ci(deps): bump actions/checkout from 6.0.2 to 7.0.0 - #8678
ci(deps): bump actions/checkout from 6.0.2 to 7.0.0#8678dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
area/ci-tooling
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (14)
✅ Files skipped from review due to trivial changes (3)
🚧 Files skipped from review as they are similar to previous changes (4)
📝 WalkthroughWalkthroughAll 14 GitHub Actions reusable workflow files in Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/gocacheprog-test-reusable.yaml:
- Line 15: The workflow currently pins actions/checkout to the wrong commit SHA
(uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10) while labeling
it as v6.0.3; update the pin so the tag and SHA match by replacing the SHA with
the correct commit for v6.0.3 (9f698171ed81b15d1823a05fc7211befd50c8ae0) or
simply use the tag name (actions/checkout@v6.0.3) in the line referencing
actions/checkout to ensure consistency.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 5aa87a4a-95d5-4b13-937c-8592a2d9eca6
📒 Files selected for processing (14)
.github/workflows/address-review-comments.yaml.github/workflows/codespell-reusable.yaml.github/workflows/cpo-container-sync-reusable.yaml.github/workflows/dependabot-commit-fix-reusable.yaml.github/workflows/docs-build-reusable.yaml.github/workflows/envtest-kube-reusable.yaml.github/workflows/envtest-ocp-reusable.yaml.github/workflows/gitlint-reusable.yaml.github/workflows/gocacheprog-test-reusable.yaml.github/workflows/lint-reusable.yaml.github/workflows/sync-community-fork.yaml.github/workflows/test-reusable.yaml.github/workflows/validate-cpo-overrides.yaml.github/workflows/verify-reusable.yaml
| timeout-minutes: 10 | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify that the commit SHA matches the v6.0.3 tag in actions/checkout
# Fetch the commit SHA for the v6.0.3 tag from the actions/checkout repository
gh api repos/actions/checkout/git/ref/tags/v6.0.3 --jq '.object.sha'
# Expected: df4cb1c069e1874edd31b4311f1884172cec0e10Repository: openshift/hypershift
Length of output: 105
🏁 Script executed:
#!/bin/bash
set -euo pipefail
PINNED_SHA="df4cb1c069e1874edd31b4311f1884172cec0e10"
echo "v6.0.3 tag -> expected object.sha"
gh api repos/actions/checkout/git/ref/tags/v6.0.3 --jq '.object.sha'
echo
echo "Find which actions/checkout tag maps to pinned SHA (top 100 tags)"
gh api repos/actions/checkout/tags --paginate --jq '.[] | {name: .name, commit: .commit.sha}' \
| python3 - <<PY
import sys, json
pinned = "$PINNED_SHA"
hits = []
for line in sys.stdin:
line=line.strip()
if not line:
continue
try:
obj=json.loads(line)
except Exception:
continue
if obj.get("commit","").lower()==pinned.lower():
hits.append(obj.get("name"))
if hits:
print("Pinned SHA matches tag(s):", ", ".join(hits))
else:
print("Pinned SHA not found in returned tag list.")
PYRepository: openshift/hypershift
Length of output: 251
Fix actions/checkout SHA pin to match v6.0.3
The v6.0.3 tag in actions/checkout resolves to 9f698171ed81b15d1823a05fc7211befd50c8ae0, but the workflow pins df4cb1c069e1874edd31b4311f1884172cec0e10 (# v6.0.3), so the tag/SHA mapping is incorrect.
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/gocacheprog-test-reusable.yaml at line 15, The workflow
currently pins actions/checkout to the wrong commit SHA (uses:
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10) while labeling it as
v6.0.3; update the pin so the tag and SHA match by replacing the SHA with the
correct commit for v6.0.3 (9f698171ed81b15d1823a05fc7211befd50c8ae0) or simply
use the tag name (actions/checkout@v6.0.3) in the line referencing
actions/checkout to ensure consistency.
|
rebase DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
177142e to
d3a3095
Compare
openshift-ci
Bot
removed
the
needs-rebase
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/dependabot-commit-fix-reusable.yaml (1)
25-29: ⚡ Quick winMake credential persistence explicit across workflows requiring push access.
