Skip to content

[CI] PR 검증 워크플로우 추가 (lint·타입체크·빌드) #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jjangminii merged 1 commit into from
Jun 25, 2026
Merged

[CI] PR 검증 워크플로우 추가 (lint·타입체크·빌드) #23

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 71 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,71 @@
name: ✅ CI

on:
pull_request:
types: [opened, synchronize, reopened]
branches: [main, develop]

permissions:
contents: read

concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true

jobs:
lint:
name: Lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

@coderabbitai coderabbitai Bot Jun 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

외부 액션을 커밋 SHA로 고정해 공급망 위험을 줄여주세요.

현재 @v4 태그는 이동 가능해서, 의도치 않은 액션 변경이 CI에 유입될 수 있습니다. 이 저장소 정책(unpinned-uses) 기준으로는 SHA 고정이 필요합니다.

공식 가이드: https://docs.github.com/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

🔧 제안 패치 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@<COMMIT_SHA>
...
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@<COMMIT_SHA>
...
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@<COMMIT_SHA>

As per path instructions, "외부 액션 버전 핀닝(SHA 또는 태그) 여부 확인" 규칙을 따랐고, 이 저장소의 정적 분석 정책은 SHA 고정을 요구합니다.

Also applies to: 22-22, 24-24, 39-39, 41-41, 43-43, 58-58, 60-60, 62-62

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 20-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 20, The workflow uses mutable action tags,
so pin every external GitHub Action to a full commit SHA to satisfy the
repository’s unpinned-uses policy. Update each action reference in the CI
workflow, including actions/checkout and the other listed action steps, by
replacing the version tag with the corresponding SHA while keeping the same
action names and workflow behavior.

Sources: Path instructions, Linters/SAST tools

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

actions/checkout에 persist-credentials: false를 설정해 토큰 노출면을 줄여주세요.

Line 20, Line 39, Line 58의 checkout 단계는 기본값으로 자격증명이 git 설정에 남습니다. 이 워크플로우는 push가 없으므로 비활성화가 안전하고 최소권한 원칙에 맞습니다.

참고: https://github.com/actions/checkout#usage

🔧 제안 패치 
-      - uses: actions/checkout@<COMMIT_SHA>
+      - uses: actions/checkout@<COMMIT_SHA>
+        with:
+          persist-credentials: false

As per path instructions, "불필요한 권한 부여 여부 확인 (principle of least privilege)" 항목에 따라 권한 최소화를 적용해야 합니다.

Also applies to: 39-39, 58-58

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 20-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 20, The checkout steps in the workflow
currently leave credentials persisted in git by default, which is broader than
needed for this read-only job. Update each `actions/checkout@v4` usage in the
workflow to set `persist-credentials: false` so tokens are not retained after
checkout. Apply this consistently to all checkout entries in the workflow to
align with least-privilege requirements.

Sources: Path instructions, Linters/SAST tools


- uses: pnpm/action-setup@v4

- uses: actions/setup-node@v4
with:
node-version: 24
cache: "pnpm"

- name: Install dependencies
run: pnpm install --frozen-lockfile

- name: Lint
run: pnpm lint

check-types:
name: Type Check
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- uses: pnpm/action-setup@v4

- uses: actions/setup-node@v4
with:
node-version: 24
cache: "pnpm"

- name: Install dependencies
run: pnpm install --frozen-lockfile

- name: Check types
run: pnpm check-types

build:
name: Build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- uses: pnpm/action-setup@v4

- uses: actions/setup-node@v4
with:
node-version: 24
cache: "pnpm"

- name: Install dependencies
run: pnpm install --frozen-lockfile

- name: Build
run: pnpm build
Loading