Skip to content

ci(helios): Pin workflow dependencies #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ryancinsight merged 2 commits into from
Aug 12, 2026
Merged

ci(helios): Pin workflow dependencies #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1a159fa
ci(helios): Pin workflow dependencies
ryancinsight Aug 12, 2026
9a79ec4
ci(helios): Refresh Atlas workflow reference
ryancinsight Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/book-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,10 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803

- name: Configure Pages
uses: actions/configure-pages@v5
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b

- name: Install mdBook
env:
Expand Down Expand Up @@ -59,7 +59,7 @@ jobs:
test -f target/book/helios/html/index.html

- name: Upload Pages artifact
uses: actions/upload-pages-artifact@v4
uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b
with:
# mdbook writes the rendered site into an `html/` subdirectory, so
# uploading the parent puts no index.html at the artifact root and
Expand All @@ -83,4 +83,4 @@ jobs:
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v4
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e
32 changes: 16 additions & 16 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,12 +14,12 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 60
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
with:
fetch-depth: 0

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
with:
components: clippy, rustfmt

Expand All @@ -29,7 +29,7 @@ jobs:
tool: cargo-nextest@0.9.140,cargo-audit@0.22.2,cargo-deny@0.20.2

- name: Cache cargo dependencies
uses: actions/cache@v6
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
with:
path: |
~/.cargo/registry
Expand Down Expand Up @@ -68,16 +68,16 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
with:
fetch-depth: 0

- uses: actions/setup-python@v6
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
with:
python-version: "3.13"

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c

- name: Install binding verification tools
run: python -m pip install maturin==1.14.1 pytest==9.1.1
Expand Down Expand Up @@ -114,42 +114,42 @@ jobs:
helios-solver:scatter_superposition
steps:
- name: Checkout baseline
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
with:
ref: ${{ github.event.pull_request.base.sha }}
path: helios-baseline

- name: Checkout candidate
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
with:
path: helios-candidate
Comment on lines 122 to 125

@coderabbitai coderabbitai Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- workflow files ---'
git ls-files .github/workflows/ci.yml .github/workflows/book-pages.yml

printf '%s\n' '--- referenced checkout steps ---'
nl -ba .github/workflows/ci.yml | sed -n '1,170p'
printf '%s\n' '--- book-pages checkout ---'
nl -ba .github/workflows/book-pages.yml | sed -n '20,45p'

printf '%s\n' '--- checkout configuration and git-command usage ---'
rg -n -C 3 'actions/checkout@|persist-credentials|git (fetch|push|pull|submodule|config)|cargo (test|run|build)|python|benchmark|book' .github/workflows/ci.yml .github/workflows/book-pages.yml

Repository: ryancinsight/helios

Length of output: 13927

🌐 Web query:

actions/checkout persist-credentials false GITHUB_TOKEN .git/config README

💡 Result:

The persist-credentials input in actions/checkout controls whether the action configures Git to use the repository's access token (such as GITHUB_TOKEN) for subsequent Git operations performed within the job [1][2]. Behavior by Version: - In versions prior to the recent refactor (typically v5 and earlier), setting persist-credentials: true (the default) caused the action to write the authentication token directly into the repository's.git/config file [3]. - In current versions (notably v6+), the action has been improved to store credentials in a separate file located under $RUNNER_TEMP instead of directly in.git/config [1][2]. It uses Git's includeIf mechanism to conditionally reference this file [4][3]. Security Context: - When persist-credentials is set to true (the default), the token persists on the runner disk until post-job cleanup, enabling downstream steps to execute authenticated Git commands [1][3]. - Setting persist-credentials: false opts out of this behavior, preventing the action from writing the token to either.git/config or the temporary file, thereby reducing the credential's exposure surface [1][3]. - Note that setting this to false only affects the "persistence" of the token into Git configuration; it does not change the fact that the GITHUB_TOKEN itself remains available as an environment variable to all steps within the job [5]. If your goal is to minimize security risks, it is a recommended best practice to set persist-credentials: false if your workflow does not require authenticated Git operations in later steps [3].

Citations:

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- ci.yml: jobs, permissions, and checkout consumers ---'
cat -n .github/workflows/ci.yml | sed -n '1,340p'

printf '%s\n' '--- book-pages.yml ---'
cat -n .github/workflows/book-pages.yml | sed -n '1,100p'

printf '%s\n' '--- actions/checkout metadata at the pinned commit ---'
curl --fail --silent --show-error \
  https://raw.githubusercontent.com/actions/checkout/d23441a48e516b6c34aea4fa41551a30e30af803/action.yml

printf '%s\n' '--- actions/checkout source references at the pinned commit ---'
for file in src/input-helper.ts src/git-auth-helper.ts src/main.ts; do
  printf '\n--- %s ---\n' "$file"
  curl --fail --silent --show-error \
    "https://raw.githubusercontent.com/actions/checkout/d23441a48e516b6c34aea4fa41551a30e30af803/$file" \
    | grep -n -E -C 4 'persist-credentials|extraheader|GITHUB_TOKEN|configureAuth|removeAuth'
done

Repository: ryancinsight/helios

Length of output: 24116

🏁 Script executed:

#!/bin/bash
set -eu

python3 - <<'PY'
from pathlib import Path
import re

for name in (".github/workflows/ci.yml", ".github/workflows/book-pages.yml"):
    text = Path(name).read_text()
    print(f"--- {name} checkout blocks ---")
    lines = text.splitlines()
    for i, line in enumerate(lines):
        if "actions/checkout@" in line:
            start = max(0, i - 1)
            end = min(len(lines), i + 8)
            print("\n".join(f"{j+1}: {lines[j]}" for j in range(start, end)))
            print()
PY

