test: published package testing #28
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| name: 'Test Phase 2: Published Package' | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| workflow_call: | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
|
|
||
| test: | ||
| strategy: | ||
| matrix: | ||
| configuration: [Release, Debug] | ||
|
|
||
| # FIX: cannot use ubuntu-latest | ||
| runs-on: ubuntu-22.04 # tip: runs-on can use ${{ matrix.<name> }} | ||
| steps: | ||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 | ||
|
Comment on lines
+21
to
+22
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== locate workflow =="
fd -a 'test-integration.yml' .github/workflows || true
echo "== workflow excerpt =="
if [ -f .github/workflows/test-integration.yml ]; then
nl -ba .github/workflows/test-integration.yml | sed -n '1,120p'
fi
echo "== workflow permissions/checkout/dotnet references =="
rg -n 'permissions:|actions/checkout|persist-credentials|dotnet test|GITHUB_TOKEN' .github/workflows/test-integration.yml || true
echo "== repo-level workflow permissions/default branch workflow permissions =="
for f in $(fd '.*\.ya?ml$' .github/workflows 2>/dev/null | sort); do
echo "--- $f"
rg -n '^permissions:| permissions:|actions/checkout' "$f" || true
doneRepository: sator-imaging/ZeroSerializer Length of output: 309 🌐 Web query:
💡 Result: In actions/checkout@v4, the persist-credentials input defaults to true [1][2]. When enabled, the action configures the provided authentication token (such as GITHUB_TOKEN) or SSH key within the local git configuration [3][1]. This allows subsequent steps in your workflow to execute authenticated git commands [3][1]. Specifically, for v4, the credentials are written into the repository's.git/config file, typically as an http.https://github.com/.extraheader basic-auth value [4]. Because these credentials reside within the.git directory, they may be inadvertently exposed if the workspace (including the.git folder) is archived and uploaded as a workflow artifact [5][4]. The action automatically removes these credentials during the post-job cleanup phase [3][1]. However, if you do not require authenticated git operations in subsequent steps or wish to avoid the risk of credential exposure via artifacts, you can opt out by setting persist-credentials to false [3][5]: - uses: actions/checkout@v4 with: persist-credentials: false Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
awk '{printf "%6d %s\n", NR, $0}' .github/workflows/test-integration.yml | sed -n '1,140p'
echo "== relevant token/checkout/dotnet references =="
grep -nE 'permissions:|actions/checkout|persist-credentials|dotnet test|GITHUB_TOKEN' .github/workflows/test-integration.yml || true
echo "== workflow-level/job-level permissions across workflows (concise) =="
python3 - <<'PY'
from pathlib import Path
for p in sorted(Path('.github/workflows').glob('*.yml')) + sorted(Path('.github/workflows').glob('*.yaml')):
lines = p.read_text().splitlines()
print(f'--- {p}')
for i,l in enumerate(lines,1):
if l.startswith('permissions:') or l.strip() == 'permissions:' or 'actions/checkout' in l:
print(f'{i}: {l}')
PYRepository: sator-imaging/ZeroSerializer Length of output: 2419 🌐 Web query:
💡 Result: In GitHub Actions, the GITHUB_TOKEN is an automatically generated, short-lived authentication token used to interact with the GitHub API within your workflow jobs [1][2]. Default Permissions The default permissions of the GITHUB_TOKEN are determined by repository or organization-level settings [3]. Repository administrators can choose between two default modes: 1. Permissive: Grants read/write access to all scopes (historically the default). 2. Restricted: Grants read-only access to contents and packages [3][1]. When a workflow runs, if no permissions are explicitly defined, it inherits these default repository settings [4]. As a security best practice, GitHub recommends configuring your repository to use the restricted default and explicitly granting only the minimum required permissions within your workflow files [2][5]. Using the Permissions Key You can override default settings by using the permissions key in your workflow YAML file, either at the workflow level or for individual jobs [1][6]. When you explicitly define any permission, all other permissions are automatically set to 'none', except for the metadata scope, which always retains read access [6]. Example for actions/checkout The actions/checkout action requires the contents scope to fetch your repository [7][8]. To follow the principle of least privilege, it is recommended to explicitly set this permission in your workflow: jobs: build: runs-on: ubuntu-latest permissions: contents: read steps: - uses: actions/checkout@v4 If your workflow requires writing to the repository (e.g., pushing tags, updating files), you must grant contents: write [4]. If you do not provide explicit permissions, the job will rely on the repository's configured defaults, which may be more permissive than your workflow requires [4]. Citations:
Restrict the GitHub token before executing tests.
Apply least-privilege token settings on:
workflow_dispatch:
workflow_call:
+permissions:
+ contents: read
+
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
@@
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+ with:
+ persist-credentials: false🧰 Tools🪛 zizmor (1.29.0)[warning] 21-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| with: | ||
| dotnet-version: | | ||
| 10.x.x | ||
| 9.x.x | ||
| 8.x.x | ||
| 7.x.x | ||
| 6.x.x | ||
| 5.x.x | ||
|
|
||
| - run: | | ||
| dotnet test ./tests-integration -c ${{ matrix.configuration }} \ | ||
| > test-output.txt | ||
|
|
||
| grep -E " - .*\.dll" test-output.txt >> $GITHUB_STEP_SUMMARY | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,7 +8,7 @@ obj | |
| !sandbox | ||
| !src | ||
| !tests | ||
| !tests-integration | ||
|
|
||
| !.gitignore | ||
| !Directory.Build.props | ||
|
|
||
Uh oh!
There was an error while loading. Please reload this page.