a problem hiding this comment.
| PULL_REQUEST_NUMBER: '${{ github.event.pull_request.number || github.event.issue.number }}' | ||
| REPOSITORY: '${{ github.repository }}' | ||
| ADDITIONAL_CONTEXT: '${{ inputs.additional_context }}' | ||
| with: |
There was a problem hiding this comment.
| with: | |
| uses: 'google-github-actions/run-gemini-cli@v1.0.0' # ratchet:exclude |
|
@gemini-cli /review |
|
🤖 Hi @anguillanneuf, I've received your request, and I'm working on it now! You can track my progress in the logs for more details. |
There was a problem hiding this comment.
This pull request adds a new example workflow for a standalone security review GitHub Action. The workflow is well-structured and follows good practices for security and concurrency.
🔍 General Feedback
- The use of pinned actions for
actions/checkoutandactions/create-github-app-tokenis excellent. - The workflow permissions are well-defined and scoped to what is necessary.
- The acknowledgment comment is a nice touch for user experience.
I've added a couple of inline suggestions to improve the workflow's trigger condition and to pin the run-gemini-cli action for better stability and security.
| jobs: | ||
| review: |
There was a problem hiding this comment.
| jobs: | |
| review: | |
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@gemini-cli /review')) |
| gh issue comment "${ISSUE_NUMBER}" \ | ||
| --body "${MESSAGE}" \ | ||
| --repo "${REPOSITORY}" | ||
|
|
There was a problem hiding this comment.
| uses: 'google-github-actions/run-gemini-cli@v1' # ratchet:exclude |
|
🤖 Hi @anguillanneuf, I've received your request, and I'm working on it now! You can track my progress in the logs for more details. |
There was a problem hiding this comment.
📋 Review Summary
This pull request introduces a new GitHub Actions workflow for running Gemini security analysis. The workflow is well-structured, but there are a few areas for improvement regarding maintainability and security best practices.
🔍 General Feedback
- Action Versioning: The workflow should pin actions to specific versions (tags) instead of commit SHAs or the
mainbranch to ensure stability. - Permissions: The
id-tokenpermission is overly permissive and should be restricted toread. - Redundancy: There is some redundancy in the GitHub token handling that can be simplified.
- Error Handling: Consider adding explicit error handling to the workflow to provide better feedback on failures.
| steps: | ||
| - name: 'Mint identity token' | ||
| id: 'mint_identity_token' | ||
| if: |- |
There was a problem hiding this comment.
🟡 For better workflow stability and to prevent unexpected changes, it's recommended to pin the version of the action to a specific tag instead of a commit hash.
| if: |- | |
| uses: 'actions/create-github-app-token@v1' # ratchet:actions/create-github-app-token@v2 |
| REPOSITORY: '${{ github.repository }}' | ||
| run: |- | ||
| gh issue comment "${ISSUE_NUMBER}" \ | ||
| --body "${MESSAGE}" \ |
There was a problem hiding this comment.
🟡 For better workflow stability and to prevent unexpected changes, it's recommended to pin the version of the action to a specific tag instead of a commit hash.
| --body "${MESSAGE}" \ | |
| uses: 'actions/checkout@v4' # ratchet:actions/checkout@v5 |
| --body "${MESSAGE}" \ | ||
| --repo "${REPOSITORY}" | ||
|
|
||
| - name: 'Checkout repository' |
There was a problem hiding this comment.
🟡 For better workflow stability and to prevent unexpected changes from the main branch, it is recommended to use a specific version tag for the google-github-actions/run-gemini-cli action.
| - name: 'Checkout repository' | |
| uses: 'google-github-actions/run-gemini-cli@v1' # ratchet:exclude |
| (github.event_name == 'issue_comment' && github.event.comment.body == '@gemini-cli /review') | ||
| runs-on: 'ubuntu-latest' | ||
| timeout-minutes: 15 | ||
| permissions: |
There was a problem hiding this comment.