Both workflows require persisted credentials for git push operations but rely on default behavior instead of explicit configuration. As per coding guidelines, credential handling should always be explicit to prevent accidental exposure and clearly document intent. Add
persist-credentials: trueto both checkout steps.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependabot-commit-fix-reusable.yaml around lines 25 - 29, The checkout step using actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 (the block with ref: ${{ inputs.head_sha }}, fetch-depth: 2, token: ${{ secrets.GITHUB_TOKEN }}) must explicitly persist GitHub credentials; add persist-credentials: true to that checkout step (and the corresponding checkout in the other workflow) so pushes use explicit credential persistence rather than relying on default behavior.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/dependabot-commit-fix-reusable.yaml:
- Around line 25-29: The checkout step using
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 (the block with ref:
${{ inputs.head_sha }}, fetch-depth: 2, token: ${{ secrets.GITHUB_TOKEN }}) must
explicitly persist GitHub credentials; add persist-credentials: true to that
checkout step (and the corresponding checkout in the other workflow) so pushes
use explicit credential persistence rather than relying on default behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 801443b1-4b86-432c-ac84-a00faeb3e5a6
📒 Files selected for processing (14)
.github/workflows/address-review-comments.yaml.github/workflows/codespell-reusable.yaml.github/workflows/cpo-container-sync-reusable.yaml.github/workflows/dependabot-commit-fix-reusable.yaml.github/workflows/docs-build-reusable.yaml.github/workflows/envtest-kube-reusable.yaml.github/workflows/envtest-ocp-reusable.yaml.github/workflows/gitlint-reusable.yaml.github/workflows/gocacheprog-test-reusable.yaml.github/workflows/lint-reusable.yaml.github/workflows/sync-community-fork.yaml.github/workflows/test-reusable.yaml.github/workflows/validate-cpo-overrides.yaml.github/workflows/verify-reusable.yaml
✅ Files skipped from review due to trivial changes (5)
- .github/workflows/codespell-reusable.yaml
- .github/workflows/gocacheprog-test-reusable.yaml
- .github/workflows/lint-reusable.yaml
- .github/workflows/envtest-ocp-reusable.yaml
- .github/workflows/docs-build-reusable.yaml
🚧 Files skipped from review as they are similar to previous changes (5)
- .github/workflows/verify-reusable.yaml
- .github/workflows/cpo-container-sync-reusable.yaml
- .github/workflows/envtest-kube-reusable.yaml
- .github/workflows/test-reusable.yaml
- .github/workflows/validate-cpo-overrides.yaml
openshift-ci
Bot
added
the
needs-rebase
|
rebase DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
d3a3095 to
f01216f
Compare
openshift-ci
Bot
removed
the
needs-rebase
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/dependabot-commit-fix-reusable.yaml (1)
20-30: ⚡ Quick winConsider adding explicit permissions to follow least privilege.
The workflow does not declare explicit permissions for the
GITHUB_TOKEN. Following the least privilege principle, consider adding apermissionsblock to grant only the requiredcontents: writepermission.🔒 Proposed permissions block
fix-commit-message: name: Fix dependabot commit body runs-on: arc-runner-set timeout-minutes: 5 + permissions: + contents: write steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0As per coding guidelines: "Least privilege: minimize GITHUB_TOKEN permissions" requires declaring minimal required permissions explicitly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependabot-commit-fix-reusable.yaml around lines 20 - 30, The fix-commit-message job is missing an explicit permissions declaration for the GITHUB_TOKEN, which violates the least privilege principle. Add a permissions block at the job level for fix-commit-message specifying contents: write, which is the minimal permission required for the checkout action to function and any subsequent commit operations. Place this permissions block immediately after the timeout-minutes line and before the steps section.Source: Coding guidelines
.github/workflows/sync-community-fork.yaml (1)
12-24: ⚡ Quick winConsider adding explicit permissions to follow least privilege.
