Skip to content
This repository was archived by the owner on Oct 12, 2026. It is now read-only.

ci: pin required repo-checks verifiers to immutable SHAs #121

Merged
nish3451 merged 2 commits into from
Aug 12, 2026
Merged

ci: pin required repo-checks verifiers to immutable SHAs #121

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f73aba8
ci: pin repo-checks verifiers to immutable SHAs
nish3451 Aug 12, 2026
efd346e
Merge branch 'main' into chore/pin-required-verifiers
nish3451 Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/codex-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,8 @@ jobs:
repo-checks:
runs-on: [self-hosted, linux, x64, vps-verify]
steps:
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

@coderabbitai coderabbitai Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- workflow ---'
cat -n .github/workflows/codex-ci.yml

printf '%s\n' '--- workflow references ---'
rg -n -C 3 'codex-ci|npm run ci|actions/checkout|persist-credentials|self-hosted|GITHUB_TOKEN|git (clone|fetch|push)|github-token' .github package.json package-lock.json 2>/dev/null || true

printf '%s\n' '--- package scripts ---'
node - <<'JS'
const fs = require('fs');
const p = JSON.parse(fs.readFileSync('package.json', 'utf8'));
console.log(JSON.stringify(p.scripts ?? {}, null, 2));
JS

Repository: nish3451/tinystudio-in

Length of output: 13461

🏁 Script executed:

#!/bin/bash
set -eu

python3 - <<'PY'
import json
import pathlib
import re

pkg = json.loads(pathlib.Path("package.json").read_text())
ci = pkg.get("scripts", {}).get("ci", "")
scripts = re.findall(r"(?:^|&&\s*)node\s+((?:scripts/)[^\s]+)", ci)

print("--- ci script files ---")
for name in scripts:
    print(name)

print("--- credential-related references in CI scripts ---")
terms = re.compile(r"\b(?:git|GITHUB_TOKEN|github-token|contents:|actions/checkout)\b", re.I)
hits = 0
for name in scripts:
    path = pathlib.Path(name)
    if not path.is_file():
        print(f"{name}: missing")
        continue
    for number, line in enumerate(path.read_text(errors="replace").splitlines(), 1):
        if terms.search(line):
            print(f"{name}:{number}:{line}")
            hits += 1
print(f"matches={hits}")
PY

printf '%s\n' '--- all workflow credential and Git operations ---'
rg -n -i -C 2 'git (clone|fetch|pull|push|remote|ls-remote)|GITHUB_TOKEN|github-token|persist-credentials|contents:' .github/workflows scripts package.json 2>/dev/null || true

Repository: nish3451/tinystudio-in

Length of output: 4300

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- retention test and helper structure ---'
ast-grep outline scripts/test-retention-automation.mjs scripts/lib/retention-preflight.mjs

printf '%s\n' '--- retention test ---'
cat -n scripts/test-retention-automation.mjs

printf '%s\n' '--- retention helper ---'
cat -n scripts/lib/retention-preflight.mjs

printf '%s\n' '--- imports and Git process calls ---'
rg -n -i -C 3 'retention-preflight|spawnSync|execFileSync|execSync|git\s+(ls-remote|fetch|clone|pull|push)|remote\.|origin' scripts

Repository: nish3451/tinystudio-in

Length of output: 50379

Disable checkout credential persistence.

This workflow runs pull-request code on a self-hosted runner. The CI scripts do not need authenticated Git access. Add persist-credentials: false to actions/checkout.

🧰 Tools
🪛 zizmor (1.29.0)

[warning] 22-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codex-ci.yml at line 22, Update the actions/checkout step
in the workflow to set persist-credentials to false, preventing checkout
credentials from remaining available to pull-request CI scripts.

Source: Linters/SAST tools

- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 20
cache: npm
Expand Down