feat(deploy): link de playtest no GitHub Pages #275
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,9 +2,9 @@ name: CI | |
|
|
||
| on: | ||
| push: | ||
| branches: [main, preview] | ||
| pull_request: | ||
| branches: [main, preview] | ||
|
|
||
| jobs: | ||
| ci: | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| name: Pages | ||
|
|
||
| on: | ||
| push: | ||
| branches: [preview] | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: read | ||
| pages: write | ||
| id-token: write | ||
|
|
||
| concurrency: | ||
| group: pages | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: sed -n '1,220p' .github/workflows/pages.yml
printf '\n--- workflow references ---\n'
rg -n "persist-credentials|actions/checkout|github-pages|upload-pages-artifact|deploy-pages|npm|pnpm|yarn|dist|build" .github/workflows .github 2>/dev/null | head -200Repository: Dhinihan/fdp-online Length of output: 3162 🌐 Web query:
💡 Result: The persist-credentials input in the actions/checkout GitHub Action controls whether the action configures the repository's local Git configuration to use an authentication token (or SSH key) for subsequent Git operations [1][2]. When set to true (which is the default), actions/checkout automatically configures the local Git environment so that your workflow steps can run authenticated Git commands (e.g., git push, git pull, or fetching submodules) without needing to manually manage credentials [1][2][3]. How it works: 1. Configuration: By default, the action adds authentication credentials (such as an Authorization header for HTTPS or SSH key details) to the repository's Git configuration [2][3][4]. 2. Storage Location: In versions prior to v6, this was typically written directly into the local.git/config file [3]. From version v6 onwards, the action was updated to store these credentials in a temporary file (under $RUNNER_TEMP), and the local.git/config points to that file [5][3]. This change helps prevent accidental leakage of credentials if the repository workspace is uploaded as an artifact [3]. 3. Cleanup: The action includes a post-job step that removes these credentials [1][2]. Why you might set it to false: Setting persist-credentials: false is a recommended security best practice if your workflow steps do not require performing authenticated Git operations [3]. Disabling it prevents the injection of these credentials, which reduces the surface area for potential credential exposure and avoids conflicts with other tools (like the GitHub CLI's gh auth setup-git) that might attempt to manage Git credentials differently [3][4]. In summary, if you do not need to run authenticated git commands in subsequent steps of your job, you should explicitly set persist-credentials: false [6][3]. Citations:
🏁 Script executed: printf '%s\n' '--- package manifests ---'
fd -i -t f 'package.json|pnpm-lock.yaml|vite.config.*|astro.config.*|next.config.*|nuxt.config.*' . --max-depth 4 -x sh -c 'echo "--- $1"; sed -n "1,220p" "$1"' sh {}
printf '%s\n' '--- workflow and repository permission references ---'
rg -n "GITHUB_TOKEN|github.token|contents:|pull_request_target|workflow_dispatch|build:pages|dist|process\.env|\.git/config" --glob '!pnpm-lock.yaml' --glob '!node_modules' .Repository: Dhinihan/fdp-online Length of output: 20184 🏁 Script executed: python3 - <<'PY'
from pathlib import Path
import re
import urllib.request
workflow = Path(".github/workflows/pages.yml").read_text()
package = Path("package.json").read_text()
required = {
"checkout": r"- uses:\s*actions/checkout@v4",
"install": r"- run:\s*pnpm install --frozen-lockfile",
"build": r"- run:\s*pnpm build:pages",
"artifact": r"path:\s*dist",
"contents": r"contents:\s*read",
"pages": r"pages:\s*write",
"oidc": r"id-token:\s*write",
}
for name, pattern in required.items():
print(f"{name}: {bool(re.search(pattern, workflow))}")
positions = {
name: workflow.index(match.group(0))
for name, pattern in required.items()
if (match := re.search(pattern, workflow))
}
print("install_before_build:", positions["install"] < positions["build"])
print("build_before_artifact:", positions["build"] < positions["artifact"])
print("pages_script_present:", '"build:pages": "tsc && vite build --base=/fdp-online/"' in package)
print("persist_credentials_explicitly_false:",
bool(re.search(r"persist-credentials:\s*false", workflow)))
url = "https://raw.githubusercontent.com/actions/checkout/v4/action.yml"
try:
action = urllib.request.urlopen(url, timeout=10).read().decode()
match = re.search(r"persist-credentials:\s*\n\s*description:.*?\n\s*default:\s*(\w+)",
action, re.S)
print("checkout_v4_default_persist_credentials:",
match.group(1) if match else "not found")
except Exception as exc:
print("checkout_v4_default_persist_credentials: unavailable", type(exc).__name__)
PYRepository: Dhinihan/fdp-online Length of output: 439 Disable checkout credential persistence. The workflow runs repository-controlled 🧰 Tools🪛 zizmor (1.29.0)[warning] 21-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| - uses: pnpm/action-setup@v4 | ||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version-file: '.nvmrc' | ||
| cache: 'pnpm' | ||
| - run: pnpm install --frozen-lockfile | ||
| - run: pnpm build:pages | ||
|
There was a problem hiding this comment.
