fix(ci): pin GitHub Actions to commit SHAs, scope secrets, harden Renovate

[LucasSantana-Dev]

Summary

• Pins 18 unique GitHub Actions (across 14 workflow files) from mutable tags (@v4) to full commit SHAs, with version comments preserved — closes 67 github-actions-mutable-action-tag code-scanning alerts.
• Replaces secrets: inherit in review-tools.yml's reusable workflow call with an explicit, minimal secret list (ANTHROPIC_API_KEY only) — closes the secrets-inherit alert.
• Adds minimumReleaseAge: "3 days" to .renovaterc.json's YouTube-adjacent package rule — closes the renovate-missing-minimum-release-age alert (supply-chain hardening: requires a package to be published for a minimum period before Renovate proposes it).

Test plan

• All 21 workflow files validated as parseable YAML
• .renovaterc.json validated as parseable JSON
• No remaining mutable @vN tags in .github/workflows/
• Every pinned SHA resolved and cross-checked against the tag it replaces (0/18 failures)

---

Summary by cubic

Pins all GitHub Actions to exact commit SHAs, scopes reusable workflow secrets to least privilege, sets persist-credentials: false on read‑only jobs, enforces a 7‑day minimum release age in Renovate, and fixes a review-tools validation error. Resolves 67 mutable-action-tag alerts, the secrets-inherit alert, and adds a safeguard for YouTube‑adjacent updates.

• Refactors

  • Pinned all Actions across 14 workflows to full SHAs with version comments (no remaining @vN tags), covering core build/test, Docker actions, cloudflare/wrangler-action, github/codeql-action/upload-sarif (commit, not tag), and utilities like actions/github-script, actions/labeler, actions/stale, actions/cache, actions/upload-artifact/download-artifact, and actions/setup-java.
  • Replaced secrets: inherit in review-tools.yml with an explicit ANTHROPIC_API_KEY; pinned reusable workflows under LucasSantana-Dev/.github to commit SHAs; set actions/checkout persist-credentials: false in read‑only/test jobs.

• Bug Fixes

  • Dropped an undeclared secret from the danger reusable-workflow call to match its interface, fixing a startup validation error that blocked the Review Tools workflow.

^{Written for commit 6319274. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • Pinned multiple GitHub Actions and Docker-related workflow steps to fixed commit SHAs for more consistent and secure automation.
  • Updated CI, deployment, and review workflows to use pinned action references instead of floating version tags.
  • Adjusted dependency update rules to add a 7-day minimum release age for selected YouTube-adjacent package updates.

[github-actions]

Failed to generate code suggestions for PR

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR pins third-party GitHub Actions across workflow files to specific commit SHAs instead of floating tags, updates review-tools.yml secrets handling, and adds a minimumReleaseAge constraint to .renovaterc.json.

Changes

GitHub Actions SHA Pinning and Renovate Config

Layer / File(s)	Summary
Core CI workflow SHA pinning .github/workflows/ci.yml	build-shared, checks, test-shared, test-backend, test-bot, test-youtube-smoke, test-frontend, docker-build, sonar, and security now use SHA-pinned checkout, setup-node, artifact, Docker, and setup-java actions.
Deployment and build workflow SHA pinning .github/workflows/bundle-size.yml, .github/workflows/deploy-frontend-cf.yml, .github/workflows/deploy-staging.yml, .github/workflows/docker-publish.yml	Checkout, setup-node, wrangler-action, github-script, docker login/buildx/metadata/build-push, and codeql upload-sarif references are pinned to commit SHAs.
Mutation testing workflow SHA pinning .github/workflows/mutation.yml	The mutation-shared and mutation-backend jobs now use SHA-pinned checkout, setup-node, cache, and upload-artifact actions.
Maintenance and gate workflow SHA pinning .github/workflows/destructive-interaction-gate.yml, .github/workflows/labeler.yml, .github/workflows/madge.yml, .github/workflows/path-portability.yml, .github/workflows/queueresolver-canary.yml, .github/workflows/release-tag-guard.yml, .github/workflows/review-tools.yml, .github/workflows/stale.yml	These workflows pin their action references to commit SHAs; review-tools.yml also changes the danger job's secrets handling.
Renovate package rule update .renovaterc.json	Adds minimumReleaseAge: "7 days" to the YouTube-adjacent packages rule alongside existing labels.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• LucasSantana-Dev/Lucky#838: Both PRs modify .github/workflows/review-tools.yml around reusable workflow references and secrets handling.
• LucasSantana-Dev/Lucky#1523: Both PRs touch .github/workflows/release-tag-guard.yml, with this PR pinning its checkout action.
• LucasSantana-Dev/Lucky#1673: Both PRs modify .github/workflows/deploy-frontend-cf.yml action references.

