Harden CI supply chain: pin actions, drop stray id-token, add CODEOWNERS - #393
Conversation
Security hardening for the GitHub Actions footprint. No behavior change to any workflow — same actions, same versions, same jobs. - SHA-pin every third-party and first-party action to a full commit SHA (with a `# vX` comment) across all workflows. Most important: the two that previously floated on mutable refs and carry write scope/secrets — anthropics/claude-code-action (@v1 tag) and pypa/gh-action-pypi-publish (@release/v1 *branch*). Leaves the already-pinned security-scan.yml and the generated issue-triage.lock.yml alone. - Remove `id-token: write` from the five LLM agent jobs (issue-solver, pr-review, maintenance, ecosystem-scout, review-panel). None of them publish via OIDC, so the scope was unnecessary. It now remains only in release.yml (PyPI trusted publishing) and pages.yml (Pages deploy). - Add .github/CODEOWNERS assigning @stbenjam as default owner with explicit ownership on the write-token surface (.github/, action.yml, review/) and supply-chain paths (release.yml, pyproject.toml, requirements*). Note it only becomes enforcing once main requires >=1 approval and "Require review from Code Owners" is enabled. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 45 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR adds a ChangesCODEOWNERS and workflow pinning
Estimated code review effort: 2 (Simple) | ~15 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a .github/CODEOWNERS file to define code ownership and review requirements for the repository, assigning @stbenjam as the default owner and the primary reviewer for CI, automation, and release-critical paths. There are no review comments, and I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #393 +/- ##
=======================================
Coverage 84.83% 84.83%
=======================================
Files 135 135
Lines 9943 9943
=======================================
Hits 8435 8435
Misses 1508 1508 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v5 | ||
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 |
There was a problem hiding this comment.
📝 Info: setup-python bumped from v5 to v6 in rule-impact workflow as part of SHA pinning
In .github/workflows/rule-impact.yml:34, actions/setup-python was upgraded from @v5 to @ece7cb06caefa5fff74198d8649806c4678c61a1 # v6. This is the only workflow where the version actually changed (all others were already on v6). This aligns it with the rest of the workflows and is likely intentional, but it's a behavioral change beyond pure SHA pinning — setup-python v6 may have different defaults or behavior.
Was this helpful? React with 👍 or 👎 to provide feedback.
- CODEOWNERS: drop the per-path entries, just `* @stbenjam`. - rule-impact.yml: bump actions/setup-python v5 -> v6 SHA so every workflow is on the same version (per Devin review on #393). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
|
||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 |
There was a problem hiding this comment.
🔍 Version comment on actions/checkout SHA may warrant verification
Every workflow pins actions/checkout to SHA 93cb6efe18208431cddfb8368fd83d5badbf9bfd with the comment # v5. Based on older public references, this SHA has been associated with actions/checkout@v4.2.2 rather than v5. If the comment is wrong, the action still works correctly (it just runs v4 instead of v5), but the mislabeled comment could cause confusion during future version audits or Dependabot updates. Worth a quick cross-check against the actions/checkout releases page to confirm the SHA-to-tag mapping.
Was this helpful? React with 👍 or 👎 to provide feedback.
Keeps the SHA-pinned actions patched without PR spam: all GitHub Actions bumps land in one grouped PR per month (updates both the SHA and the `# vX` comment), and Python deps in another. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
#393 removed `id-token: write` from the five claude-code-action jobs on the grounds that "none of them publish via OIDC". The action does use OIDC: it exchanges a GitHub OIDC token for its app token as the first thing it does at startup, so every one of those jobs now aborts before running: Requesting OIDC token... error: Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable Could not fetch an OIDC token. Did you remember to add `id-token: write` to your workflow permissions? This went unnoticed because the issue-solver, pr-review and review-panel jobs gate their claude-code-action step behind an `if:` that has been false on every scheduled run since. Skillsaw Maintenance is dispatch-only, so its first manual run after #393 surfaced it (run 29915664997). Restore the permission on all five, with a comment explaining why it is needed so it does not get pruned as "stray" again. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2 participants
Security hardening for the GitHub Actions footprint, from an audit of the
write-token surface. No behavior change — same actions, same versions,
same jobs; only how they're referenced and scoped.
What & why
SHA-pin every action. All third-party and first-party
uses:are nowpinned to a full 40-char commit SHA with a
# vXcomment. A floating tag orbranch can be silently repointed to attacker code that runs with the
workflow's token. Highest-value pins (write scope + secrets, previously on
mutable refs):
anthropics/claude-code-action— was@v1(mutable tag)pypa/gh-action-pypi-publish— was@release/v1(mutable branch), on the PyPI publish jobsecurity-scan.yml/codeqlwere already SHA-pinned and are untouched. Thegenerated
issue-triage.lock.ymlis intentionally not hand-edited (regeneratevia
gh aw compileif its pins need bumping).Drop unnecessary
id-token: write. Removed from the five LLM agent jobs(
issue-solver,pr-review,maintenance,ecosystem-scout,review-panel)— none publish via OIDC, so the scope was over-provisioned. It now survives
only in
release.yml(PyPI trusted publishing) andpages.yml(Pages deploy),where OIDC is actually used.
Add
CODEOWNERS.@stbenjamas default owner, with explicit ownership onthe write-token surface (
.github/,action.yml,review/) and supply-chainpaths (
release.yml,pyproject.toml,requirements*).Not in this PR — repo settings you still need to click
CODEOWNERS is inert until
mainrequires ≥1 approving review and"Require review from Code Owners" is enabled. Today
mainrequires 0approvals, which means an agent with
contents: writecan merge a green PRwith no human sign-off. Also recommend adding a required reviewer to the
pypienvironment (currently no protection rules) so every publish needsexplicit approval. These are account settings, not files.
🤖 Generated with Claude Code
Summary by CodeRabbit