Harden CI steps - #13236
Conversation
|
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThis PR hardens GitHub Actions workflow security by adding explicit minimal permissions, disabling credential persistence, and pinning action versions to commit SHAs across 14 workflows. It introduces a new zizmor security analysis workflow, integrates post-release devtools error code updates into the release workflow (replacing a standalone workflow), and configures Dependabot to delay successive npm update pull requests by 7 days. ChangesGitHub Actions Security Hardening
New Zizmor Security Analysis Workflow
Post-Release Devtools Integration
Dependency Management Configuration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
commit: |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
172-172: ⚡ Quick winInconsistent version comment formatting.
The version comments at lines 172 and 178 use
#v3and#v1without a space before the version number. This is inconsistent with the formatting used in other workflow files (e.g., line 32 uses# v6, line 46 uses# v6, line 58 uses# v1) and in prerelease.yml line 25 which uses# v3.📝 Proposed fix for formatting consistency
- - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 `#v3` + - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3- - uses: benc-uk/workflow-dispatch@7a027648b88c2413826b6ddd6c76114894dc5ec4 `#v1` + - uses: benc-uk/workflow-dispatch@7a027648b88c2413826b6ddd6c76114894dc5ec4 # v1Also applies to: 178-178
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml at line 172, Update the inline version comment formatting to include a space before the version number for consistency; change the comment on the actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 occurrence (currently "#v3") to "# v3" and similarly change the other action comment (the one flagged as "#v1") to "# v1" so all workflow action comments match the existing "# vX" style used elsewhere.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/change-prerelease-tag.yml:
- Line 43: The workflow currently sets persist-credentials: false which prevents
the GitHub App token from being stored and makes the later git push (the step
that runs git push) fail; fix by either removing the persist-credentials: false
setting from the checkout step so the token provided by
steps.github-actions-bot-app-token.outputs.token persists for subsequent git
operations, or keep persist-credentials: false but add a git remote
reconfiguration before the push (run a command to set origin to
https://x-access-token:${{ steps.github-actions-bot-app-token.outputs.token
}}@github.com/${{ github.repository }}) so the push uses the App token; apply
the same change to the other affected workflows (prerelease.yml and
exit-prerelease.yml) as well.
In @.github/workflows/exit-prerelease.yml:
- Line 38: The workflow sets actions/checkout with persist-credentials: false
which prevents credentials from being available for the subsequent git push;
before the git push step (the push command referenced in the workflow) either
re-configure git credentials by setting the origin URL to include the token from
steps.github-actions-bot-app-token.outputs.token (using git remote set-url
origin https://x-access-token:${{
steps.github-actions-bot-app-token.outputs.token }}@github.com/${{
github.repository }}) or remove persist-credentials: false from the
actions/checkout invocation so credentials are persisted; update the workflow to
perform one of these fixes so the git push succeeds.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Line 172: Update the inline version comment formatting to include a space
before the version number for consistency; change the comment on the
actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3
occurrence (currently "#v3") to "# v3" and similarly change the other action
comment (the one flagged as "#v1") to "# v1" so all workflow action comments
match the existing "# vX" style used elsewhere.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: e97bea3d-b1e1-4761-8fec-e8ae7a9bfa9c
📒 Files selected for processing (18)
.github/dependabot.yml.github/workflows/api-extractor.yml.github/workflows/arethetypeswrong.yml.github/workflows/change-prerelease-tag.yml.github/workflows/cleanup-checks.yml.github/workflows/compare-build-output.yml.github/workflows/copilot-setup-steps.yml.github/workflows/devtools-errorcodes.yml.github/workflows/docmodel.yml.github/workflows/exit-prerelease.yml.github/workflows/knip.yml.github/workflows/prerelease.yml.github/workflows/publish-pr-releases.yml.github/workflows/release.yml.github/workflows/scheduled-test-canary.yml.github/workflows/size-limit.yml.github/workflows/sync-skill.yml.github/workflows/zizmor.yml
💤 Files with no reviewable changes (1)
- .github/workflows/devtools-errorcodes.yml
✅ Docs preview has no changesThe preview was not built because there were no changes. Build ID: 6f878c58f5a8b9c13b1a5cd8 ✅ AI Style Review — No Changes DetectedNo MDX files were changed in this pull request. Review Log: View detailed log
|
| node-version: ">=23.6.0" | ||
|
|
||
| - name: Install dependencies (with cache) | ||
| uses: bahmutov/npm-install@v1 |
There was a problem hiding this comment.
Should we even use this action anymore? actions/setup-node has a built-in cache so might be best to use that one. Thoughts?
There was a problem hiding this comment.
Very happy if we get rid of it, I just didn't want to do everything in one PR
| - name: Run comparison script | ||
| id: attw | ||
| run: ./config/compare-build-output-to.sh $(git merge-base HEAD origin/${{ github.base_ref }}) | tee $GITHUB_STEP_SUMMARY | ||
| run: ./config/compare-build-output-to.sh $(git merge-base HEAD origin/${GITHUB_BASE_REF}) | tee $GITHUB_STEP_SUMMARY |
There was a problem hiding this comment.
Out of curiosity, whats the difference here and why is the env variable better?
There was a problem hiding this comment.
This was an autofix if I remember correctly, so I didn't dig too deep into this, but apparently {{ }} can be used for command injection into the command being built while env variables get expanded by the shell. So if you had ; or | in your branch name, you could start a new command I guess?
There was a problem hiding this comment.
Will we need to manually trigger this in future releases?
Edit: Nevermind, I see it added to a different workflow below
jerelmiller
left a comment
jerelmiller
left a comment
There was a problem hiding this comment.
Generally looks good! Had a few questions, but let's get this in.
| app-id: 819772 | ||
| private-key: ${{ secrets.APOLLO_GITHUB_ACTIONS_BOT_PRIVATE_KEY }} | ||
| repositories: apollo-client-devtools | ||
| - uses: benc-uk/workflow-dispatch@7a027648b88c2413826b6ddd6c76114894dc5ec4 # v1 |
3 participants
Summary by CodeRabbit
New Features
Chores