Prevent checkout default-branch warnings#207
Merged
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughSummary by CodeRabbit릴리스 노트
WalkthroughGitHub Actions 워크플로우들에 GIT_CONFIG_* 환경변수를 추가해 ChangesGit 초기 분기 가드 적용
Sequence Diagram(s)(생성 조건에 부합하지 않아 생략) Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Review rate limit: 3/5 reviews remaining, refill in 14 minutes and 30 seconds. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@scripts/checks/verify_supply_chain.py`:
- Around line 401-439: The code falsely flags workflows because
verify_checkout_default_branch_guard simply searches for "actions/checkout@"
anywhere (including commented lines) and workflow_top_level_env only matches a
strict "env:" line and env entries with exactly two spaces. Update
verify_checkout_default_branch_guard to detect actions/checkout@ only on
non-commented lines (e.g., scan lines and ignore lines whose first
non-whitespace char is '#'); update workflow_top_level_env to match the env
header with a tolerant regex like r'^\s*env:\b' so "env: # ..." is accepted, and
accept env entries with any indentation using
r'^\s+([A-Za-z_][A-Za-z0-9_]*):\s*(.*?)\s*$' while still stripping inline
comments and quotes; keep the rest of the logic and use the same
CHECKOUT_DEFAULT_BRANCH_GUARD_ENV and CHECKOUT_DEFAULT_BRANCH_GUARD_VIOLATION
symbols.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 4287c9e5-cf29-42e2-aa26-bb3262e05863
📒 Files selected for processing (13)
.github/workflows/bandit.yml.github/workflows/build-baseline.yml.github/workflows/ci.yml.github/workflows/codeql.yml.github/workflows/dependency-review.yml.github/workflows/ossf-scorecard.yml.github/workflows/release.yml.github/workflows/sbom.yml.github/workflows/secret-scan-gate.yml.github/workflows/security-audit.yml.github/workflows/trivy.ymlscripts/checks/verify_supply_chain.pyservices/analysis-engine/tests/test_supply_chain_policy.py
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@scripts/checks/verify_supply_chain.py`:
- Around line 435-439: The current guard uses a simple substring check ("if
'actions/checkout@' not in content_without_comments") which causes false
positives when that substring appears in run: commands or string literals;
change the check to only match a uses: step. Replace the substring test with a
regex search on content_without_comments (e.g.
re.search(r'(?m)^\s*uses:\s*(?:["\'])?actions/checkout@',
content_without_comments)) so only lines that declare a uses: action for
actions/checkout are accepted; update the code around content_without_comments
and the if-check accordingly.
- Around line 413-422: The parser is treating any indented "key: value" line as
top-level by using env_line_without_comment.startswith(" ") and a loose regex;
fix it by capturing the base indentation when you enter the env block and only
accept key/value lines whose leading whitespace matches that expected depth.
Concretely: when you detect the env block, record the indentation (e.g.,
base_indent = len(re.match(r"^(\s*)", env_line_without_comment).group(1))) and
change the regex/match check to require that the line begins with exactly
base_indent plus the expected additional indent (or use
r"^\s{N}([A-Za-z_][A-Za-z0-9_]*):\s*(.*?)\s*$" with N computed), then continue
to populate env[match.group(1)] only when that indent test passes.
In `@services/analysis-engine/tests/test_supply_chain_policy.py`:
- Around line 233-271: Add a regression test that covers the top-level env
nested-map bypass: create a new (or extend existing) test similar to
test_supply_chain_check_rejects_nested_checkout_default_branch_guard that writes
a workflow where the workflow's env contains a nested mapping (e.g., env:
CONFIGS: { GIT_CONFIG_COUNT: "1", GIT_CONFIG_KEY_0: init.defaultBranch,
GIT_CONFIG_VALUE_0: develop }) and then call
verify_checkout_default_branch_guard() to assert it returns the same violation
string; reference the test function name
test_supply_chain_check_rejects_top_level_nested_env_checkout_default_branch_guard
(or update the existing
test_supply_chain_check_rejects_nested_checkout_default_branch_guard) and ensure
the expected violation message matches the current assertion text.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: d25d76df-4b8f-4ac2-b03f-f9f7564d3e20
📒 Files selected for processing (2)
scripts/checks/verify_supply_chain.pyservices/analysis-engine/tests/test_supply_chain_policy.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
init.defaultBranch=developguard before checkout across workflows that useactions/checkout.Verification
uv run --project services/analysis-engine pytest services/analysis-engine/tests/test_supply_chain_policy.py -quv run --project services/analysis-engine ruff check scripts/checks/verify_supply_chain.py services/analysis-engine/tests/test_supply_chain_policy.pypython3 scripts/checks/verify_supply_chain.pypython3 scripts/checks/security_gates.py./scripts/harness/quickcheck.shCloses #204