pin GitHub Actions - #100
Conversation
📝 WalkthroughWalkthroughThis pull request pins GitHub Actions references in three workflow files (codeql-analysis.yml, fuzz.yml, go.yml) to specific commit SHAs instead of floating version tags. This applies to checkout, setup-go, CodeQL, and go-fuzz actions. ChangesCI Action Pinning
Estimated code review effort: 1 (Trivial) | ~3 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/fuzz.yml:
- Line 16: Update both actions/checkout steps in the fuzz jobs to set
persist-credentials to false. Keep the existing checkout references and job
behavior unchanged while ensuring neither checkout leaves credentials available
to subsequent steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 244cdec2-c5d9-4ffd-8af4-6b47638ca9b0
📒 Files selected for processing (3)
.github/workflows/codeql-analysis.yml.github/workflows/fuzz.yml.github/workflows/go.yml
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - uses: actions/setup-go@v7 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/fuzz.yml
printf '%s\n' '--- checkout and token references ---'
rg -n -C 3 'actions/checkout|persist-credentials|github.token|token:|git ' .github/workflows/fuzz.yml
printf '%s\n' '--- repository references to fuzz action ---'
rg -n -C 3 'go-fuzz|fuzz' .github/workflows/fuzz.ymlRepository: shogo82148/androidbinary
Length of output: 3378
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import json
import urllib.request
urls = {
"run_action_yml": "https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/action.yml",
"list_action_yml": "https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/list/action.yml",
"checkout_action_yml": "https://raw.githubusercontent.com/actions/checkout/3d3c42e5aac5ba805825da76410c181273ba90b1/action.yml",
}
for name, url in urls.items():
print(f"--- {name}: {url} ---")
try:
with urllib.request.urlopen(url, timeout=15) as response:
print(response.read().decode("utf-8", "replace"))
except Exception as exc:
print(f"ERROR: {exc}")
PYRepository: shogo82148/androidbinary
Length of output: 1000
🌐 Web query:
actions/checkout persist-credentials false documentation token local git config
💡 Result:
In GitHub Actions, the actions/checkout action uses the persist-credentials input to control how the repository's authentication token is handled during the job [1][2]. When persist-credentials is set to its default value of true, the action configures Git to use the authentication token for subsequent Git commands within that workflow job [1][3]. Historically, this meant the token was stored directly in the local Git configuration (.git/config) [4][5]. However, starting in version v6.0.0, actions/checkout improved security by storing these credentials in a separate file under $RUNNER_TEMP rather than directly in the local .git/config [5][6]. This change reduces the risk of accidental exposure, such as through artifact publishing or repository copies [7]. The token is removed during post-job cleanup [1][4]. When you set persist-credentials: false, the action opts out of this automatic configuration [1][2]. This means the authentication token is not persisted to the local Git configuration or any temporary file, effectively preventing subsequent Git commands in the same job from using that specific token automatically [1][4]. Use this setting if your workflow does not require authenticated Git operations after the initial checkout, or if you prefer to manage Git authentication manually for security reasons [8][7].
Citations:
- 1: https://github.com/actions/checkout?tab=readme-ov-file
- 2: https://github.com/actions/checkout/blob/main/README.md
- 3: https://github.com/marketplace/actions/checkout?version=v3.6.0
- 4: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 5: https://github.com/actions/checkout/tree/v6.0.0
- 6: actions/checkout@v5.0.1...v6.0.0
- 7: [security] Escalate concerning default
persist-credentials=trueplease actions/checkout#2312 - 8: Remove
persist-credentialsor change the default tofalseactions/checkout#485
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import urllib.request
urls = {
"run_action_yml": "https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/action.yml",
"list_action_yml": "https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/list/action.yml",
"checkout_action_yml": "https://raw.githubusercontent.com/actions/checkout/3d3c42e5aac5ba805825da76410c181273ba90b1/action.yml",
}
for name, url in urls.items():
print(f"--- {name} ---")
try:
with urllib.request.urlopen(url, timeout=15) as response:
print(response.read().decode("utf-8", "replace"))
except Exception as exc:
print(f"ERROR: {exc}")
PYRepository: shogo82148/androidbinary
Length of output: 663
🏁 Script executed:
#!/bin/bash
set -eu
for spec in \
"run_action_yml|https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/action.yml" \
"list_action_yml|https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/list/action.yml" \
"checkout_action_yml|https://raw.githubusercontent.com/actions/checkout/3d3c42e5aac5ba805825da76410c181273ba90b1/action.yml"
do
name=${spec%%|*}
url=${spec#*|}
printf '%s\n' "--- $name ---"
curl --fail --silent --show-error --location --insecure "$url"
printf '\n'
doneRepository: shogo82148/androidbinary
Length of output: 6534
🌐 Web query:
site:github.com/shogo82148/actions-go-fuzz "token" "action.yml"
💡 Result:
In GitHub Actions, action.yml is a mandatory configuration file used to define metadata for a custom action [1]. It specifies the action's inputs, outputs, and execution instructions, allowing the action to be used in workflow files [1]. While there is no specific field in the action.yml schema exclusively named token, action authors frequently define an input named token to accept authentication credentials [2]. This allows users of the action to pass a GitHub token—such as the default GITHUB_TOKEN provided by the environment—into the action [2]. A typical example of defining such an input in an action.yml file looks like this: inputs: token: description: "The GitHub token for the repository" required: false default: ${{ github.token }} By convention, this input is often configured to default to the standard GitHub Actions token, which enables the action to perform authorized operations within the repository [2].
Citations:
🏁 Script executed:
#!/bin/bash
set -eu
for spec in \
"run_dist|https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/dist/index.js" \
"list_dist|https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/dist/list.js"
do
name=${spec%%|*}
url=${spec#*|}
printf '%s\n' "--- $name ---"
content=$(curl --fail --silent --show-error --location --insecure "$url")
printf '%s\n' "$content" | rg -n -i -C 2 'git|credential|token|github|exec|spawn|go test|go list' || true
printf '%s\n' "--- $name size ---"
printf '%s' "$content" | wc -c
doneRepository: shogo82148/androidbinary
Length of output: 281
🏁 Script executed:
#!/bin/bash
set -eu
url='https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/dist/index.js'
curl -k -L --fail --silent --show-error "$url" -o /tmp/actions-go-fuzz-index.js
printf '%s\n' '--- references ---'
rg -n -i -C 2 'git|credential|token|github|exec|spawn|go test|go list' /tmp/actions-go-fuzz-index.js || true
printf '%s\n' '--- size ---'
wc -c /tmp/actions-go-fuzz-index.jsRepository: shogo82148/androidbinary
Length of output: 264
Disable checkout credential persistence in both fuzz jobs.
Set persist-credentials: false on both actions/checkout steps. Neither job performs an authenticated Git operation, and the jobs grant write permissions. This prevents subsequent actions and repository code from using the checkout credential.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 16-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/fuzz.yml at line 16, Update both actions/checkout steps in
the fuzz jobs to set persist-credentials to false. Keep the existing checkout
references and job behavior unchanged while ensuring neither checkout leaves
credentials available to subsequent steps.
Source: Linters/SAST tools
1 participant
Summary by CodeRabbit