ci(deps): bump actions/checkout from 6.0.2 to 7.0.0 - #8780
ci(deps): bump actions/checkout from 6.0.2 to 7.0.0#8780dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
area/ci-tooling
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
📝 WalkthroughWalkthroughThe pull request updates pinned Suggested reviewers: 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/sync-community-fork.yaml:
- Around line 21-24: The checkout step is using a secret token
(COMMUNITY_FORK_TOKEN) without disabling credential persistence, which creates a
security risk of credential leakage through artifacts. Add persist-credentials:
false to the with section of the
actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 action to ensure
credentials are not persisted beyond the current job execution.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: ab78103f-7108-4cd6-a936-c6e9c516a490
📒 Files selected for processing (14)
.github/workflows/codespell-reusable.yaml.github/workflows/cpo-container-sync-reusable.yaml.github/workflows/dependabot-commit-fix-reusable.yaml.github/workflows/docs-build-reusable.yaml.github/workflows/envtest-kube-reusable.yaml.github/workflows/envtest-ocp-reusable.yaml.github/workflows/gitlint-reusable.yaml.github/workflows/gocacheprog-test-reusable.yaml.github/workflows/lint-reusable.yaml.github/workflows/reusable-claude-on-pr.yaml.github/workflows/sync-community-fork.yaml.github/workflows/test-reusable.yaml.github/workflows/validate-cpo-overrides.yaml.github/workflows/verify-reusable.yaml
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| fetch-depth: 0 | ||
| token: ${{ secrets.COMMUNITY_FORK_TOKEN }} |
There was a problem hiding this comment.
Add persist-credentials: false to prevent credential leakage via artifacts.
This step checks out the repository using a secret token (COMMUNITY_FORK_TOKEN) but does not disable credential persistence. By default, GitHub Actions persists credentials to artifacts, creating a risk of secret exposure. Although this workflow requires the token for the subsequent push, credentials should not persist beyond the current job execution.
Per the coding guideline on least privilege and the static analysis warning, add persist-credentials: false to the checkout configuration.
🔐 Proposed fix to disable credential persistence
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0
token: ${{ secrets.COMMUNITY_FORK_TOKEN }}
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ secrets.COMMUNITY_FORK_TOKEN }} | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ secrets.COMMUNITY_FORK_TOKEN }} | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 21-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/sync-community-fork.yaml around lines 21 - 24, The
checkout step is using a secret token (COMMUNITY_FORK_TOKEN) without disabling
credential persistence, which creates a security risk of credential leakage
through artifacts. Add persist-credentials: false to the with section of the
actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 action to ensure
credentials are not persisted beyond the current job execution.
Sources: Coding guidelines, Linters/SAST tools
e1b55c2 to
927a893
Compare
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
927a893 to
f29ae8c
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/dependabot-commit-fix-reusable.yaml (1)
25-29: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAvoid persisting write-capable checkout credentials.
Both workflows should disable credential persistence and authenticate only the required push without writing the token into
.git/config.
.github/workflows/dependabot-commit-fix-reusable.yaml#L25-L29: use non-persisted authentication for the amended push toorigin..github/workflows/sync-community-fork.yaml#L21-L24: use non-persisted authentication for the push to the community remote.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependabot-commit-fix-reusable.yaml around lines 25 - 29, Update the checkout steps in .github/workflows/dependabot-commit-fix-reusable.yaml lines 25-29 and .github/workflows/sync-community-fork.yaml lines 21-24 to disable persisted credentials while retaining the required checkout authentication. Ensure each workflow authenticates only its subsequent push to the appropriate remote without writing the token into .git/config.Sources: Path instructions, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/update-ci-job-registry.yaml:
- Around line 15-17: Update the actions/checkout step in the CI workflow to set
persist-credentials to false, preventing COMMUNITY_FORK_TOKEN from being stored
in git configuration. Then update the later git push step to authenticate
explicitly using the intended token while preserving its existing push behavior.
