Fix GraphQl relevant missmatch while perform searching on graphql #65
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,7 +8,7 @@ on: | |
| jobs: | ||
| static: | ||
| name: M2 Coding Standard | ||
| runs-on: ubuntu-22.04 | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - uses: extdn/github-actions-m2/magento-coding-standard/8.4@master | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== workflow snippet =="
if [ -f .github/workflows/coding-standard.yml ]; then
cat -n .github/workflows/coding-standard.yml | sed -n '1,80p'
else
echo "workflow not found"
fi
echo
echo "== search for mage/m2 coding standard usage =="
rg -n "magento-coding-standard|m2/magento-coding-standard|extdn/magento|coding-standard" .github README.md . 2>/dev/null | head -n 200Repository: tuyennn/magento2-outofstockatlast Length of output: 1184 🌐 Web query:
💡 Result: The repository github.com/extdn/github-actions-m2 provides various GitHub Actions for Magento 2 extension testing, but it does not contain an action specifically named "magento-coding-standard/8.4" [1][2]. Regarding your query: 1. Magento Coding Standard: The ExtDN repository provides a general "magento-coding-standard" action, which typically executes the latest version of the official Magento Coding Standard [1][2]. It is not versioned by PHP version (e.g., 8.4) in the same way some other actions in the repository are [1][2]. 2. Versioned Actions: The repository does maintain versioned paths for other tools, such as "magento-mess-detector" and "magento-integration-tests," which include specific subdirectories for different PHP versions (e.g., 8.4) [1][3]. 3. PHP 8.4 Support: While the official magento/magento-coding-standard has added support for PHP 8.4 [4], if you need to run it in a workflow on PHP 8.4, it is common practice to use a standard setup (e.g., shivammathur/setup-php) to configure the environment and then execute the coding standard directly [5][6]. If you are seeing references to specific "8.4" action YAML files in that repository, they likely refer to the "magento-mess-detector" or similar tools that have implemented multi-version support, rather than the coding standard action itself [3]. Citations:
🌐 Web query:
💡 Result: The repository extdn/github-actions-m2 provides GitHub Actions for Magento 2, including support for running Magento Coding Standard [1][2]. Regarding your specific request for a version associated with "8.4," the repository recently added support for PHP 8.4 environments in its internal actions. Specifically, as of July 2026, the repository includes Citations:
🌐 Web query:
💡 Result: There is no official Dockerfile provided directly under the path extdn/github-actions-m2/magento-coding-standard/8.4 in the ExtDN GitHub repository. The ExtDN project provides a GitHub Action that simplifies the execution of Magento Coding Standard in CI/CD pipelines [1][2]. The ExtDN Magento Coding Standard action uses pre-built Docker images hosted on Docker Hub under the repository extdn/magento-coding-standard-action [3]. These images are maintained and updated via the ExtDN GitHub Action workflow processes [4][5]. To use the Magento Coding Standard in your GitHub workflow, you should reference the action in your.github/workflows/coding-standard.yml file as follows [1][6]: name: ExtDN M2 Coding Standard on: push: branches: - master pull_request: jobs: static: name: M2 Coding Standard runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: extdn/github-actions-m2/magento-coding-standard@master If you are looking for a Docker environment to run these checks locally, you can pull the official images directly from Docker Hub [3]. As of July 2026, images are tagged by version (e.g., 8.3-latest), and you can use the following command to pull and run them [3]: docker pull extdn/magento-coding-standard-action:8.3-latest docker run --rm -v $(pwd):/app extdn/magento-coding-standard-action:8.3-latest [options] For direct usage within a project, the standard recommendation remains installing the Magento Coding Standard via Composer as a dev dependency [7]: composer require --dev magento/magento-coding-standard Then, you can execute it using vendor/bin/phpcs --standard=Magento2 [7]. Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== GitHub ref/action.yml lookup =="
python3 - <<'PY'
import urllib.request
base = "https://raw.githubusercontent.com/extdn/github-actions-m2/master/magento-coding-standard/8.4/"
for path in ["action.yml", "action.yaml", "Dockerfile", "Dockerfile.84", "Dockerfile.8.4", "Dockerfile:8.4"]:
url = base + path
try:
with urllib.request.urlopen(url, timeout=20) as r:
print(f"\n--- {path} ({r.getcode()}) ---")
text = r.read().decode("utf-8", "replace")
print(text[:1200])
if "image:" in text or "docker://" in text or "-t " in text or "FROM " in text:
print("[contains docker/action image config]")
except Exception as e:
print(f"{path}: {type(e).__name__}: {e}")
PYRepository: tuyennn/magento2-outofstockatlast Length of output: 1160 🏁 Script executed: #!/bin/bash
set -euo pipefail
python3 - <<'PY'
import urllib.request
opts = {"https_client_cert_reqs": 0}
base = "https://raw.githubusercontent.com/extdn/github-actions-m2/master/magento-coding-standard/8.4/"
for path in ["action.yml", "action.yaml", "Dockerfile", "Dockerfile.84", "Dockerfile.8.4", "Dockerfile:8.4"]:
url = base + path
try:
req = urllib.request.Request(url)
req.add_header("User-Agent", "CodeRabbit verification")
with urllib.request.urlopen(req, timeout=30) as r:
print(f"\n--- {path} ({r.getcode()}) ---")
print(r.read().decode("utf-8", "replace")[:2000])
except Exception as e:
print(f"{path}: {type(e).__name__}: {e}")
PYRepository: tuyennn/magento2-outofstockatlast Length of output: 1125 🌐 Web query:
💡 Result: The resource path you specified, raw.githubusercontent.com/extdn/github-actions-m2/master/magento-coding-standard/8.4/action.yml, refers to a specific GitHub Action configuration file within the ExtDN GitHub Actions for Magento 2 repository [1][2]. The ExtDN Citations:
🌐 Web query:
💡 Result: The URL provided refers to a specific version of a GitHub Action within the extdn/github-actions-m2 repository [1][2]. This repository, maintained by the Extension Developer Network (ExtDN), provides a suite of GitHub Actions designed to assist developers in automating tasks for Magento 2 projects, including testing against the Magento Coding Standard [1][3]. The Citations:
🌐 Web query:
💡 Result: The extdn/github-actions-m2 repository provides GitHub Actions for Magento projects, including support for Magento Coding Standard and other static analysis tools like PHPStan [1][2]. Regarding PHP 8.4 support: 1. Docker Image Builds: The repository's workflow configuration (.github/workflows/phpstan-images.yml) explicitly includes 8.4 and 8.5 in its strategy matrix for building Docker images [3][4]. This indicates that the infrastructure for supporting PHP 8.4 exists within the project's build pipeline [3][4]. 2. Usage: You can typically reference these actions in your.github/workflows/coding-standard.yml file using syntax similar to: - uses: extdn/github-actions-m2/magento-coding-standard@master [1][2] 3. Implementation: These actions generally function by wrapping Docker containers that execute the required analysis tools [5]. When using these actions, ensure your environment is configured to handle the specific requirements of the version you are targeting [5]. If you encounter issues such as dependency errors (e.g., PHPCompatibility sniff errors), it is often due to changes in upstream dependencies within the Magento Coding Standard itself [6]. The project relies on standard GitHub Action workflows and Docker-based execution, which allows for testing against multiple PHP versions via the matrix strategy defined in the source repository [3][4]. Citations:
🌐 Web query:
💡 Result: The GitHub repository extdn/github-actions-m2 provides automated GitHub Actions for Magento 2 projects, including a specific action for executing the Magento Coding Standard [1][2][3]. The specific file path you referenced, magento-coding-standard/8.4/action.yml, refers to a versioned directory within this repository that encapsulates the configuration for running the Magento Coding Standard [1]. In the context of this repository, these versioned folders (such as 8.4) typically correspond to specific configurations or releases designed to be compatible with particular PHP versions or dependency sets of the Magento Coding Standard [4][5]. Key points regarding this action: - Purpose: It allows developers to integrate static code analysis into their GitHub workflows to ensure their Magento 2 code adheres to established community coding standards [3][6]. - Usage: It is commonly invoked in a GitHub Actions workflow file (e.g.,.github/workflows/coding-standard.yml) [1][3]. - Context: The Magento Coding Standard itself is a set of rules for the PHP_CodeSniffer tool, maintained by the Magento community to ensure code quality [7][8]. If you are encountering issues using a specific version like 8.4, it may be due to dependency changes in the underlying Magento Coding Standard package, which has historically required updates to how Citations:
🌐 Web query:
💡 Result: The extdn/magento-coding-standard-action is a Docker image maintained by the Extension Developer Network (ExtDN), used primarily for running the Magento Coding Standard checks in automated environments like GitHub Actions [1]. There is no public "action.yml" file associated with the extdn/magento-coding-standard-action repository itself, as it is a Docker container image hosted on Docker Hub rather than a composite or JavaScript GitHub Action [1]. If you are looking to integrate Magento Coding Standard checks into a GitHub workflow, the recommended approach by ExtDN is to use their GitHub Actions repository, extdn/github-actions-m2 [2][3][4]. That repository provides a GitHub Action that leverages the Magento Coding Standard [2]. You can implement it in your project by creating a workflow file (e.g.,.github/workflows/coding-standard.yml) with the following step [2][5]: - uses: extdn/github-actions-m2/magento-coding-standard@master Regarding the version tag "8.4-latest" you mentioned, this corresponds to a tag for the Docker image extdn/magento-coding-standard-action on Docker Hub [1]. You can pull or reference this specific version in a Docker-based workflow using: docker pull extdn/magento-coding-standard-action:8.4-latest [1] Note that if you are using the GitHub Action directly via extdn/github-actions-m2, you typically do not need to interact with the Docker image tags manually unless you are maintaining or extending that specific action [2][1]. Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== Docker Hub tags for extdn/magento-coding-standard-action =="
python3 - <<'PY'
import json, urllib.request
url = "https://hub.docker.com/v2/repositories/extdn/magento-coding-standard-action/tags/?page_size=120"
req = urllib.request.Request(url)
req.add_header("User-Agent", "CodeRabbit verification")
with urllib.request.urlopen(req, timeout=30) as r:
data = json.load(r)
print("count:", data.get("count"))
tags = [x["name"] for x in data.get("results", [])]
for name in ["8.4-latest", "8.3-latest", "8.2-latest", "latest"]:
print(f"{name}:", name in tags)
for t in tags[:80]:
print(t)
print("...last:", tags[-20:] if len(tags) >= 20 else tags[-10:])
PY
echo
echo "== try Docker Hub image digest for 8.4-latest (no auth) =="
python3 - <<'PY'
import json, urllib.request
for api in [
"https://hub.docker.com/v2/repositories/extdn/magento-coding-standard-action/8.4-latest",
]:
try:
req = urllib.request.Request(api)
req.add_header("User-Agent", "CodeRabbit verification")
with urllib.request.urlopen(req, timeout=30) as r:
data = json.load(r)
print(api)
print(f" status: {data.get('status')}")
print(f" full_length: {data.get('full_length')}")
print(f" digest: {data.get('digest')}")
except Exception as e:
print(f"{api}: {type(e).__name__}: {e}")
PYRepository: tuyennn/magento2-outofstockatlast Length of output: 2520 Pin the coding-standard action and container image immutably.
🤖 Prompt for AI Agents |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: tuyennn/magento2-outofstockatlast
Length of output: 762
🌐 Web query:
actions/checkout persist-credentials default true untrusted third party action GitHub security best practices💡 Result:
In GitHub Actions, the actions/checkout action defaults to
persist-credentials: true[1][2]. This setting configures the local Git environment by storing the authentication token (typically GITHUB_TOKEN) in a way that allows subsequent Git commands (e.g.,git push,git fetch) to run automatically [1][2]. Security best practices, as documented by organizations like OWASP and security auditors, strongly recommend settingpersist-credentials: falseunless your workflow explicitly requires authenticated Git operations [3][4][5]. The primary security concerns regarding this default behavior include: Credential Exposure: When enabled, the authentication token is available for all subsequent steps in the same job [6][3][4]. If a compromised third-party action or malicious script runs later in the job, it can potentially access and abuse these credentials [3][4][7]. Artifact Leakage: There is a historical risk of inadvertently leaking these persisted credentials if the repository directory is bundled and uploaded as a job artifact, making the credentials accessible to anyone who can download the artifact [3][7]. While recent versions ofactions/checkouthave improved security by storing the token in a temporary location ($RUNNER_TEMP) rather than directly in.git/config, the underlying principle of least privilege remains paramount [1][2]. Mitigation Strategy: To adhere to security best practices, you should explicitly disable this feature in your workflow files: - uses: actions/checkout@v4 with: persist-credentials: false If your workflow requires authenticated Git operations, evaluate whether you can use minimal GITHUB_TOKEN permissions or if the task can be achieved via API calls rather than persistent Git credentials [3]. Always prioritize the principle of least privilege by restricting token permissions to the minimum necessary for the job [3][4].Citations:
persist-credentialsor change the default tofalseactions/checkout#485Disable checkout credential persistence.
The workflow runs a third-party Docker action after checkout, while checkout’s default token persistence is unnecessary because no later Git operation needs the token. Set
persist-credentials: falsefor this checkout step.Proposed fix
📝 Committable suggestion
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 13-13: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Source: Linters/SAST tools