Suggested labels: infra

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: pinning GitHub Actions, tightening secrets handling, and hardening Renovate.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ci-hardening-1

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/path-portability.yml (1)

17-21: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Disable persisted checkout credentials.

bash scripts/check-path-portability.sh doesn’t need git auth, so this job can avoid leaving the token in local git config by setting persist-credentials: false.

Suggested change

       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/path-portability.yml around lines 17 - 21, Disable
persisted checkout credentials in the workflow by updating the actions/checkout
step so it does not leave the GitHub token in local git config. The path
portability job only runs bash scripts/check-path-portability.sh and does not
need git auth, so modify the checkout configuration to set persist-credentials
to false while keeping the existing checkout action and the Install jq and
ripgrep step unchanged.

Source: Linters/SAST tools

🧹 Nitpick comments (4)

.github/workflows/ci.yml (2)

23-24: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Consider persist-credentials: false on checkout steps that don't need to push.

zizmor flags every actions/checkout step in this file for not setting persist-credentials: false. None of these jobs push commits back to the repo, so the persisted git credential (even though checkout v6 now stores it outside .git/config, under $RUNNER_TEMP) is unnecessary exposure. This is a pre-existing pattern not introduced by this PR's SHA-pinning change, but worth tightening while these lines are already being touched.

🔒 Example fix (repeat for each checkout step)

             - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+              with:
+                  persist-credentials: false

Also applies to: 48-49, 82-83, 104-105, 129-130, 165-166, 190-191, 223-223, 303-305, 371-374

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 23 - 24, Add persist-credentials:
false to each actions/checkout step in the CI workflow, since the jobs do not
push back to the repo and the stored git token is unnecessary. Update every
checkout occurrence in the workflow file consistently so the security posture is
tightened without changing any job behavior, using the existing actions/checkout
references as the targets.

Source: Linters/SAST tools

---

24-24: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Cache-poisoning surface via setup-node npm cache and download-artifact across shared jobs.

zizmor flags cache: 'npm' on setup-node and the artifact-download steps as cache-poisoning risks: a job running lower-trust code (e.g. a fork PR under pull_request) could theoretically write a poisoned cache/artifact entry that a later, more-trusted run (e.g. push-to-main sonar) restores. The top-level trigger here is pull_request (not pull_request_target) and permissions: contents: read, which substantially contains the risk since fork PRs don't get secrets by default — but the shared cache/artifact namespace across push and pull_request events for the same branch is still a residual vector worth being aware of. No action strictly required given the current trigger posture, but consider scoping caches/artifacts by run if this repo's threat model changes (e.g. adding pull_request_target jobs later).

Also applies to: 49-49, 83-83, 105-105, 130-130, 166-166, 191-191, 306-317, 374-374

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 24, The shared cache/artifact usage in the
CI workflow can expose a cache-poisoning surface across `setup-node` and
`download-artifact` jobs. Review the `actions/setup-node` steps and the artifact
download steps in the workflow, and if you want to harden for future
`pull_request_target`-style changes, scope cache keys and artifact names by
run/job or disable shared caching so lower-trust runs cannot influence later
trusted jobs. Keep the current `pull_request`/read-only posture if no immediate
change is needed, but make the namespace separation explicit in the affected
workflow steps (`setup-node`, artifact upload/download jobs).

