ci(helios): Pin workflow dependencies - #49
Conversation
|
Warning Review limit reached
Next review available in: 47 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe pull request replaces mutable GitHub Actions tags with commit SHAs in the Pages and CI workflows. It also updates benchmark-related Atlas and benchmark-gate revisions. ChangesWorkflow action pinning
Estimated code review effort: 1 (Trivial) | ~5 minutes Mergeability Score: 🟡 Moderate · up to The workflows pin action versions but still persist checkout credentials across six steps, allowing later repository-controlled commands to access the workflow token. Merge should wait until credentials are disabled or the risk is explicitly accepted. Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 122-125: Disable persisted credentials on all six checkout steps
by adding persist-credentials: false to the checkout configurations at
.github/workflows/ci.yml lines 17-19, 71-73, 117-120, 122-125, and 142-146, and
.github/workflows/book-pages.yml line 31. Use a separately scoped credential
only for any later authenticated Git operation that requires one.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: ae6c06b2-1a1f-4275-9f3a-5bc931e225e4
📒 Files selected for processing (2)
.github/workflows/book-pages.yml.github/workflows/ci.yml
| - name: Checkout candidate | ||
| uses: actions/checkout@v6 | ||
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 | ||
| with: | ||
| path: helios-candidate |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow files ---'
git ls-files .github/workflows/ci.yml .github/workflows/book-pages.yml
printf '%s\n' '--- referenced checkout steps ---'
nl -ba .github/workflows/ci.yml | sed -n '1,170p'
printf '%s\n' '--- book-pages checkout ---'
nl -ba .github/workflows/book-pages.yml | sed -n '20,45p'
printf '%s\n' '--- checkout configuration and git-command usage ---'
rg -n -C 3 'actions/checkout@|persist-credentials|git (fetch|push|pull|submodule|config)|cargo (test|run|build)|python|benchmark|book' .github/workflows/ci.yml .github/workflows/book-pages.ymlRepository: ryancinsight/helios
Length of output: 13927
🌐 Web query:
actions/checkout persist-credentials false GITHUB_TOKEN .git/config README
💡 Result:
The persist-credentials input in actions/checkout controls whether the action configures Git to use the repository's access token (such as GITHUB_TOKEN) for subsequent Git operations performed within the job [1][2]. Behavior by Version: - In versions prior to the recent refactor (typically v5 and earlier), setting persist-credentials: true (the default) caused the action to write the authentication token directly into the repository's.git/config file [3]. - In current versions (notably v6+), the action has been improved to store credentials in a separate file located under $RUNNER_TEMP instead of directly in.git/config [1][2]. It uses Git's includeIf mechanism to conditionally reference this file [4][3]. Security Context: - When persist-credentials is set to true (the default), the token persists on the runner disk until post-job cleanup, enabling downstream steps to execute authenticated Git commands [1][3]. - Setting persist-credentials: false opts out of this behavior, preventing the action from writing the token to either.git/config or the temporary file, thereby reducing the credential's exposure surface [1][3]. - Note that setting this to false only affects the "persistence" of the token into Git configuration; it does not change the fact that the GITHUB_TOKEN itself remains available as an environment variable to all steps within the job [5]. If your goal is to minimize security risks, it is a recommended best practice to set persist-credentials: false if your workflow does not require authenticated Git operations in later steps [3].
Citations:
- 1: https://github.com/actions/checkout?tab=readme-ov-file
- 2: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 3: Set
persist-credentials: falseon checkout steps cli/go-gh#225 - 4: https://github.com/actions/checkout/pull/2286/files
- 5: Remove
persist-credentialsor change the default tofalseactions/checkout#485
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- ci.yml: jobs, permissions, and checkout consumers ---'
cat -n .github/workflows/ci.yml | sed -n '1,340p'
printf '%s\n' '--- book-pages.yml ---'
cat -n .github/workflows/book-pages.yml | sed -n '1,100p'
printf '%s\n' '--- actions/checkout metadata at the pinned commit ---'
curl --fail --silent --show-error \
https://raw.githubusercontent.com/actions/checkout/d23441a48e516b6c34aea4fa41551a30e30af803/action.yml
printf '%s\n' '--- actions/checkout source references at the pinned commit ---'
for file in src/input-helper.ts src/git-auth-helper.ts src/main.ts; do
printf '\n--- %s ---\n' "$file"
curl --fail --silent --show-error \
"https://raw.githubusercontent.com/actions/checkout/d23441a48e516b6c34aea4fa41551a30e30af803/$file" \
| grep -n -E -C 4 'persist-credentials|extraheader|GITHUB_TOKEN|configureAuth|removeAuth'
doneRepository: ryancinsight/helios
Length of output: 24116
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
for name in (".github/workflows/ci.yml", ".github/workflows/book-pages.yml"):
