Skip to content

test: published package testing #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sator-imaging merged 3 commits into from
Aug 10, 2026
Merged

test: published package testing #28

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4928f8c
mv
sator-imaging Aug 10, 2026
05354fc
polish
sator-imaging Aug 10, 2026
d0da7ad
Apply suggestion from @sator-imaging
sator-imaging Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions .github/workflows/test-integration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
name: 'Test Phase 2: Published Package'

on:
workflow_dispatch:
workflow_call:

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

jobs:

test-integration:
strategy:
matrix:
configuration: [Release, Debug]

# FIX: cannot use ubuntu-latest
runs-on: ubuntu-22.04 # tip: runs-on can use ${{ matrix.<name> }}
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
Comment on lines +21 to +22

@coderabbitai coderabbitai Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== locate workflow =="
fd -a 'test-integration.yml' .github/workflows || true

echo "== workflow excerpt =="
if [ -f .github/workflows/test-integration.yml ]; then
  nl -ba .github/workflows/test-integration.yml | sed -n '1,120p'
fi

echo "== workflow permissions/checkout/dotnet references =="
rg -n 'permissions:|actions/checkout|persist-credentials|dotnet test|GITHUB_TOKEN' .github/workflows/test-integration.yml || true

echo "== repo-level workflow permissions/default branch workflow permissions =="
for f in $(fd '.*\.ya?ml$' .github/workflows 2>/dev/null | sort); do
  echo "--- $f"
  rg -n '^permissions:|  permissions:|actions/checkout' "$f" || true
done

Repository: sator-imaging/ZeroSerializer

Length of output: 309

🌐 Web query:

actions/checkout persist-credentials default true GITHUB_TOKEN local git config v4

💡 Result:

In actions/checkout@v4, the persist-credentials input defaults to true [1][2]. When enabled, the action configures the provided authentication token (such as GITHUB_TOKEN) or SSH key within the local git configuration [3][1]. This allows subsequent steps in your workflow to execute authenticated git commands [3][1]. Specifically, for v4, the credentials are written into the repository's.git/config file, typically as an http.https://github.com/.extraheader basic-auth value [4]. Because these credentials reside within the.git directory, they may be inadvertently exposed if the workspace (including the.git folder) is archived and uploaded as a workflow artifact [5][4]. The action automatically removes these credentials during the post-job cleanup phase [3][1]. However, if you do not require authenticated git operations in subsequent steps or wish to avoid the risk of credential exposure via artifacts, you can opt out by setting persist-credentials to false [3][5]: - uses: actions/checkout@v4 with: persist-credentials: false

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow excerpt =="
awk '{printf "%6d  %s\n", NR, $0}' .github/workflows/test-integration.yml | sed -n '1,140p'

echo "== relevant token/checkout/dotnet references =="
grep -nE 'permissions:|actions/checkout|persist-credentials|dotnet test|GITHUB_TOKEN' .github/workflows/test-integration.yml || true

echo "== workflow-level/job-level permissions across workflows (concise) =="
python3 - <<'PY'
from pathlib import Path
for p in sorted(Path('.github/workflows').glob('*.yml')) + sorted(Path('.github/workflows').glob('*.yaml')):
    lines = p.read_text().splitlines()
    print(f'--- {p}')
    for i,l in enumerate(lines,1):
        if l.startswith('permissions:') or l.strip() == 'permissions:' or 'actions/checkout' in l:
            print(f'{i}: {l}')
PY

Repository: sator-imaging/ZeroSerializer

Length of output: 2419

🌐 Web query:

GitHub Actions workflow permissions default GITHUB_TOKEN repository settings actions/checkout contents: read token permissions

💡 Result:

In GitHub Actions, the GITHUB_TOKEN is an automatically generated, short-lived authentication token used to interact with the GitHub API within your workflow jobs [1][2]. Default Permissions The default permissions of the GITHUB_TOKEN are determined by repository or organization-level settings [3]. Repository administrators can choose between two default modes: 1. Permissive: Grants read/write access to all scopes (historically the default). 2. Restricted: Grants read-only access to contents and packages [3][1]. When a workflow runs, if no permissions are explicitly defined, it inherits these default repository settings [4]. As a security best practice, GitHub recommends configuring your repository to use the restricted default and explicitly granting only the minimum required permissions within your workflow files [2][5]. Using the Permissions Key You can override default settings by using the permissions key in your workflow YAML file, either at the workflow level or for individual jobs [1][6]. When you explicitly define any permission, all other permissions are automatically set to 'none', except for the metadata scope, which always retains read access [6]. Example for actions/checkout The actions/checkout action requires the contents scope to fetch your repository [7][8]. To follow the principle of least privilege, it is recommended to explicitly set this permission in your workflow: jobs: build: runs-on: ubuntu-latest permissions: contents: read steps: - uses: actions/checkout@v4 If your workflow requires writing to the repository (e.g., pushing tags, updating files), you must grant contents: write [4]. If you do not provide explicit permissions, the job will rely on the repository's configured defaults, which may be more permissive than your workflow requires [4].

Citations:

Restrict the GitHub token before executing tests.

actions/checkout persists GITHUB_TOKEN in the local Git configuration by default, and this job then executes checked-out code with dotnet test. Since the workflow does not set explicit permissions, it also inherits repository-default token permissions. Set permissions: contents: read and disable persisted checkout credentials for this workflow.

Apply least-privilege token settings 
 on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
🧰 Tools
🪛 zizmor (1.29.0)

[warning] 21-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test-integration.yml around lines 21 - 22, Update the
workflow permissions to grant only contents: read, and configure the
actions/checkout step to disable persisted credentials before dotnet test
executes the checked-out code.

Source: Linters/SAST tools

with:
dotnet-version: |
10.x.x
9.x.x
8.x.x
7.x.x
6.x.x
5.x.x

- run: |
dotnet test ./tests-integration -c ${{ matrix.configuration }} \
> test-output.txt

grep -E " - .*\.dll" test-output.txt >> $GITHUB_STEP_SUMMARY
2 changes: 1 addition & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ obj
!sandbox
!src
!tests
!integration
!tests-integration

!.gitignore
!Directory.Build.props
Expand Down
10 changes: 6 additions & 4 deletions ...on/ZeroSerializer.IntegrationTests.csproj → ...on/ZeroSerializer.IntegrationTests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<Project Sdk="Microsoft.NET.Sdk">
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<TargetFrameworks>net10.0;net8.0;net6.0;net5.0</TargetFrameworks>
<TargetFrameworks>net10.0;net9.0;net8.0;net7.0;net6.0;net5.0</TargetFrameworks>
<ImplicitUsings>disable</ImplicitUsings>
<Nullable>enable</Nullable>
<LangVersion>latest</LangVersion>
Expand All @@ -18,13 +18,15 @@
</ItemGroup>

<!--
- Reference the NuGet package instead of the local src project reference.
- Mirror the full test suite from the tests directory by including all test sources, excluding Unity compatibility tests.
Reference the NuGet package instead of the local src project reference.
-->
<ItemGroup>
<PackageReference Include="$(NuGetPublishID)" Version="*-*" />
</ItemGroup>

<!--
Mirror the full test suite from the tests directory by including all test sources, excluding Unity compatibility tests.
-->
<ItemGroup>
<Compile Include="../tests/**/*.cs" Exclude="../tests/obj/**/*.cs;../tests/bin/**/*.cs;../tests/UnityCompatibilityTests.cs" />
</ItemGroup>
Expand Down
Loading