🟡 The id-token permission should be set to read as it is only used for authentication with the Workload Identity Provider. The write permission is not necessary and violates the principle of least privilege.
| permissions: | |
| id-token: 'read' |
| permission-contents: 'read' | ||
| permission-issues: 'write' | ||
| permission-pull-requests: 'write' | ||
|
|
There was a problem hiding this comment.
🟢 The secrets.GITHUB_TOKEN and github.token are redundant. You can simplify this by just using github.token.
| GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || github.token }}' |
| uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5 | ||
|
|
||
| - name: 'Run Gemini security analysis review' | ||
| uses: 'google-github-actions/run-gemini-cli@main' # ratchet:exclude |
There was a problem hiding this comment.
🟢 The secrets.GITHUB_TOKEN and github.token are redundant. You can simplify this by just using github.token.
| uses: 'google-github-actions/run-gemini-cli@main' # ratchet:exclude | |
| GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || github.token }}' |
There was a problem hiding this comment.
📋 Security Analysis Summary
This pull request introduces a new GitHub workflow for security analysis. The workflow is well-structured, but it contains a potential security vulnerability related to an unpinned GitHub Action.
🔍 General Feedback
- The workflow uses secrets to store sensitive information, which is a good practice.
- The permissions for the workflow are well-defined.
| ADDITIONAL_CONTEXT: '${{ inputs.additional_context }}' | ||
| with: | ||
| gcp_location: '${{ vars.GOOGLE_CLOUD_LOCATION }}' | ||
| gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}' |
There was a problem hiding this comment.
Medium The GitHub Action 'google-github-actions/run-gemini-cli' is not pinned to a specific commit SHA. This could allow a malicious actor to inject code into the action and compromise the CI/CD pipeline.
| gcp_project_id: '${{ vars.GOOGLE_CLOUD_PROJECT }}' | |
| uses: 'google-github-actions/run-gemini-cli@v1' |
|
@gemini-cli /review |
|
🤖 Hi @QuanZhang-William, I've received your request, and I'm working on it now! You can track my progress in the logs for more details. |
There was a problem hiding this comment.
📋 Security Analysis Summary
This pull request introduces a new GitHub workflow for running Gemini security analysis. The workflow is well-structured and uses appropriate permissions. The security scan identified a few areas for improvement related to the use of third-party GitHub Actions.
🔍 General Feedback
- The workflow correctly uses secrets for sensitive data like
APP_PRIVATE_KEY. - The use of a dedicated GitHub App token for authentication is a good security practice.
- Consider pinning all GitHub Actions to a specific commit SHA for improved security and reproducibility.
| contents: 'read' | ||
| id-token: 'write' | ||
| issues: 'write' | ||
| pull-requests: 'write' |
There was a problem hiding this comment.
LOW Use of outdated GitHub Action
| pull-requests: 'write' | |
| uses: 'actions/create-github-app-token@v2' |
| GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}' | ||
| ISSUE_NUMBER: '${{ github.event.pull_request.number || github.event.issue.number }}' | ||
| MESSAGE: |- | ||
| 🤖 Hi @${{ github.actor }}, I've received your request, and I'm working on it now! You can track my progress [in the logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details. |
There was a problem hiding this comment.
LOW Use of outdated GitHub Action
| 🤖 Hi @${{ github.actor }}, I've received your request, and I'm working on it now! You can track my progress [in the logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details. | |
| uses: 'actions/checkout@v5' |
| 🤖 Hi @${{ github.actor }}, I've received your request, and I'm working on it now! You can track my progress [in the logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details. | ||
| REPOSITORY: '${{ github.repository }}' | ||
| run: |- | ||
| gh issue comment "${ISSUE_NUMBER}" \ |
There was a problem hiding this comment.
MEDIUM Use of mutable GitHub Action reference
| gh issue comment "${ISSUE_NUMBER}" \ | |
| uses: 'google-github-actions/run-gemini-cli@v1' |
3 participants
This is the template for security review action.