Repository: ryancinsight/helios

Length of output: 2399

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- authentication implementation at the pinned commit ---'
curl --fail --silent --show-error \
  https://raw.githubusercontent.com/actions/checkout/d23441a48e516b6c34aea4fa41551a30e30af803/src/git-auth-helper.ts \
  | sed -n '45,145p;225,265p'

printf '%s\n' '--- action version and commit identity ---'
curl --fail --silent --show-error \
  https://api.github.com/repos/actions/checkout/commits/d23441a48e516b6c34aea4fa41551a30e30af803 \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); print(json.dumps({"sha": d.get("sha"), "message": d.get("commit",{}).get("message"), "date": d.get("commit",{}).get("committer",{}).get("date")}, indent=2))'

printf '%s\n' '--- tags pointing to or containing the pinned commit ---'
curl --fail --silent --show-error \
  'https://api.github.com/repos/actions/checkout/commits/d23441a48e516b6c34aea4fa41551a30e30af803/tags' \
  | python3 -c 'import json,sys; print("\n".join(x["name"] for x in json.load(sys.stdin)))'

printf '%s\n' '--- checkout README security guidance at the pinned commit ---'
curl --fail --silent --show-error \
  https://raw.githubusercontent.com/actions/checkout/d23441a48e516b6c34aea4fa41551a30e30af803/README.md \
  | grep -n -E -C 5 'persist-credentials|untrusted|token'

Repository: ryancinsight/helios

Length of output: 5555

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- configureToken implementation ---'
curl --fail --silent --show-error \
  https://raw.githubusercontent.com/actions/checkout/d23441a48e516b6c34aea4fa41551a30e30af803/src/git-auth-helper.ts \
  | grep -n -A55 -B8 'private async configureToken'

printf '%s\n' '--- callers that control credential persistence ---'
curl --fail --silent --show-error \
  https://raw.githubusercontent.com/actions/checkout/d23441a48e516b6c34aea4fa41551a30e30af803/src/git-source-provider.ts \
  | grep -n -E -A12 -B12 'persistCredentials|configureAuth|configureGlobalAuth|removeAuth'

printf '%s\n' '--- README guidance ---'
curl --fail --silent --show-error \
  https://raw.githubusercontent.com/actions/checkout/d23441a48e516b6c34aea4fa41551a30e30af803/README.md \
  | grep -n -E -A8 -B8 'persist-credentials'

Repository: ryancinsight/helios

Length of output: 9673

🏁 Script executed:

#!/bin/bash
set -eu

python3 - <<'PY'
from pathlib import Path
import re

for name in (".github/workflows/ci.yml", ".github/workflows/book-pages.yml"):
    text = Path(name).read_text()
    print(f"--- {name}: permissions and execution steps ---")
    for i, line in enumerate(text.splitlines(), 1):
        if re.search(r"(^|\s)(permissions:|pull_request:|push:|run:|uses:)", line):
            print(f"{i}: {line}")
PY

Repository: ryancinsight/helios

Length of output: 2957

Disable persisted credentials on every checkout.

actions/checkout defaults persist-credentials to true. At this pinned version, it stores the token in $RUNNER_TEMP and adds a local Git configuration reference in each checkout. Later repository-controlled commands can access the token. Add persist-credentials: false to all six checkout steps. Use a separately scoped credential only when a later authenticated Git operation requires one.

🧰 Tools
🪛 zizmor (1.29.0)

[warning] 122-125: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 2 files
  • .github/workflows/ci.yml#L122-L125 (this comment)
  • .github/workflows/book-pages.yml#L31-L31
  • .github/workflows/ci.yml#L17-L19
  • .github/workflows/ci.yml#L71-L73
  • .github/workflows/ci.yml#L117-L120
  • .github/workflows/ci.yml#L142-L146
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 122 - 125, Disable persisted
credentials on all six checkout steps by adding persist-credentials: false to
the checkout configurations at .github/workflows/ci.yml lines 17-19, 71-73,
117-120, 122-125, and 142-146, and .github/workflows/book-pages.yml line 31. Use
a separately scoped credential only for any later authenticated Git operation
that requires one.

Source: Linters/SAST tools


- name: Checkout candidate path dependencies
uses: ryancinsight/atlas/.github/actions/checkout-path-dependencies@1a7cdca7309f4a765b5bf644704521fa7c849208
uses: ryancinsight/atlas/.github/actions/checkout-path-dependencies@ceafa3d951f7db9ffcd93a79e5efbbdd09e199de
with:
manifest: helios-candidate/Cargo.toml
destination: .
atlas_ref: 1a7cdca7309f4a765b5bf644704521fa7c849208
atlas_ref: ceafa3d951f7db9ffcd93a79e5efbbdd09e199de

- name: Checkout historical baseline path dependencies
uses: ryancinsight/atlas/.github/actions/checkout-path-dependencies@1a7cdca7309f4a765b5bf644704521fa7c849208
uses: ryancinsight/atlas/.github/actions/checkout-path-dependencies@ceafa3d951f7db9ffcd93a79e5efbbdd09e199de
with:
manifest: helios-baseline/Cargo.toml
destination: .
atlas_ref: 1a7cdca7309f4a765b5bf644704521fa7c849208
atlas_ref: ceafa3d951f7db9ffcd93a79e5efbbdd09e199de

- name: Checkout Atlas benchmark gate
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
with:
repository: ryancinsight/atlas
ref: 1a7cdca7309f4a765b5bf644704521fa7c849208
ref: ceafa3d951f7db9ffcd93a79e5efbbdd09e199de
path: atlas-tool

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c

- name: Cache cargo dependencies
uses: actions/cache@v6
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
with:
path: |
~/.cargo/registry
Expand Down
Loading