Bump pinned GitHub Actions with matching tests - #490
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_190a7c21-98e8-47f9-a06d-3b74c2a28686) |
📝 WalkthroughWalkthroughThe pull request updates pinned GitHub Actions revisions across CI, operational, production, and secret-scanning workflows. Two workflow tests now expect the updated pinned commits. ChangesGitHub Actions pin refresh
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/cross-browser-matrix.yml (1)
26-26: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDisable checkout credential persistence before uploading artifacts.
actions/checkoutdefaultspersist-credentialstotrue. This job later uploadstest-results/. The current path does not prove that.gitenters the artifact, but a test or future path change could expose repository credentials. Setpersist-credentials: falseunless later steps require authenticated Git commands. The checkout documentation recommends this opt-out, and zizmor identifies checkout-to-artifact flows as anartipackedrisk. (github.com)- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: falseVerify that
scripts/run-cross-browser-risk-proof.mjsdoes not copy.gitor credential-bearing files intotest-results/.Also applies to: 46-48
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cross-browser-matrix.yml at line 26, Update the actions/checkout step in the cross-browser workflow to set persist-credentials to false, unless a later step requires authenticated Git commands. Verify scripts/run-cross-browser-risk-proof.mjs excludes .git and credential-bearing files from test-results before artifact upload.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/finalize-production-soak.yml:
- Around line 108-110: Update the second actions/checkout step using the
verify_deploy_run SHA to set persist-credentials to false, while preserving its
existing ref configuration.
---
Nitpick comments:
In @.github/workflows/cross-browser-matrix.yml:
- Line 26: Update the actions/checkout step in the cross-browser workflow to set
persist-credentials to false, unless a later step requires authenticated Git
commands. Verify scripts/run-cross-browser-risk-proof.mjs excludes .git and
credential-bearing files from test-results before artifact upload.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 37f38f9c-80dd-4684-8cda-204552378722
📒 Files selected for processing (10)
.github/workflows/ci.yml.github/workflows/cross-browser-matrix.yml.github/workflows/d1-backup-r2.yml.github/workflows/d1-backup-validate.yml.github/workflows/d1-remote-restore-evidence.yml.github/workflows/deploy-production.yml.github/workflows/finalize-production-soak.yml.github/workflows/secret-scan.ymltests/deploy-production-gate.test.tstests/finalize-production-soak-workflow.test.ts
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| ref: ${{ steps.verify_deploy_run.outputs.sha }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=".github/workflows/finalize-production-soak.yml"
printf '%s\n' "Relevant workflow section:"
sed -n '1,180p' "$file"
printf '%s\n' "All checkout and Git-related references:"
rg -n -i 'checkout|git|release|artifact|upload|persist-credentials|token' "$file"Repository: nish3451/0509
Length of output: 11148
🌐 Web query:
actions/checkout v7 persist-credentials default .git/config documentation
💡 Result:
In actions/checkout (including v7), the persist-credentials input defaults to true [1][2]. When enabled, this option configures Git to use the provided authentication token or SSH key for subsequent Git commands within the workflow [3][4]. Important changes to how this is implemented were introduced starting in v6: 1. Security Improvement: Instead of writing credentials directly into the repository's local.git/config file, the action now stores them in a separate configuration file located under $RUNNER_TEMP [5][6][7]. 2. Implementation: The action uses Git's includeIf mechanism to conditionally include this separate credential file based on the Git directory path [8][9]. This design isolates credentials from the main repository configuration, improving security while maintaining automatic functionality for commands like git fetch or git push [5][8][9]. You can opt out of this behavior by explicitly setting persist-credentials to false in your workflow step [3][4]. If you choose to do so, the action will not configure any credentials for Git commands [3][4]. The token is automatically removed during the post-job cleanup phase regardless of the configuration [3][6].
Citations:
- 1: https://github.com/actions/checkout/blob/34e114876b0b11c390a56381ad16ebd13914f8d5/action.yml
- 2: https://github.com/actions/checkout/blob/72f2cec99f417b1a1c5e2e88945068983b7965f9/action.yml
- 3: https://github.com/actions/checkout/?tab=readme-ov-file
- 4: https://github.com/actions/checkout
- 5: actions/checkout@v4.2.2...v7
- 6: https://github.com/marketplace/actions/checkout
- 7: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 8: Persist creds to a separate file actions/checkout#2286
- 9: https://github.com/actions/checkout/pull/2286/files
🏁 Script executed:
#!/bin/bash
set -eu
file=".github/workflows/finalize-production-soak.yml"
printf '%s\n' "Remaining workflow steps:"
sed -n '175,220p' "$file"
printf '%s\n' "Git command references after the second checkout:"
python3 - <<'PY'
from pathlib import Path
path = Path(".github/workflows/finalize-production-soak.yml")
lines = path.read_text().splitlines()
second = next(i for i, line in enumerate(lines) if "actions/checkout@" in line and i > 0)
for number, line in enumerate(lines[second + 1:], second + 2):
if any(token in line.lower() for token in ("git ", "git\n", "git\t")):
print(f"{number}: {line}")
PY
printf '%s\n' "Credential persistence settings:"
rg -n -C 2 'persist-credentials|actions/checkout@' "$file"Repository: nish3451/0509
Length of output: 1504
Disable credential persistence on the second checkout.
actions/checkout@v7 persists ${{ github.token }} for later Git commands by default. It stores this configuration under $RUNNER_TEMP, not .git/config. Set persist-credentials: false because no later step requires Git credentials.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 108-110: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/finalize-production-soak.yml around lines 108 - 110,
Update the second actions/checkout step using the verify_deploy_run SHA to set
persist-credentials to false, while preserving its existing ref configuration.
Source: Linters/SAST tools
1 participant
Summary
This is the reviewed current-main successor for the surviving action-pin changes from #482 and #379.
Validation
Note
Medium Risk
Touches production deploy, D1 backup/restore, and CI checkout/Node setup via third-party action upgrades; behavior should be unchanged but regressions would affect release and verification paths.
Overview
Bumps pinned commit SHAs for shared GitHub Actions across eight workflows, with no changes to job logic, inputs, or deployment semantics.
actions/checkoutmoves to v7.0.1,actions/setup-nodeto v7.0.0,actions/upload-artifactto v7.0.1 (cross-browser failure uploads), andactions/github-scriptto v9.0.0 (production soak finalization provenance step). Affected pipelines include CI, cross-browser matrix, D1 backup/validate/restore evidence, production deploy, soak finalization, and secret scan.tests/deploy-production-gate.test.tsandtests/finalize-production-soak-workflow.test.tsupdate the exact action pin strings those suites assert against.Reviewed by Cursor Bugbot for commit ccb8caf. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit
Chores
Tests