Proposal: Pin GitHub Actions to commit SHAs for supply-chain security#1474
Proposal: Pin GitHub Actions to commit SHAs for supply-chain security#1474ysknsid25 wants to merge 7 commits into
Conversation
|
@ysknsid25 is attempting to deploy a commit to the Open Circle Team on Vercel. A member of the Team first needs to authorize it. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThis pull request pins GitHub Actions to specific commit SHAs across the repository's CI, publish, and environment setup workflows. The environment composite action pins pnpm/action-setup, actions/setup-node, and denoland/setup-deno to SHAs. All checkout steps in ci.yml and publish.yml now use a pinned actions/checkout v6.0.2 SHA instead of floating 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Signed-off-by: ysknsid25 <kengo071225@gmail.com>
ysknsid25
force-pushed
the
chore/pin-github-actions-sha
branch
from
3b644e6 to
5a3f91d
Compare
Signed-off-by: ysknsid25 <kengo071225@gmail.com>
Signed-off-by: ysknsid25 <kengo071225@gmail.com>
dosubot
Bot
added
size:XS
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/ci.yml (1)
14-15: Consider settingpersist-credentials: falsefor additional supply-chain hardening.While SHA pinning prevents tag-rewrite attacks, the static analysis tool flags that checkout steps don't set
persist-credentials: false. When credentials persist in.git/config, they could potentially be exposed if build artifacts or caches are compromised. For workflows that don't need to push commits or tags, settingpersist-credentials: falseremoves this attack surface.Example hardening for checkout steps
- name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: falseThis is out of scope for SHA pinning but aligns with the PR's supply-chain security theme.
Also applies to: 24-25, 37-38, 50-51, 63-64, 76-77, 89-90, 102-103, 115-116, 128-129, 141-142
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 14 - 15, The checkout steps using "uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" should set persist-credentials: false to avoid leaving tokens in .git/config; update each Checkout repository step (all occurrences of the actions/checkout@... usage) to include a with: persist-credentials: false block so workflows that don't push won't retain credentials..github/workflows/publish.yml (1)
21-22: Consider settingpersist-credentials: falsefor publish workflows.The same credential persistence consideration from
ci.ymlapplies here. Since these publish jobs useid-token: writefor provenance and don't push commits, settingpersist-credentials: falseon checkout steps would reduce the attack surface.See the operational advice in the
ci.ymlreview for the pattern. This hardening is particularly relevant for publish workflows handling release credentials.Also applies to: 41-42, 55-56, 75-76, 94-95, 114-115
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish.yml around lines 21 - 22, The checkout steps labeled "Checkout repository" in the publish workflow currently use actions/checkout@de0fac2... and retain persisted credentials; update each of those checkout steps (all occurrences of the "Checkout repository" job steps in .github/workflows/publish.yml) to include persist-credentials: false so the runner does not leave GITHUB_TOKEN credentials around (these publish jobs already use id-token: write and do not push commits), applying the same change to every checkout instance noted in the review.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pinact.yml:
- Line 16: The checkout step using
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd should explicitly
disable credential persistence to avoid storing the GITHUB_TOKEN in local git
config; update the checkout step to include the input persist-credentials: false
(i.e., add persist-credentials: false under the actions/checkout step) so
credentials are not persisted for subsequent steps or artifacts.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 14-15: The checkout steps using "uses:
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" should set
persist-credentials: false to avoid leaving tokens in .git/config; update each
Checkout repository step (all occurrences of the actions/checkout@... usage) to
include a with: persist-credentials: false block so workflows that don't push
won't retain credentials.
In @.github/workflows/publish.yml:
- Around line 21-22: The checkout steps labeled "Checkout repository" in the
publish workflow currently use actions/checkout@de0fac2... and retain persisted
credentials; update each of those checkout steps (all occurrences of the
"Checkout repository" job steps in .github/workflows/publish.yml) to include
persist-credentials: false so the runner does not leave GITHUB_TOKEN credentials
around (these publish jobs already use id-token: write and do not push commits),
applying the same change to every checkout instance noted in the review.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 41b0cae5-8ba5-47cd-adea-2c490ddbe715
📒 Files selected for processing (5)
.github/actions/environment/action.yml.github/dependabot.yml.github/workflows/ci.yml.github/workflows/pinact.yml.github/workflows/publish.yml
Signed-off-by: ysknsid25 <kengo071225@gmail.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 5 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Signed-off-by: ysknsid25 <kengo071225@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pnpm-workspace.yaml`:
- Line 6: Replace the current minimumReleaseAge value (20160) with the required
default of 1 day (1440 minutes) in pnpm-workspace.yaml and add a commented
override showing a 7-day value (10080 minutes); specifically update the
minimumReleaseAge key to 1440 and add a commented line like "# alternative:
minimumReleaseAge: 10080" so the file reflects the PR requirements instead of
the 14-day setting.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f5066c75-1bb7-4d27-b5a8-dc087f1bc043
📒 Files selected for processing (1)
pnpm-workspace.yaml
ysknsid25
left a comment
ysknsid25
left a comment
There was a problem hiding this comment.
@fabian-hiller
I have an implementation question 🙏
fixed minimumReleaseAge 14 to 7 Signed-off-by: ysknsid25 <kengo071225@gmail.com>
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
2 participants
resolve: #1475
Summary by cubic
Pinned all GitHub Actions to commit SHAs and added a CI check to enforce pinning for better supply‑chain security. Set CI to use
pnpm11 and enforced a 7‑dayminimumReleaseAgeto avoid too‑new releases.New Features
pinactworkflow usingsuzuki-shunsuke/pinact-action@cf51507…to verify pins on PRs; fixedpersist-credentialsindentation.Dependencies
actions/checkouttode0fac2…(v6.0.2) across workflows.pnpm/action-setup@b906aff…(v4.3.0) withversion: 11,actions/setup-node@48b55a…(v6.4.0), anddenoland/setup-deno@667a34…(v2.0.4)..github/dependabot.ymlfor grouped monthlygithub-actionsupdates.Written for commit 05ea979. Summary will update on new commits.