Skip to content

ci: pin GitHub Actions to commit SHAs with version comments #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shenxianpeng merged 1 commit into from
Aug 2, 2026
Merged

ci: pin GitHub Actions to commit SHAs with version comments #28

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,8 @@ jobs:
matrix:
python-version: ["3.10", "3.11", "3.12", "3.13"]
steps:
- uses: actions/checkout@v7
- uses: actions/setup-python@v6
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

@coderabbitai coderabbitai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Tracked workflow files:"
git ls-files '.github/workflows/*.yml' '.github/workflows/*.yaml' || true

echo
echo "Relevant checkout steps in workflows:"
rg -n "uses: actions/checkout|persist-credentials|fetch-depth:|permissions:" .github/workflows || true

echo
echo "Workflow excerpts:"
for f in .github/workflows/main.yml .github/workflows/publish.yml; do
  if [ -f "$f" ]; then
    echo "--- $f ---"
    nl -ba "$f" | sed -n '1,140p'
  fi
done

echo
echo "Commit and local version:"
git rev-parse HEAD || true
git describe --tags --always --long 2>/dev/null || true

Repository: commit-check/commit-check-mcp

Length of output: 1409

🌐 Web query:

actions/checkout v4 persist-credentials default true default git credential helper README

💡 Result:

In the actions/checkout action, the persist-credentials input controls whether the authentication token or SSH key is configured for use by subsequent git commands in your workflow [1][2]. Key details regarding persist-credentials in actions/checkout: Default Behavior: The default value for persist-credentials is true [1][2][3]. When enabled, the action configures the runner's local git environment with the credentials, allowing your workflow scripts to execute authenticated git commands (such as git fetch or git push) without requiring additional configuration [4][5][3]. Security and Mechanism: - When persist-credentials is true, the action ensures that the authentication token or SSH key used to check out the repository is made available to git [4][3]. - In v4, the credentials were typically persisted in the local git config [4][5]. - Starting from v6.0.0, the action was updated to improve security by storing these credentials in a separate file within $RUNNER_TEMP rather than directly in the repository's.git/config [6][7]. This configuration is loaded using Git's includeIf mechanism [8]. - The credentials are removed during the post-job cleanup step to maintain security [4][5][3]. Opting Out: To disable this behavior, you can set persist-credentials to false in your workflow file [4][5]. This is recommended if you do not need to run authenticated git commands later in the job and want to strictly limit credential exposure [4][3]. Example usage: - uses: actions/checkout@v4 with: persist-credentials: false

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "main.yml relevant context:"
awk '{printf "%5d  %s\n", NR, $0}' .github/workflows/main.yml | sed -n '1,100p'

echo
echo "publish.yml relevant context:"
awk '{printf "%5d  %s\n", NR, $0}' .github/workflows/publish.yml | sed -n '1,130p'

echo
echo "Extract checkout steps and later git-related commands in each workflow:"
python3 - <<'PY'
from pathlib import Path
import re
for path in [Path(".github/workflows/main.yml"), Path(".github/workflows/publish.yml")]:
    print(f"--- {path} ---")
    text = path.read_text()
    lines = text.splitlines()
    in_checkout_with = False
    checkout_lineno = None
    for i, line in enumerate(lines, 1):
        if re.search(r"uses:\s*actions/checkout@", line):
            in_checkout_with = True
            checkout_lineno = i
            print(f"checkout {i}: {line}")
        elif in_checkout_with and line.strip().startswith("- "):
            in_checkout_with = False
            print(f"  no persist-credentials=false in continuation lines before next list item")
        elif in_checkout_with:
            if "persist-credentials" in line:
                print(f"  {i}: {line.strip()}")
                in_checkout_with = False
    for i, line in enumerate(lines, 1):
        lower = line.lower()
        if re.search(r"\bgit\s+", line) or lower.startswith("git ") or "gh release" in line:
            print(f"git-related {i}: {line.strip()}")
PY

Repository: commit-check/commit-check-mcp

Length of output: 7851

🌐 Web query:

github modelcontextprotocol registry mcp-publisher release mcp-publisher server.json branch master default branch

💡 Result:

The mcp-publisher is the official command-line interface tool used to interact with the Model Context Protocol (MCP) Registry [1][2]. It is developed and hosted within the modelcontextprotocol/registry repository on GitHub [3][4]. Key details regarding your query include: Default Branch: The default branch for the modelcontextprotocol/registry repository is main [3][5]. server.json Usage: The mcp-publisher tool uses a server.json file to describe MCP servers for registration, client discovery, and package management [6][7]. When using the publish command, the tool defaults to looking for a server.json file in the current directory (or you can specify a custom path using the --file or PATH argument) [4][1][2]. For developers, the tool provides several commands, including: mcp-publisher init: Creates a server.json file with auto-detected values [4][2]. mcp-publisher login: Authenticates the user, supporting methods such as GitHub OAuth, GitHub OIDC, and domain verification (DNS/HTTP) [3][4][5]. mcp-publisher publish: Validates the server.json against the required schema and publishes it to the MCP Registry [4][7]. For more information, you can refer to the official documentation within the registry repository or the Model Context Protocol website [3][2].

Citations:

Disable checkout credential persistence in every workflow job.

All four checkout steps use the default persisted GitHub token; set persist-credentials: false unless a later job step requires authenticated git commands.

🧰 Tools
🪛 zizmor (1.28.0)

[warning] 27-27: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 2 files
  • .github/workflows/main.yml#L27-L27 (this comment)
  • .github/workflows/main.yml#L51-L51
  • .github/workflows/publish.yml#L23-L23
  • .github/workflows/publish.yml#L85-L85
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/main.yml at line 27, Update all checkout steps in
.github/workflows/main.yml lines 27-27 and 51-51, and
.github/workflows/publish.yml lines 23-23 and 85-85, to set persist-credentials
to false; retain credential persistence only if a later step in that job
requires authenticated git commands.

Source: Linters/SAST tools

- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: ${{ matrix.python-version }}

Expand All @@ -39,7 +39,7 @@ jobs:

- name: Upload coverage reports to Codecov
if: matrix.python-version == '3.12'
uses: codecov/codecov-action@v7
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
with:
token: ${{ secrets.CODECOV_TOKEN }}
slug: commit-check/commit-check-mcp
Expand All @@ -48,8 +48,8 @@ jobs:
build:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v7
- uses: actions/setup-python@v6
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: "3.12"

Expand All @@ -65,7 +65,7 @@ jobs:
run: python -m twine check dist/*

- name: Upload distributions
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: dist
path: dist/*
14 changes: 7 additions & 7 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,11 +20,11 @@ jobs:
outputs:
artifact-name: python-package-distributions
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0

- uses: actions/setup-python@v6
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: "3.12"

Expand All @@ -45,13 +45,13 @@ jobs:
commit-check-mcp --help

- name: Upload distributions
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: python-package-distributions
path: dist/*

- name: Create attestations
uses: actions/attest-build-provenance@v4
uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
with:
subject-path: dist/*

Expand All @@ -65,13 +65,13 @@ jobs:
id-token: write
steps:
- name: Download distributions
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: python-package-distributions
path: dist

- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1

publish-mcp-registry:
name: Publish server.json to MCP Registry
Expand All @@ -82,7 +82,7 @@ jobs:
id-token: write # Required for OIDC authentication with MCP Registry
steps:
- name: Checkout repo
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Extract version from release tag
id: version
Expand Down
Loading