The workflow does not declare explicit permissions. Even when using a custom token (
COMMUNITY_FORK_TOKEN), following the least privilege principle requires limiting the defaultGITHUB_TOKENpermissions explicitly.🔒 Proposed permissions block
sync-community-fork: name: Sync Community Fork runs-on: arc-runner-set timeout-minutes: 10 + permissions: + contents: read steps: # Use the community fork token for checkout so that the credential helperAs per coding guidelines: "Least privilege: minimize GITHUB_TOKEN permissions" requires declaring minimal required permissions explicitly. Since this workflow uses a custom token for authentication, the default
GITHUB_TOKENcan be restricted tocontents: read.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/sync-community-fork.yaml around lines 12 - 24, The sync-community-fork workflow does not declare explicit permissions for the default GITHUB_TOKEN, which violates the least privilege principle. Add a permissions block at the workflow level (before or after the job definition for sync-community-fork) that explicitly limits the GITHUB_TOKEN permissions to contents: read, since the workflow uses a custom COMMUNITY_FORK_TOKEN for authentication and the default token only needs minimal read access to repository contents.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/reusable-claude-on-pr.yaml:
- Around line 65-74: The create-github-app-token action in the app-token step is
missing explicit permission constraints, causing the generated token to inherit
all permissions from the GitHub App installation. Add a permissions field to the
create-github-app-token action configuration that restricts the token to only
the required permissions needed for repository content access and pull request
operations. This ensures the token follows the principle of least privilege by
limiting its scope to only contents and pull-requests permissions with
appropriate access levels.
- Around line 27-33: Add an explicit permissions block to the workflow to
enforce least privilege access. The reusable-claude-on-pr workflow currently
lacks permission declarations but uses github.token on multiple lines and
creates a GitHub App token, which requires explicit permission grants. Add a
permissions section at the appropriate level (either workflow-wide or job-level
under the run job) that declares only the minimum required permissions needed
for the operations performed: reading the pull request content, writing
comments/checks if needed, and any other specific permissions required by the
operations on lines 39, 49, 68-73, and 85. Ensure OIDC permissions for GCP
authentication on line 85 are also properly declared.
---
Nitpick comments:
In @.github/workflows/dependabot-commit-fix-reusable.yaml:
- Around line 20-30: The fix-commit-message job is missing an explicit
permissions declaration for the GITHUB_TOKEN, which violates the least privilege
principle. Add a permissions block at the job level for fix-commit-message
specifying contents: write, which is the minimal permission required for the
checkout action to function and any subsequent commit operations. Place this
permissions block immediately after the timeout-minutes line and before the
steps section.
In @.github/workflows/sync-community-fork.yaml:
- Around line 12-24: The sync-community-fork workflow does not declare explicit
permissions for the default GITHUB_TOKEN, which violates the least privilege
principle. Add a permissions block at the workflow level (before or after the
job definition for sync-community-fork) that explicitly limits the GITHUB_TOKEN
permissions to contents: read, since the workflow uses a custom
COMMUNITY_FORK_TOKEN for authentication and the default token only needs minimal
read access to repository contents.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 9c7b4955-db3a-4974-b734-af4b437bcd5d
📒 Files selected for processing (14)
.github/workflows/codespell-reusable.yaml.github/workflows/cpo-container-sync-reusable.yaml.github/workflows/dependabot-commit-fix-reusable.yaml.github/workflows/docs-build-reusable.yaml.github/workflows/envtest-kube-reusable.yaml.github/workflows/envtest-ocp-reusable.yaml.github/workflows/gitlint-reusable.yaml.github/workflows/gocacheprog-test-reusable.yaml.github/workflows/lint-reusable.yaml.github/workflows/reusable-claude-on-pr.yaml.github/workflows/sync-community-fork.yaml.github/workflows/test-reusable.yaml.github/workflows/validate-cpo-overrides.yaml.github/workflows/verify-reusable.yaml
✅ Files skipped from review due to trivial changes (3)
- .github/workflows/gitlint-reusable.yaml
- .github/workflows/codespell-reusable.yaml
- .github/workflows/envtest-kube-reusable.yaml
🚧 Files skipped from review as they are similar to previous changes (4)
- .github/workflows/gocacheprog-test-reusable.yaml
- .github/workflows/docs-build-reusable.yaml
- .github/workflows/envtest-ocp-reusable.yaml
- .github/workflows/test-reusable.yaml
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/dependabot-commit-fix-reusable.yaml (1)
20-30: ⚡ Quick winConsider adding explicit permissions to follow least privilege.