---
Outside diff comments:
In @.github/workflows/dependabot-commit-fix-reusable.yaml:
- Around line 25-29: Update the checkout steps in
.github/workflows/dependabot-commit-fix-reusable.yaml lines 25-29 and
.github/workflows/sync-community-fork.yaml lines 21-24 to disable persisted
credentials while retaining the required checkout authentication. Ensure each
workflow authenticates only its subsequent push to the appropriate remote
without writing the token into .git/config.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: e9f75836-eb86-4de2-94e4-e55c6e5181dc
📒 Files selected for processing (15)
.github/workflows/codespell-reusable.yaml.github/workflows/cpo-container-sync-reusable.yaml.github/workflows/dependabot-commit-fix-reusable.yaml.github/workflows/docs-build-reusable.yaml.github/workflows/envtest-kube-reusable.yaml.github/workflows/envtest-ocp-reusable.yaml.github/workflows/gitlint-reusable.yaml.github/workflows/gocacheprog-test-reusable.yaml.github/workflows/lint-reusable.yaml.github/workflows/reusable-claude-on-pr.yaml.github/workflows/sync-community-fork.yaml.github/workflows/test-reusable.yaml.github/workflows/update-ci-job-registry.yaml.github/workflows/validate-cpo-overrides.yaml.github/workflows/verify-reusable.yaml
🚧 Files skipped from review as they are similar to previous changes (11)
- .github/workflows/docs-build-reusable.yaml
- .github/workflows/gitlint-reusable.yaml
- .github/workflows/gocacheprog-test-reusable.yaml
- .github/workflows/validate-cpo-overrides.yaml
- .github/workflows/codespell-reusable.yaml
- .github/workflows/cpo-container-sync-reusable.yaml
- .github/workflows/lint-reusable.yaml
- .github/workflows/envtest-ocp-reusable.yaml
- .github/workflows/reusable-claude-on-pr.yaml
- .github/workflows/test-reusable.yaml
- .github/workflows/envtest-kube-reusable.yaml
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| token: ${{ secrets.COMMUNITY_FORK_TOKEN }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git ls-files .github/workflows/update-ci-job-registry.yaml
wc -l .github/workflows/update-ci-job-registry.yaml
cat -n .github/workflows/update-ci-job-registry.yamlRepository: openshift/hypershift
Length of output: 2759
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show any nearby references to COMMUNITY_FORK_TOKEN, GH_TOKEN, git push, and checkout credential settings.
rg -n -C 3 'COMMUNITY_FORK_TOKEN|GH_TOKEN|persist-credentials|git push|actions/checkout' .github/workflows/update-ci-job-registry.yaml .github/workflows -g '*.yaml'Repository: openshift/hypershift
Length of output: 19971
Avoid persisting COMMUNITY_FORK_TOKEN from checkout. actions/checkout stores the token in git config by default, and this job runs repository code before the later git push. Set persist-credentials: false here and make the push step authenticate explicitly.
Proposed checkout change
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
token: ${{ secrets.COMMUNITY_FORK_TOKEN }}
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| token: ${{ secrets.COMMUNITY_FORK_TOKEN }} | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| token: ${{ secrets.COMMUNITY_FORK_TOKEN }} | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 15-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/update-ci-job-registry.yaml around lines 15 - 17, Update
the actions/checkout step in the CI workflow to set persist-credentials to
false, preventing COMMUNITY_FORK_TOKEN from being stored in git configuration.
Then update the later git push step to authenticate explicitly using the
intended token while preserving its existing push behavior.
Sources: Path instructions, Linters/SAST tools
|
Stale PRs are closed after 21d of inactivity. If this PR is still relevant, comment to refresh it or remove the stale label. If this PR is safe to close now please do so with /lifecycle stale |
openshift-ci
Bot
added
lifecycle/stale
|
rebase DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Stale PRs rot after 14d of inactivity. Mark the PR as fresh by commenting If this PR is safe to close now please do so with /lifecycle rotten |
openshift-ci
Bot
added
lifecycle/rotten
|
@dependabot[bot]: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Bumps actions/checkout from 6.0.2 to 7.0.0.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)df4cb1cUpdate changelog for v6.0.3 (#2446)Summary by CodeRabbit