text = Path(name).read_text()
print(f"--- {name} checkout blocks ---")
lines = text.splitlines()
for i, line in enumerate(lines):
if "actions/checkout@" in line:
start = max(0, i - 1)
end = min(len(lines), i + 8)
print("\n".join(f"{j+1}: {lines[j]}" for j in range(start, end)))
print()
PYRepository: ryancinsight/helios
Length of output: 2399
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- authentication implementation at the pinned commit ---'
curl --fail --silent --show-error \
https://raw.githubusercontent.com/actions/checkout/d23441a48e516b6c34aea4fa41551a30e30af803/src/git-auth-helper.ts \
| sed -n '45,145p;225,265p'
printf '%s\n' '--- action version and commit identity ---'
curl --fail --silent --show-error \
https://api.github.com/repos/actions/checkout/commits/d23441a48e516b6c34aea4fa41551a30e30af803 \
| python3 -c 'import json,sys; d=json.load(sys.stdin); print(json.dumps({"sha": d.get("sha"), "message": d.get("commit",{}).get("message"), "date": d.get("commit",{}).get("committer",{}).get("date")}, indent=2))'
printf '%s\n' '--- tags pointing to or containing the pinned commit ---'
curl --fail --silent --show-error \
'https://api.github.com/repos/actions/checkout/commits/d23441a48e516b6c34aea4fa41551a30e30af803/tags' \
| python3 -c 'import json,sys; print("\n".join(x["name"] for x in json.load(sys.stdin)))'
printf '%s\n' '--- checkout README security guidance at the pinned commit ---'
curl --fail --silent --show-error \
https://raw.githubusercontent.com/actions/checkout/d23441a48e516b6c34aea4fa41551a30e30af803/README.md \
| grep -n -E -C 5 'persist-credentials|untrusted|token'Repository: ryancinsight/helios
Length of output: 5555
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- configureToken implementation ---'
curl --fail --silent --show-error \
https://raw.githubusercontent.com/actions/checkout/d23441a48e516b6c34aea4fa41551a30e30af803/src/git-auth-helper.ts \
| grep -n -A55 -B8 'private async configureToken'
printf '%s\n' '--- callers that control credential persistence ---'
curl --fail --silent --show-error \
https://raw.githubusercontent.com/actions/checkout/d23441a48e516b6c34aea4fa41551a30e30af803/src/git-source-provider.ts \
| grep -n -E -A12 -B12 'persistCredentials|configureAuth|configureGlobalAuth|removeAuth'
printf '%s\n' '--- README guidance ---'
curl --fail --silent --show-error \
https://raw.githubusercontent.com/actions/checkout/d23441a48e516b6c34aea4fa41551a30e30af803/README.md \
| grep -n -E -A8 -B8 'persist-credentials'Repository: ryancinsight/helios
Length of output: 9673
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
for name in (".github/workflows/ci.yml", ".github/workflows/book-pages.yml"):
text = Path(name).read_text()
print(f"--- {name}: permissions and execution steps ---")
for i, line in enumerate(text.splitlines(), 1):
if re.search(r"(^|\s)(permissions:|pull_request:|push:|run:|uses:)", line):
print(f"{i}: {line}")
PYRepository: ryancinsight/helios
Length of output: 2957
Disable persisted credentials on every checkout.
actions/checkout defaults persist-credentials to true. At this pinned version, it stores the token in $RUNNER_TEMP and adds a local Git configuration reference in each checkout. Later repository-controlled commands can access the token. Add persist-credentials: false to all six checkout steps. Use a separately scoped credential only when a later authenticated Git operation requires one.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 122-125: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 2 files
.github/workflows/ci.yml#L122-L125(this comment).github/workflows/book-pages.yml#L31-L31.github/workflows/ci.yml#L17-L19.github/workflows/ci.yml#L71-L73.github/workflows/ci.yml#L117-L120.github/workflows/ci.yml#L142-L146
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 122 - 125, Disable persisted
credentials on all six checkout steps by adding persist-credentials: false to
the checkout configurations at .github/workflows/ci.yml lines 17-19, 71-73,
117-120, 122-125, and 142-146, and .github/workflows/book-pages.yml line 31. Use
a separately scoped credential only for any later authenticated Git operation
that requires one.
Source: Linters/SAST tools
1 participant
Outcome\n\nPin all mutable GitHub Actions references in the book and CI workflows to immutable commit SHAs. Advance the Atlas path-dependency and benchmark gate from the stale 1a7cdca reference to merged Atlas main 366640f.\n\n## Verification\n\n- git diff --check\n- workflow scan reports no mutable action refs in the changed workflows\n\nHosted Rust, Python, book, and benchmark gates remain authoritative.
High-level PR Summary
This PR pins all GitHub Actions workflow dependencies from mutable version tags (like
@v6,@v5,@stable) to immutable commit SHAs for improved security and reproducibility. Additionally, it updates the Atlas path-dependency reference from the stale commit1a7cdcato the merged main branch commit366640fto keep the benchmark gate current.⏱️ Estimated Review Time: 5-15 minutes
💡 Review Order Suggestion
.github/workflows/ci.yml.github/workflows/book-pages.ymlSummary by CodeRabbit