The workflow does not declare explicit permissions for the
GITHUB_TOKEN. Following the least privilege principle, consider adding apermissionsblock to grant only the requiredcontents: writepermission.🔒 Proposed permissions block
fix-commit-message: name: Fix dependabot commit body runs-on: arc-runner-set timeout-minutes: 5 + permissions: + contents: write steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0As per coding guidelines: "Least privilege: minimize GITHUB_TOKEN permissions" requires declaring minimal required permissions explicitly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependabot-commit-fix-reusable.yaml around lines 20 - 30, The fix-commit-message job is missing an explicit permissions declaration for the GITHUB_TOKEN, which violates the least privilege principle. Add a permissions block at the job level for fix-commit-message specifying contents: write, which is the minimal permission required for the checkout action to function and any subsequent commit operations. Place this permissions block immediately after the timeout-minutes line and before the steps section.Source: Coding guidelines
.github/workflows/sync-community-fork.yaml (1)
12-24: ⚡ Quick winConsider adding explicit permissions to follow least privilege.
The workflow does not declare explicit permissions. Even when using a custom token (
COMMUNITY_FORK_TOKEN), following the least privilege principle requires limiting the defaultGITHUB_TOKENpermissions explicitly.🔒 Proposed permissions block
sync-community-fork: name: Sync Community Fork runs-on: arc-runner-set timeout-minutes: 10 + permissions: + contents: read steps: # Use the community fork token for checkout so that the credential helperAs per coding guidelines: "Least privilege: minimize GITHUB_TOKEN permissions" requires declaring minimal required permissions explicitly. Since this workflow uses a custom token for authentication, the default
GITHUB_TOKENcan be restricted tocontents: read.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/sync-community-fork.yaml around lines 12 - 24, The sync-community-fork workflow does not declare explicit permissions for the default GITHUB_TOKEN, which violates the least privilege principle. Add a permissions block at the workflow level (before or after the job definition for sync-community-fork) that explicitly limits the GITHUB_TOKEN permissions to contents: read, since the workflow uses a custom COMMUNITY_FORK_TOKEN for authentication and the default token only needs minimal read access to repository contents.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/reusable-claude-on-pr.yaml:
- Around line 65-74: The create-github-app-token action in the app-token step is
missing explicit permission constraints, causing the generated token to inherit
all permissions from the GitHub App installation. Add a permissions field to the
create-github-app-token action configuration that restricts the token to only
the required permissions needed for repository content access and pull request
operations. This ensures the token follows the principle of least privilege by
limiting its scope to only contents and pull-requests permissions with
appropriate access levels.
- Around line 27-33: Add an explicit permissions block to the workflow to
enforce least privilege access. The reusable-claude-on-pr workflow currently
lacks permission declarations but uses github.token on multiple lines and
creates a GitHub App token, which requires explicit permission grants. Add a
permissions section at the appropriate level (either workflow-wide or job-level
under the run job) that declares only the minimum required permissions needed
for the operations performed: reading the pull request content, writing
comments/checks if needed, and any other specific permissions required by the
operations on lines 39, 49, 68-73, and 85. Ensure OIDC permissions for GCP
authentication on line 85 are also properly declared.
---
Nitpick comments:
In @.github/workflows/dependabot-commit-fix-reusable.yaml:
- Around line 20-30: The fix-commit-message job is missing an explicit
permissions declaration for the GITHUB_TOKEN, which violates the least privilege
principle. Add a permissions block at the job level for fix-commit-message
specifying contents: write, which is the minimal permission required for the
checkout action to function and any subsequent commit operations. Place this
permissions block immediately after the timeout-minutes line and before the
steps section.