On a AGENTS.md reference: AGENTS.md:L10-L16 Useful? React with 👍 / 👎. |
||
| - uses: actions/upload-pages-artifact@v3 | ||
| with: | ||
| path: dist | ||
|
|
||
| deploy: | ||
| needs: build | ||
| runs-on: ubuntu-latest | ||
| environment: | ||
| name: github-pages | ||
| url: ${{ steps.deployment.outputs.page_url }} | ||
| steps: | ||
| - id: deployment | ||
| uses: actions/deploy-pages@v4 | ||
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: Dhinihan/fdp-online
Length of output: 3539
🌐 Web query:
Official GitHub Pages deployment workflow documentation and actions/deploy-pages README job-level permissions requirements for actions/upload-pages-artifact and actions/deploy-pages💡 Result:
For a GitHub Pages deployment workflow using the official GitHub Actions, the job responsible for the deployment requires specific job-level permissions to function correctly [1][2]. Job-Level Permissions Requirements The deployment job must grant the GITHUB_TOKEN the following minimum permissions [1][3]: - pages: write (required to create the Pages deployment via the GitHub API) [2][4] - id-token: write (required to request the OIDC JWT token used to verify the deployment's origin and respect environment protection rules) [2][4] Example Workflow Configuration To implement these requirements, you must explicitly set the permissions block within your deployment job: jobs: deploy: runs-on: ubuntu-latest permissions: pages: write # Required for deployment id-token: write # Required for OIDC token environment: name: github-pages url: ${{ steps.deployment.outputs.page_url }} steps: - name: Deploy to GitHub Pages id: deployment uses: actions/deploy-pages@v4 Additional Requirements - Artifact Upload: The deployment job must have access to an artifact uploaded by a previous step (typically using actions/upload-pages-artifact) [3]. If using a separate job to build, the deployment job must define a needs: build dependency [1][2]. - Environment Configuration: You must specify an environment (commonly github-pages) to allow the workflow to enforce branch and deployment protection rules [1][2]. - actions/upload-pages-artifact: This action itself does not require specific job-level permissions to function [5][6]. Its role is to package and upload the static assets as a compliant gzip archive [5][7]. The permissions listed above are specific to the deployment phase handled by actions/deploy-pages [2][3].
Citations:
Scope Pages permissions to the deploy job.
The
buildjob only needscontents: read. Movepages: writeandid-token: writeto thedeployjob, which callsactions/deploy-pages.🧰 Tools
🪛 zizmor (1.29.0)
[error] 10-10: overly broad permissions (excessive-permissions): pages: write is overly broad at the workflow level
(excessive-permissions)
[error] 11-11: overly broad permissions (excessive-permissions): id-token: write is overly broad at the workflow level
(excessive-permissions)
🤖 Prompt for AI Agents
Source: Linters/SAST tools
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sobre o bump do
upload-pages-artifactv3 → v5 (nitpick da review de 22:18): fica fora deste PR de propósito. Ele é uma das cinco linhas da issue #276, que cataloga todas as actions ainda mirando Node 20. Subir oupload-pages-artifactsem odeploy-pagescorrespondente separa um par que a GitHub versiona junto, então os cinco bumps vão juntos lá, com changelog lido.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@Dhinihan, entendido. O bump deactions/upload-pages-artifactpermanece fora deste PR e será tratado em conjunto na issue#276.Essa decisão não altera a observação sobre escopo de permissões em
.github/workflows/pages.yml. O comentário permanece aberto para esse ponto independente.🐇
✏️ Learnings added
You are interacting with an AI system.