Source: Linters/SAST tools

.renovaterc.json (1)

20-46: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Consider adding minimumReleaseAge to auto-merging rules too.

The npm (patch/minor), github-actions, and docker packageRules all auto-merge automatically but have no minimumReleaseAge guard, unlike the YouTube-adjacent rule fixed here. Since these merge without manual review, they arguably carry higher exposure to just-published malicious/unstable packages than the rule that was just patched.

🛡️ Example: adding minimumReleaseAge to auto-merge rules

         {
             "description": "Auto-merge patch and minor npm updates",
             "matchManagers": ["npm"],
             "matchUpdateTypes": ["patch", "minor"],
             "automerge": true,
             "automergeType": "pr",
+            "minimumReleaseAge": "3 days",
             "platformAutomerge": true
         },

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.renovaterc.json around lines 20 - 46, The auto-merge packageRules for npm,
github-actions, and docker in the Renovate config currently enable automerge
without any minimum release age safeguard. Update those rule blocks to include a
minimumReleaseAge setting consistent with the already-patched auto-merge rule,
and keep the existing matchManagers, matchUpdateTypes, and automerge behavior
intact. Make the change in the packageRules entries for the auto-merging npm,
github-actions, and docker rules so they are protected by the same freshness
guard.

.github/workflows/deploy-frontend-cf.yml (1)

21-35: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Pins look correct; consider hardening flagged by static analysis.

zizmor flags this checkout step for not setting persist-credentials: false (artipacked) and the setup-node cache step for potential cache poisoning. Since this job only deploys after a build with no other job consuming the persisted token, consider persist-credentials: false on checkout unless later steps genuinely need git push/auth.

🔒 Suggested hardening

       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-frontend-cf.yml around lines 21 - 35, The workflow
hardening comment applies to the GitHub Actions job using actions/checkout and
actions/setup-node in deploy-frontend-cf.yml. Update the checkout step to
disable persisted Git credentials unless a later step truly needs repo write
access, and review the npm cache configuration on the setup-node step to reduce
cache-poisoning risk while keeping the root package-lock.json cache target
intact. Keep the existing deploy/build flow in place and only adjust the
security-related options on those two steps.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/madge.yml:
- Around line 29-33: The checkout step in the madge workflow currently leaves
repository credentials available in git config, but this job is read-only and
does not need git auth. Update the actions/checkout step in the workflow to
disable persisted credentials by setting persist-credentials to false, keeping
the token out of local config while leaving the rest of the job unchanged.

In @.github/workflows/mutation.yml:
- Around line 38-39: The checkout steps are leaving the job token persisted in
git config, which can expose credentials to later build/test steps. Update both
actions/checkout usages in the workflow to set persist-credentials to false, and
keep the change scoped to the checkout step so the token is not stored for
reuse.

---

Outside diff comments:
In @.github/workflows/path-portability.yml:
- Around line 17-21: Disable persisted checkout credentials in the workflow by
updating the actions/checkout step so it does not leave the GitHub token in
local git config. The path portability job only runs bash
scripts/check-path-portability.sh and does not need git auth, so modify the
checkout configuration to set persist-credentials to false while keeping the
existing checkout action and the Install jq and ripgrep step unchanged.

---

Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 23-24: Add persist-credentials: false to each actions/checkout
step in the CI workflow, since the jobs do not push back to the repo and the
stored git token is unnecessary. Update every checkout occurrence in the
workflow file consistently so the security posture is tightened without changing
any job behavior, using the existing actions/checkout references as the targets.
- Line 24: The shared cache/artifact usage in the CI workflow can expose a
cache-poisoning surface across `setup-node` and `download-artifact` jobs. Review
the `actions/setup-node` steps and the artifact download steps in the workflow,
and if you want to harden for future `pull_request_target`-style changes, scope
cache keys and artifact names by run/job or disable shared caching so
lower-trust runs cannot influence later trusted jobs. Keep the current
`pull_request`/read-only posture if no immediate change is needed, but make the
namespace separation explicit in the affected workflow steps (`setup-node`,
artifact upload/download jobs).