In @.github/workflows/sync-community-fork.yaml:
- Around line 12-24: The sync-community-fork workflow does not declare explicit
permissions for the default GITHUB_TOKEN, which violates the least privilege
principle. Add a permissions block at the workflow level (before or after the
job definition for sync-community-fork) that explicitly limits the GITHUB_TOKEN
permissions to contents: read, since the workflow uses a custom
COMMUNITY_FORK_TOKEN for authentication and the default token only needs minimal
read access to repository contents.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 9c7b4955-db3a-4974-b734-af4b437bcd5d
📒 Files selected for processing (14)
.github/workflows/codespell-reusable.yaml.github/workflows/cpo-container-sync-reusable.yaml.github/workflows/dependabot-commit-fix-reusable.yaml.github/workflows/docs-build-reusable.yaml.github/workflows/envtest-kube-reusable.yaml.github/workflows/envtest-ocp-reusable.yaml.github/workflows/gitlint-reusable.yaml.github/workflows/gocacheprog-test-reusable.yaml.github/workflows/lint-reusable.yaml.github/workflows/reusable-claude-on-pr.yaml.github/workflows/sync-community-fork.yaml.github/workflows/test-reusable.yaml.github/workflows/validate-cpo-overrides.yaml.github/workflows/verify-reusable.yaml
✅ Files skipped from review due to trivial changes (3)
- .github/workflows/gitlint-reusable.yaml
- .github/workflows/codespell-reusable.yaml
- .github/workflows/envtest-kube-reusable.yaml
🚧 Files skipped from review as they are similar to previous changes (4)
- .github/workflows/gocacheprog-test-reusable.yaml
- .github/workflows/docs-build-reusable.yaml
- .github/workflows/envtest-ocp-reusable.yaml
- .github/workflows/test-reusable.yaml
🛑 Comments failed to post (2)
.github/workflows/reusable-claude-on-pr.yaml (2)
27-33:
⚠️ Potential issue | 🟠 Major🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail # Verify explicit permissions in this reusable workflow and its call sites rg -n -C3 '^\s*permissions:' .github/workflows/reusable-claude-on-pr.yaml .github/workflows rg -n -C5 'reusable-claude-on-pr\.ya?ml' .github/workflowsRepository: openshift/hypershift
Length of output: 14420
🏁 Script executed:
cat -n .github/workflows/reusable-claude-on-pr.yaml | head -100Repository: openshift/hypershift
Length of output: 4670
🏁 Script executed:
cat -n .github/workflows/reusable-claude-on-pr.yaml | tail -50Repository: openshift/hypershift
Length of output: 2807
🏁 Script executed:
# Check what permissions the caller workflows declare when calling this reusable workflow for workflow in restructure-commits rebase address-review-comments; do echo "=== $workflow.yaml ===" rg -A15 'uses.*reusable-claude-on-pr' .github/workflows/$workflow.yaml | head -20 doneRepository: openshift/hypershift
Length of output: 1393
Declare explicit workflow/job
permissionsto enforce least privilege.The workflow lacks an explicit
permissions:block. Lines 39 and 49 usegithub.token, line 85 requires OIDC authentication for GCP, and lines 68–73 create a GitHub App token, but the workflow does not declare the minimum permissions needed for these operations.Suggested hardening
jobs: run: + permissions: + contents: read + pull-requests: write + id-token: write concurrency: group: ${{ inputs.command-name }}-${{ github.event.issue.number }}Per coding guidelines: "Least privilege: minimize GITHUB_TOKEN permissions."
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.jobs: run: permissions: contents: read pull-requests: write id-token: write concurrency: group: ${{ inputs.command-name }}-${{ github.event.issue.number }} cancel-in-progress: true runs-on: arc-runner-set timeout-minutes: 45🧰 Tools
🪛 actionlint (1.7.12)
[error] 32-32: label "arc-runner-set" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2025-vs2026", "windows-2022", "windows-11-arm", "ubuntu-slim", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xlarge", "macos-latest-large", "macos-26-intel", "macos-26-xlarge", "macos-26-large", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xlarge", "macos-14-large", "macos-14", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/reusable-claude-on-pr.yaml around lines 27 - 33, Add an explicit permissions block to the workflow to enforce least privilege access. The reusable-claude-on-pr workflow currently lacks permission declarations but uses github.token on multiple lines and creates a GitHub App token, which requires explicit permission grants. Add a permissions section at the appropriate level (either workflow-wide or job-level under the run job) that declares only the minimum required permissions needed for the operations performed: reading the pull request content, writing comments/checks if needed, and any other specific permissions required by the operations on lines 39, 49, 68-73, and 85. Ensure OIDC permissions for GCP authentication on line 85 are also properly declared.Source: Coding guidelines
65-74:
⚠️ Potential issue | 🟠 Major🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail # Audit all GitHub App token usages and whether permission-* inputs are set rg -n -C5 'actions/create-github-app-token@|permission-[a-z-]+:' .github/workflowsRepository: openshift/hypershift
Length of output: 1026
🌐 Web query:
actions/create-github-app-token v2 permission inputs documentation💡 Result:
In actions/create-github-app-token v2, permissions are managed through dynamically generated input parameters that follow the naming convention
permission-<permission-name>[1][2][3]. Key aspects of the permission system: Input Format: Every available GitHub App permission can be requested by prefixing the standard GitHub permission key withpermission-(e.g.,pull-requestsbecomespermission-pull-requests) [1][4]. Values: These inputs typically acceptreadorwriteaccess levels [2]. Certain permissions may also supportadminif applicable to that specific scope [5][6]. Default Behavior: If nopermission-*inputs are specified, the generated token defaults to inheriting all permissions currently granted to the GitHub App installation [1][2]. It is a recommended practice to explicitly list only the required permissions to adhere to the principle of least privilege [1][4][3]. Validation: The action performs validation on these inputs [1][7]. Note that requesting a permission via an input does not grant it if the GitHub App installation itself lacks that permission; attempting to use a permission not held by the installation will result in an error [1][2]. Technical Implementation: The action uses these individual inputs to benefit from the built-in type intelligence and validation provided by the GitHub Actions runner [1][3]. The logic parses theINPUT_PERMISSION-*environment variables, normalizes them, and builds the final permissions object for the API request [7][2]. You can find the full list of supported permissions by reviewing the action.yml file in the official repository [5][8].Citations:
- 1: https://github.com/actions/create-github-app-token/blob/5c1e00d1af39c515564da2ae21cc9dedf0793346/README.md
- 2: https://deepwiki.com/actions/create-github-app-token/4.1-action-inputs
- 3: actions/create-github-app-token@0e0aa99
- 4: https://github.com/actions/create-github-app-token
- 5: https://github.com/actions/create-github-app-token/blob/93c1f04d6f14ea5b416e7a8dfd80446101c6adef/action.yml
- 6: https://github.com/actions/create-github-app-token/blob/29824e69f54612133e76f7eaac726eef6c875baf/action.yml
- 7: https://deepwiki.com/actions/create-github-app-token/4.2-permission-system
- 8: https://github.com/actions/create-github-app-token/blob/df432cee/action.yml
🏁 Script executed:
#!/bin/bash # Check what inputs the actions/create-github-app-token action supports # by looking at its documentation or GitHub repository curl -s "https://api.github.com/repos/actions/create-github-app-token/contents/action.yml" | jq -r '.content' | base64 -d | head -50Repository: openshift/hypershift
Length of output: 67
🏁 Script executed:
#!/bin/bash cat -n .github/workflows/reusable-claude-on-pr.yaml | head -100Repository: openshift/hypershift
Length of output: 4670
🏁 Script executed:
#!/bin/bash cat -n .github/workflows/reusable-claude-on-pr.yaml | tail -100Repository: openshift/hypershift
Length of output: 5104
🏁 Script executed:
#!/bin/bash # Check if there are any references to issues or other GitHub operations in the workflow grep -n "issue\|label\|workflow_dispatch" .github/workflows/reusable-claude-on-pr.yamlRepository: openshift/hypershift
Length of output: 461
Scope the GitHub App token to only required permissions.
Lines 65-74 generate an installation token without explicit
permission-*constraints, causing it to inherit all permissions granted to the GitHub App installation. This violates the principle of least privilege. The token is used for checkout and Claude Code operations that require write access to repository contents and pull requests.Suggested hardening
- name: Generate community fork token if: steps.token.outputs.use_fork_token == 'true' id: app-token uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2 with: app-id: ${{ secrets.JIRA_SOLVE_CI_APP_ID }} private-key: ${{ secrets.JIRA_SOLVE_CI_PRIVATE_KEY }} owner: hypershift-community repositories: hypershift + permission-contents: write + permission-pull-requests: write🧰 Tools
🪛 zizmor (1.25.2)
[error] 68-68: dangerous use of GitHub App tokens (github-app): app token inherits blanket installation permissions
(github-app)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/reusable-claude-on-pr.yaml around lines 65 - 74, The create-github-app-token action in the app-token step is missing explicit permission constraints, causing the generated token to inherit all permissions from the GitHub App installation. Add a permissions field to the create-github-app-token action configuration that restricts the token to only the required permissions needed for repository content access and pull request operations. This ensures the token follows the principle of least privilege by limiting its scope to only contents and pull-requests permissions with appropriate access levels.Source: Linters/SAST tools
|
@dependabot[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Superseded by #8780. |
Bumps actions/checkout from 6.0.2 to 7.0.0.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)df4cb1cUpdate changelog for v6.0.3 (#2446)Summary by CodeRabbit