chore: Enforce GitHub Actions security policy#1223
Merged
Conversation
Pin workflow actions to immutable commit SHAs so CI behavior cannot drift through moving tags, and add architecture tests that keep new workflow changes on the same policy. Disable setup-go caching in the pull request security scan because PR workflows should not restore Go module caches from untrusted changes.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughPins GitHub Actions usages across repository workflows to specific commit SHAs, adds PR cache-safety constraints, introduces a security policy document, and implements Go tests that enforce these workflow rules by scanning .github/workflows YAML files. ChangesGitHub Actions Security Hardening and Enforcement
Sequence Diagram(s)sequenceDiagram
participant Developer
participant Workflows as Workflow Files
participant Tests as Security Tests
participant CI as CI System
Developer->>Workflows: pin actions to commit SHAs
Developer->>Workflows: add cache: false to PR setup-go and guard actions/cache
CI->>Tests: run workflow compliance tests
Tests->>Workflows: scan .github/workflows/*.yml
Tests->>Tests: validate SHA pinning and PR cache rules
Tests-->>CI: report results
Estimated code review effort🎯 4 (Complex) | ⏱️ ~40 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Packages/src/Cli`~/internal/architecture/github_actions_security_test.go:
- Around line 120-127: The parser in parseUsesAction incorrectly assumes "uses:"
has no leading "-" and that step boundaries only start at "- name:", which lets
unnamed steps (e.g., "- uses: actions/checkout@v2") bypass checks; update
parseUsesAction to accept an optional leading "-" (trim leading "- " before
checking for "uses:") and add/adjust the higher-level step-parsing logic that
groups lines into a step context so attributes (uses:, name:, with:, etc.) are
only interpreted within the same step block — ensure step start is detected for
lines beginning with "-" followed by "name:" or "uses:" and that subsequent
indented lines are attached to that step to prevent attribute bleed between
neighboring steps.
- Around line 130-137: The function workflowRunsOnPullRequest only detects block
keys and misses inline "on:" forms; update it to also handle lines starting with
"on:" by parsing the remainder of that line for "pull_request" or
"pull_request_target" (e.g., "on: pull_request" and "on: [push, pull_request]")
and, if "on:" appears alone, scan subsequent indented lines until the next
top-level key to find those same identifiers; ensure you still return true for
existing block-form checks (strings.HasPrefix(trimmedLine, "pull_request:") /
"pull_request_target:") and add the new logic that normalizes and searches
comma/bracket-separated lists and simple inline values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 6a05eb43-3dc6-4541-aae0-03ee697f5591
📒 Files selected for processing (10)
.github/workflows/build-and-test.yml.github/workflows/cli-minimum-version-warning.yml.github/workflows/native-cli-publish.yml.github/workflows/release-failure-notify.yml.github/workflows/release-please.yml.github/workflows/security-scan.yml.github/workflows/unity-compile-check-and-test-runner.yml.github/workflows/unity-editmode-tests.ymlPackages/src/Cli~/internal/architecture/github_actions_security_test.godocs/github-actions-security.md
There was a problem hiding this comment.
1 issue found across 10 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Cover unnamed GitHub Actions steps and inline pull request triggers so the workflow security policy tests cannot miss valid workflow syntax or read settings from neighboring steps.
There was a problem hiding this comment.
2 issues found across 1 file (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Only direct GitHub Actions trigger entries under on: should decide whether a workflow is pull-request driven. This keeps nested values such as workflow_run filters from being treated as PR triggers while still supporting inline map syntax.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
User Impact
Changes
Verification
Closes #1221
Out of scope: moving the CLI minimum warning comment implementation to Go is tracked separately in #1222.