ci: pin GitHub Actions to commit SHAs with version comments - #28
Conversation
|
Warning Review limit reached
Next review available in: 57 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughChangesWorkflow action pinning
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #28 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 2 2
Lines 203 203
=========================================
Hits 203 203 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Match the commit-check org convention: pin mutable action tags to full commit hashes and annotate each pin with its release version.
146bc64 to
203da13
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/main.yml:
- Line 27: Update all checkout steps in .github/workflows/main.yml lines 27-27
and 51-51, and .github/workflows/publish.yml lines 23-23 and 85-85, to set
persist-credentials to false; retain credential persistence only if a later step
in that job requires authenticated git commands.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 31a07d5c-a6b3-4185-8ac3-dde16f72c900
📒 Files selected for processing (2)
.github/workflows/main.yml.github/workflows/publish.yml
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - uses: actions/setup-python@v6 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Tracked workflow files:"
git ls-files '.github/workflows/*.yml' '.github/workflows/*.yaml' || true
echo
echo "Relevant checkout steps in workflows:"
rg -n "uses: actions/checkout|persist-credentials|fetch-depth:|permissions:" .github/workflows || true
echo
echo "Workflow excerpts:"
for f in .github/workflows/main.yml .github/workflows/publish.yml; do
if [ -f "$f" ]; then
echo "--- $f ---"
nl -ba "$f" | sed -n '1,140p'
fi
done
echo
echo "Commit and local version:"
git rev-parse HEAD || true
git describe --tags --always --long 2>/dev/null || trueRepository: commit-check/commit-check-mcp
Length of output: 1409
🌐 Web query:
actions/checkout v4 persist-credentials default true default git credential helper README
💡 Result:
In the actions/checkout action, the persist-credentials input controls whether the authentication token or SSH key is configured for use by subsequent git commands in your workflow [1][2]. Key details regarding persist-credentials in actions/checkout: Default Behavior: The default value for persist-credentials is true [1][2][3]. When enabled, the action configures the runner's local git environment with the credentials, allowing your workflow scripts to execute authenticated git commands (such as git fetch or git push) without requiring additional configuration [4][5][3]. Security and Mechanism: - When persist-credentials is true, the action ensures that the authentication token or SSH key used to check out the repository is made available to git [4][3]. - In v4, the credentials were typically persisted in the local git config [4][5]. - Starting from v6.0.0, the action was updated to improve security by storing these credentials in a separate file within $RUNNER_TEMP rather than directly in the repository's.git/config [6][7]. This configuration is loaded using Git's includeIf mechanism [8]. - The credentials are removed during the post-job cleanup step to maintain security [4][5][3]. Opting Out: To disable this behavior, you can set persist-credentials to false in your workflow file [4][5]. This is recommended if you do not need to run authenticated git commands later in the job and want to strictly limit credential exposure [4][3]. Example usage: - uses: actions/checkout@v4 with: persist-credentials: false
Citations:
- 1: https://github.com/actions/checkout/blob/v4/action.yml
- 2: https://github.com/actions/checkout/blob/v4.1.1/action.yml
- 3: https://github.com/actions/checkout/blob/cbb722410c2e876e24abbe8de2cc27693e501dcb/action.yml
- 4: https://github.com/actions/checkout/blob/v4/README.md
- 5: https://github.com/actions/checkout
- 6: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 7: https://github.com/actions/checkout/tree/v6.0.0
- 8:
persist-credentialsin separate file breaks GitHub authentication for Git worktrees actions/checkout#2318
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "main.yml relevant context:"
awk '{printf "%5d %s\n", NR, $0}' .github/workflows/main.yml | sed -n '1,100p'
echo
echo "publish.yml relevant context:"
awk '{printf "%5d %s\n", NR, $0}' .github/workflows/publish.yml | sed -n '1,130p'
echo
echo "Extract checkout steps and later git-related commands in each workflow:"
python3 - <<'PY'
from pathlib import Path
import re
for path in [Path(".github/workflows/main.yml"), Path(".github/workflows/publish.yml")]:
print(f"--- {path} ---")
text = path.read_text()
lines = text.splitlines()
in_checkout_with = False
checkout_lineno = None
for i, line in enumerate(lines, 1):
if re.search(r"uses:\s*actions/checkout@", line):
in_checkout_with = True
checkout_lineno = i
print(f"checkout {i}: {line}")
elif in_checkout_with and line.strip().startswith("- "):
in_checkout_with = False
print(f" no persist-credentials=false in continuation lines before next list item")
elif in_checkout_with:
if "persist-credentials" in line:
print(f" {i}: {line.strip()}")
in_checkout_with = False
for i, line in enumerate(lines, 1):
lower = line.lower()
if re.search(r"\bgit\s+", line) or lower.startswith("git ") or "gh release" in line:
print(f"git-related {i}: {line.strip()}")
PYRepository: commit-check/commit-check-mcp
Length of output: 7851
🌐 Web query:
github modelcontextprotocol registry mcp-publisher release mcp-publisher server.json branch master default branch
💡 Result:
The mcp-publisher is the official command-line interface tool used to interact with the Model Context Protocol (MCP) Registry [1][2]. It is developed and hosted within the modelcontextprotocol/registry repository on GitHub [3][4]. Key details regarding your query include: Default Branch: The default branch for the modelcontextprotocol/registry repository is main [3][5]. server.json Usage: The mcp-publisher tool uses a server.json file to describe MCP servers for registration, client discovery, and package management [6][7]. When using the publish command, the tool defaults to looking for a server.json file in the current directory (or you can specify a custom path using the --file or PATH argument) [4][1][2]. For developers, the tool provides several commands, including: mcp-publisher init: Creates a server.json file with auto-detected values [4][2]. mcp-publisher login: Authenticates the user, supporting methods such as GitHub OAuth, GitHub OIDC, and domain verification (DNS/HTTP) [3][4][5]. mcp-publisher publish: Validates the server.json against the required schema and publishes it to the MCP Registry [4][7]. For more information, you can refer to the official documentation within the registry repository or the Model Context Protocol website [3][2].
Citations:
- 1: https://modelcontextprotocol.info/tools/registry/cli/
- 2: https://modelcontextprotocol.info/tools/registry/publishing/
- 3: https://github.com/modelcontextprotocol/registry
- 4: https://github.com/modelcontextprotocol/registry/blob/dc736892/docs/reference/cli/commands.md
- 5: https://github.com/modelcontextprotocol/registry/blob/main/README.md
- 6: https://github.com/ghraw/modelcontextprotocol/registry/refs/heads/main/docs/reference/server-json/generic-server-json.md
- 7: https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/server-json/official-registry-requirements.md
Disable checkout credential persistence in every workflow job.
All four checkout steps use the default persisted GitHub token; set persist-credentials: false unless a later job step requires authenticated git commands.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 27-27: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 2 files
.github/workflows/main.yml#L27-L27(this comment).github/workflows/main.yml#L51-L51.github/workflows/publish.yml#L23-L23.github/workflows/publish.yml#L85-L85
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/main.yml at line 27, Update all checkout steps in
.github/workflows/main.yml lines 27-27 and 51-51, and
.github/workflows/publish.yml lines 23-23 and 85-85, to set persist-credentials
to false; retain credential persistence only if a later step in that job
requires authenticated git commands.
Source: Linters/SAST tools
Summary
Pin workflow actions to full commit hashes and annotate each pin with its release version (matching the commit-check org convention), for example
actions/checkout@3d3c42e… # v7.0.1.Fixes #26
Summary by CodeRabbit