In @.github/workflows/deploy-frontend-cf.yml:
- Around line 21-35: The workflow hardening comment applies to the GitHub
Actions job using actions/checkout and actions/setup-node in
deploy-frontend-cf.yml. Update the checkout step to disable persisted Git
credentials unless a later step truly needs repo write access, and review the
npm cache configuration on the setup-node step to reduce cache-poisoning risk
while keeping the root package-lock.json cache target intact. Keep the existing
deploy/build flow in place and only adjust the security-related options on those
two steps.

In @.renovaterc.json:
- Around line 20-46: The auto-merge packageRules for npm, github-actions, and
docker in the Renovate config currently enable automerge without any minimum
release age safeguard. Update those rule blocks to include a minimumReleaseAge
setting consistent with the already-patched auto-merge rule, and keep the
existing matchManagers, matchUpdateTypes, and automerge behavior intact. Make
the change in the packageRules entries for the auto-merging npm, github-actions,
and docker rules so they are protected by the same freshness guard.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fbe079dd-e313-44e6-9f6d-00aa67a4bf31

📥 Commits

Reviewing files that changed from the base of the PR and between ba20cd8 and 40b0d5e.

📒 Files selected for processing (15)

• .github/workflows/bundle-size.yml
• .github/workflows/ci.yml
• .github/workflows/deploy-frontend-cf.yml
• .github/workflows/deploy-staging.yml
• .github/workflows/destructive-interaction-gate.yml
• .github/workflows/docker-publish.yml
• .github/workflows/labeler.yml
• .github/workflows/madge.yml
• .github/workflows/mutation.yml
• .github/workflows/path-portability.yml
• .github/workflows/queueresolver-canary.yml
• .github/workflows/release-tag-guard.yml
• .github/workflows/review-tools.yml
• .github/workflows/stale.yml
• .renovaterc.json

[cubic-dev-ai]

3 issues found across 15 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/docker-publish.yml">

<violation number="1" location=".github/workflows/docker-publish.yml:124">
P2: The pinned SHA for `github/codeql-action/upload-sarif` resolves to an annotated tag object, not a commit. The `v4` tag is an annotated tag; its tag-object SHA (`1ad29ea4a422cce9a242a9fae469541dcd08addc`) is not a commit SHA. When used in a `uses:` directive, GitHub Actions needs a commit SHA to check out the action code — a tag object SHA may fail to resolve at runtime or behave unexpectedly. Prefer the underlying commit SHA (`99df26d4f13ea111d4ec1a7dddef6063f76b97e9`) which is what the `v4` tag actually dereferences to.</violation>
</file>

<file name=".renovaterc.json">

<violation number="1" location=".renovaterc.json:58">
P3: The Semgrep `renovate-missing-minimum-release-age` rule recommends `"7 days"` as the minimum release age for supply-chain hardening. With `"3 days"`, the code-scanning alert may not be fully resolved. If the goal is to close that alert, consider aligning with the recommended 7-day threshold — or verify that the scanner accepts 3 days as sufficient.</violation>
</file>

<file name=".github/workflows/mutation.yml">

<violation number="1" location=".github/workflows/mutation.yml:38">
P2: Since this PR is specifically hardening CI security (pinning SHAs), consider also adding `persist-credentials: false` to this checkout step. The default (`true`) leaves the job token in local git config, accessible to all subsequent steps — a concern when those steps run repo-controlled build/test scripts like Stryker mutation testing.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

<sub>Requires human review: Auto-approval blocked by 3 unresolved issues from previous reviews.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 4 files (changes from recent commits).

<sub>Auto-approved: Pins all GitHub Actions to commit SHAs, scopes reusable workflow secrets to least privilege, and adds a minimum release age for Renovate. These are low-risk, mechanical CI/CD hardening changes with no business logic impact.

Re-trigger cubic</sub>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud