docs(audit) + 11 fixes: auditoria exaustiva 2026-05-23 + plano de 20 etapas #124
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -26,7 +26,7 @@ jobs: | |
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v5 | ||
|
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== File = .github/workflows/codeql.yml =="
ls -la .github/workflows/codeql.yml || true
echo
echo "== Lines around checkout (approx 1-80) =="
nl -ba .github/workflows/codeql.yml | sed -n '1,120p'
echo
echo "== All checkout uses in the workflow =="
rg -n "uses:\s*actions/checkout@" .github/workflows/codeql.yml || true
echo
echo "== Any persist-credentials configuration =="
rg -n "persist-credentials" .github/workflows/codeql.yml || trueRepository: adm01-debug/promo-gifts-v4 Length of output: 293 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== File = .github/workflows/codeql.yml =="
sed -n '1,200p' .github/workflows/codeql.yml | cat
echo
echo "== Lines with checkout uses =="
grep -nE "uses:\s*actions/checkout@" .github/workflows/codeql.yml || true
echo
echo "== Lines with persist-credentials =="
grep -nE "persist-credentials" .github/workflows/codeql.yml || trueRepository: adm01-debug/promo-gifts-v4 Length of output: 1084 🌐 Web query:
💡 Result: For actions/checkout v5, the input persist-credentials has no explicit documented boolean default; instead, the README shows the default as an empty value (persist-credentials: ''). This corresponds to the action’s default behavior of persisting credentials (token/SSH key) into the local git configuration unless you set persist-credentials: false. The documentation also states that the auth token is persisted in local git config and removed during post-job cleanup, and that you can opt out by setting persist-credentials: false [1][2]. Citations:
🌐 Web query:
💡 Result: Best practice: in GitHub Actions workflows, pin the action you “use” to a full-length commit SHA (immutable reference) instead of a mutable tag like v5. GitHub documents that pinning to a full-length commit SHA is the only way to use an action as an immutable release and helps mitigate the risk of a malicious backdoor being added to the action’s repository.[1] Why v5 tags are not equivalent to SHA pinning - A tag reference such as actions/checkout@v5 is a moving, mutable Git ref; workflows that use tags can end up running different code over time if the tag is repointed (or if the action maintainer is compromised).[1] - Pinning to a commit SHA prevents silent changes because the commit SHA is immutable; the exact code state identified by that SHA is what will be executed.[1] What this looks like in YAML - Less secure (tag): - uses: actions/some-action@v5 - More secure (commit SHA): - uses: actions/some-action@ (Many teams keep the human-readable version as a comment for maintainability.)[2] How to keep SHAs up to date - Because commit SHAs are immutable, you must intentionally update pins when you want newer action versions; tools exist to automatically convert/update workflow pins to the latest SHA for a given tag.[3] Direct answer - To follow the security best practice implied by the docs, replace references like actions/ Citations:
Fix de segurança no checkout (CodeQL): pin SHA e desative persistência de credenciais.
🧰 Tools🪛 zizmor (1.25.2)[warning] 28-29: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 29-29: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI Agents |
||
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v4 | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -37,8 +37,8 @@ jobs: | |
| runs-on: ubuntu-latest | ||
| timeout-minutes: 5 | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - uses: actions/setup-node@v6 | ||
|
Comment on lines
+40
to
+41
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/contract-tests.yml"
echo "== File: $FILE =="
echo
nl -ba "$FILE" | sed -n '1,160p'
echo
echo "== uses: lines =="
rg -n "uses:\s*actions/(checkout|setup-node)@|persist-credentials:" "$FILE" -n || trueRepository: adm01-debug/promo-gifts-v4 Length of output: 181 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/contract-tests.yml"
echo "== File: $FILE =="
echo
if [ ! -f "$FILE" ]; then
echo "Arquivo não encontrado: $FILE"
exit 1
fi
# Mostrar com numeração (sem nl)
awk '{printf "%6d\t%s\n", NR, $0}' "$FILE" | sed -n '1,220p'
echo
echo "== Evidências: uses/actions e persist-credentials =="
awk '{print NR "\t" $0}' "$FILE" | rg -n "uses:\s*actions/(checkout|setup-node)@|persist-credentials:" || trueRepository: adm01-debug/promo-gifts-v4 Length of output: 4637 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/contract-tests.yml"
echo "== persist-credentials no workflow =="
rg -n "persist-credentials\s*:" "$FILE" || true
echo
echo "== uses actions/*`@v`* (sem SHA) =="
rg -n "uses:\s*actions/[A-Za-z0-9_-]+@v[0-9]+" "$FILE" || true
echo
echo "== uses actions/*@<não-v>" # ajuda a ver se tem SHA em algum lugar
rg -n "uses:\s*actions/[A-Za-z0-9_-]+@([0-9a-f]{7,40})\b" "$FILE" || trueRepository: adm01-debug/promo-gifts-v4 Length of output: 322 🌐 Web query:
💡 Result: The actions/checkout input persist-credentials defaults to true. In the official actions/checkout README, the option is documented as “Default: true” and describes that “The auth token is persisted in the local git config… Set persist-credentials: false to opt-out.” [1][2] So the default value is: true. Citations:
Padronize o pin das Actions e desative persist-credentials no checkout. O workflow usa
🧰 Tools🪛 zizmor (1.25.2)[warning] 40-40: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 40-40: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) [error] 41-41: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI Agents |
||
| with: | ||
| node-version: '20' | ||
| cache: 'npm' | ||
|
|
@@ -63,9 +63,9 @@ jobs: | |
| if: github.event.pull_request.head.repo.full_name == github.repository | ||
| timeout-minutes: 15 | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
|
|
||
| - uses: actions/setup-node@v6 | ||
| with: | ||
| node-version: '20' | ||
| cache: 'npm' | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: adm01-debug/promo-gifts-v4
Length of output: 193
🏁 Script executed:
Repository: adm01-debug/promo-gifts-v4
Length of output: 7629
Pin
actions/checkoutem SHA imutável.actions/checkout@v5está referenciado por tag (mutável), enfraquecendo a cadeia de confiança do workflow. Troque por um commit SHA fixo da releasev5(neste arquivo, esse é o únicousessem pinagem por SHA).🧰 Tools
🪛 zizmor (1.25.2)
[error] 40-40: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents