chore(deps): update actions/checkout action to v7 - #581
Conversation
|
Warning Review limit reached
More reviews will be available in 3 minutes and 18 seconds. Learn how PR review limits work. To continue reviewing without waiting, enable usage-based billing in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (25)
📝 WalkthroughWalkthroughAll 25 GitHub Actions workflow files under Changesactions/checkout v6.0.3 → v7.0.0 across all workflows
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Workflow state fingerprint for Keepalive Loop Reporter. Do not edit. |
|
Workflow state fingerprint for Agents Gate Followups. Do not edit. |
Workflow source neededPR #581 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely. Please do one of:
Once a valid source is present, this warning will not be reposted. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (11)
.github/workflows/agents-80-pr-event-hub.yml (1)
75-83:⚠️ Potential issue | 🔴 CriticalFix unsafe
actions/checkoutsteps in workflows usingpull_request_targetwithout explicitrefparameters.The reviewed file (agents-80-pr-event-hub.yml, lines 75-83) correctly uses an explicit
refparameter with a safe fallback sequence starting withgithub.event.pull_request.base.sha, which is safe for fork PRs when usingpull_request_targetwithactions/checkout@v7.0.0.However, this same repository has other workflows that use
pull_request_targetbut have checkout steps without explicitrefparameters, which will fail on fork PRs with v7.0.0:
- autofix.yml: Lines 94 and 521 lack
refparameters- agents-verifier.yml: Lines 89 and 333 lack
refparameters- agents-verify-to-new-pr.yml: Line 69 lacks
refparameter (also checks out external repostranske/Workflowswithoutref)- agents-guard.yml: Line 141 lacks
refparameterAll unsafe checkout steps in workflows using
pull_request_targetmust be fixed with an explicit saferef(e.g.,github.event.pull_request.base.shaor the same fallback logic as agents-80-pr-event-hub.yml) before or simultaneously with the v7.0.0 upgrade to prevent workflow failures on fork PRs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/agents-80-pr-event-hub.yml around lines 75 - 83, All unsafe `actions/checkout` steps in workflows using `pull_request_target` must be updated to include explicit `ref` parameters. In autofix.yml at lines 94 and 521, in agents-verifier.yml at lines 89 and 333, in agents-verify-to-new-pr.yml at line 69, and in agents-guard.yml at line 141, add a `ref` parameter with a safe fallback sequence starting with `github.event.pull_request.base.sha` (matching the pattern used in agents-80-pr-event-hub.yml). For the external repository checkout in agents-verify-to-new-pr.yml at line 69 that checks out the stranske/Workflows repository, also include an explicit ref parameter to ensure safe operation on fork PRs with actions/checkout@v7.0.0.Source: MCP tools
.github/workflows/agents-autofix-dispatcher.yml (1)
30-41:⚠️ Potential issue | 🟡 MinorAdd
persist-credentials: falseto the checkout step.The workflow only needs the helpers during checkout; credentials are passed to subsequent steps via context variables. Disabling persistence removes unnecessary token exposure in the worktree.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/agents-autofix-dispatcher.yml around lines 30 - 41, Add the parameter persist-credentials: false to the with section of the "Checkout workflow helpers" step (the actions/checkout step). This should be added as a sibling to the existing token, sparse-checkout, sparse-checkout-cone-mode, and fetch-depth parameters to prevent GitHub credentials from persisting in the worktree after the checkout is complete, since the credentials are only needed during the checkout operation itself.Source: Linters/SAST tools
.github/workflows/agents-issue-optimizer.yml (1)
118-131:⚠️ Potential issue | 🟡 MinorDisable persisted credentials on both checkouts.
The workflow triggers on the
issuesevent (notpull_request_target), and both checkout steps are read-only operations that fetch scripts and source code. No subsequent steps modify or push to these repositories. Addpersist-credentials: falseto lines 120 and 124 to avoid leaving GitHub tokens in the worktree.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/agents-issue-optimizer.yml around lines 118 - 131, The workflow has two actions/checkout steps that download scripts and source code without making any subsequent modifications or pushes. Add the parameter persist-credentials: false to both checkout steps: the first one that checks out the main repository and the second one that checks out the Workflows repository for scripts. This prevents GitHub tokens from being persisted in the worktree when they are not needed for any write operations.Source: Linters/SAST tools
.github/workflows/agents-guard.yml (1)
33-42:⚠️ Potential issue | 🟡 MinorAdd
persist-credentials: falseto all three checkout steps.These checkout operations are read-only (no git writes), and persisting credentials unnecessarily exposes the token to the git config. This is especially important on the
pull_request_targetbranch where security gates are enforced.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/agents-guard.yml around lines 33 - 42, Add the parameter persist-credentials: false to all three checkout steps in the workflow file to prevent unnecessary credential exposure. Locate each actions/checkout step (including the one named "Checkout eligibility action" shown in the diff) and add persist-credentials: false as a parameter under the with section of each checkout action. This ensures that git credentials are not persisted in the config for these read-only operations, improving security especially in the pull_request_target context.Source: Linters/SAST tools
.github/workflows/agents-auto-pilot.yml (1)
73-83:⚠️ Potential issue | 🟡 MinorDisable persisted credentials on checkout steps at lines 73–83 and 156–194.
These checkout steps only read helper scripts and repository files; neither job performs git operations like push or commit. Adding
persist-credentials: falseprevents the GitHub token from being written to.git/configwith no functional downside.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/agents-auto-pilot.yml around lines 73 - 83, The checkout steps at the specified locations unnecessarily persist GitHub credentials since these steps only read files and do not perform any git operations like push or commit. Add the persist-credentials: false parameter to both the Checkout eligibility action step (which includes the sparse-checkout and sparse-checkout-cone-mode configuration) and the second checkout step at lines 156-194 to prevent the GitHub token from being written to the git config file.Source: Linters/SAST tools
.github/workflows/agents-keepalive-loop-reporter.yml (1)
26-33:⚠️ Potential issue | 🟠 MajorAdd explicit safe ref to
actions/checkout@v7forworkflow_runevents.
actions/checkout@v7blocks checking out fork-originatedworkflow_runevents as a security measure. Without an explicitrefparameter, this step will fail when triggered by fork PRs. Specify a known-safe ref, such as${{ github.event.workflow_run.head_sha }}or${{ github.event.workflow_run.base_sha }}.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/agents-keepalive-loop-reporter.yml around lines 26 - 33, The checkout step for keepalive scripts needs an explicit ref parameter to handle workflow_run events from forks safely. Add a `ref` parameter to the `with` block of the "Checkout keepalive scripts" step using either `${{ github.event.workflow_run.head_sha }}` or `${{ github.event.workflow_run.base_sha }}` as the value to prevent checkout failures when this workflow is triggered by fork PRs.Source: Linked repositories
.github/workflows/agents-verifier.yml (1)
88-97:⚠️ Potential issue | 🔴 Critical | 🏗️ Heavy liftCRITICAL: v7.0.0 blocks fork PR checkout for
pull_request_targetwithout explicitref.The v7.0.0 release implements a security enhancement that blocks checking out fork PRs for
pull_request_targetandworkflow_runevents. This workflow usespull_request_targetand the checkout step does not specify an explicitref, so it will fail when triggered by fork PRs.According to the linked repository analysis, this workflow "Uses pull_request_target instead of pull_request to ensure secrets are available for PRs from forks after merge", indicating fork PR support is intentional and required.
🔧 Required fix to restore fork PR support
Add an explicit safe
refparameter to check out the base branch instead of the fork's head:- name: Checkout retry helpers uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: + ref: ${{ github.event.pull_request.base.sha }} sparse-checkout: | .github/actions/setup-api-client .github/scripts/error_classifier.js .github/scripts/github-api-with-retry.js .github/scripts/token_load_balancer.js scripts/state_fingerprint.py sparse-checkout-cone-mode: falseThis checks out the base branch SHA, which is safe for fork PRs and allows the workflow to access the helper scripts without exposing secrets to untrusted code.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/agents-verifier.yml around lines 88 - 97, The actions/checkout action at version v7.0.0 requires an explicit ref parameter when used with pull_request_target events to support fork PRs. Add a ref parameter to the "Checkout retry helpers" step that specifies the base branch reference (use github.base_ref) to safely check out the base branch instead of the fork's head, which will allow the workflow to access the helper scripts for fork PRs without failing.Source: Linked repositories
.github/workflows/autofix.yml (1)
92-104:⚠️ Potential issue | 🔴 Critical | 🏗️ Heavy liftCRITICAL: v7.0.0 blocks fork PR checkout for
pull_request_targetwithout explicitref.The v7.0.0 release blocks checking out fork PRs for
pull_request_targetevents. This workflow usespull_request_targetand this specific "Checkout for API helpers" step was flagged in the linked repository analysis as having no explicit ref parameter.Unlike the first checkout step in this workflow (which correctly uses
github.event.pull_request.base.sha), this step will fail when triggered by fork PRs.🔧 Required fix
Add an explicit safe
refparameter:- name: Checkout for API helpers if: steps.eligibility.outputs.should-run == 'true' uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: + ref: ${{ github.event.pull_request.base.sha || github.event.workflow_run.repository.default_branch || github.event.repository.default_branch }} sparse-checkout: | .github/actions/setup-api-client .github/scripts/error_classifier.js .github/scripts/github-api-with-retry.js .github/scripts/token_load_balancer.js scripts/runner_lib scripts/state_fingerprint.py scripts/reference_packs.py sparse-checkout-cone-mode: falseThis mirrors the safe ref pattern from the first checkout step in this workflow.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/autofix.yml around lines 92 - 104, The "Checkout for API helpers" step in the autofix.yml workflow is missing an explicit ref parameter, which causes the checkout to fail for fork PRs when triggered by pull_request_target events in actions/checkout v7.0.0. Add a ref parameter to this checkout step using the same safe reference pattern employed in the first checkout step of the workflow (github.event.pull_request.base.sha) to ensure fork PRs can be checked out successfully.Source: Linked repositories
.github/workflows/agents-verify-to-new-pr.yml (1)
67-83:⚠️ Potential issue | 🔴 Critical | 🏗️ Heavy liftCRITICAL: v7.0.0 blocks this checkout pattern on
pull_request_target.The v7.0.0 security enhancement blocks checking out fork PRs for
pull_request_targetevents. This workflow usespull_request_target(line 30) and this specific workflow was flagged in the linked repository analysis as affected.Even though this checks out
stranske/Workflowsrather than the PR itself, the v7.0.0 security enhancement applies to all checkouts inpull_request_targetworkflows when triggered by fork PRs without an explicit saferef.🔧 Required fix
Add an explicit
refto check out the main branch of stranske/Workflows:- name: Checkout repository if: steps.check-merged.outputs.merged == 'true' uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: stranske/Workflows + ref: main token: ${{ steps.select-token.outputs.token }} sparse-checkout: | .github/actions/setup-api-client .github/agents/registry.yml .github/scripts/agent_registry.js .github/scripts/error_classifier.js .github/scripts/github-api-with-retry.js .github/scripts/terminal_disposition.js .github/scripts/token_load_balancer.js scripts/langchain tools sparse-checkout-cone-mode: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/agents-verify-to-new-pr.yml around lines 67 - 83, The "Checkout repository" step that checks out stranske/Workflows is missing an explicit ref parameter, which is required by actions/checkout v7.0.0 when used in pull_request_target workflows due to security enhancements. Add a ref field to this checkout action specifying the main branch (such as ref: main or ref: refs/heads/main) to ensure the action can properly validate the checkout operation when triggered by fork PRs in the pull_request_target context.Source: Linked repositories
.github/workflows/reusable-pr-context.yml (2)
138-142:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAdd persist-credentials: false for security hardening.
The checkout step is missing
persist-credentials: false, which means the GitHub token persists in the local git config. While this reusable workflow only checks out.github/scriptsusing sparse-checkout, settingpersist-credentials: falseis a best practice to minimize credential exposure, especially since this workflow is called by multiple downstream workflows.🛡️ Proposed fix
- name: Checkout (for scripts) uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: + persist-credentials: false sparse-checkout: | .github/scripts sparse-checkout-cone-mode: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/reusable-pr-context.yml around lines 138 - 142, The actions/checkout step in the reusable workflow is missing the security hardening parameter persist-credentials: false. Add this parameter to the with section of the actions/checkout step (the one that configures sparse-checkout and sparse-checkout-cone-mode) to prevent the GitHub token from persisting in the local git config, following security best practices for credential management in reusable workflows.
138-142:⚠️ Potential issue | 🔴 CriticalAdd explicit ref parameter to actions/checkout for v7.0.0 fork PR compatibility.
The reusable workflow is called from
agents-80-pr-event-hub.yml(which haspull_request_targetandworkflow_runtriggers) without passing an explicit ref. Whenactions/checkout@v7.0.0runs in this context, it will block fork PRs per v7.0.0's security restriction. Add arefinput to the reusable workflow and pass a safe ref (e.g.,github.event.pull_request.base.shaforpull_request_target, orgithub.event.workflow_run.head_commit.idforworkflow_run) to allow secure fork PR checkouts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/reusable-pr-context.yml around lines 138 - 142, The actions/checkout@v7.0.0 action in the reusable workflow needs an explicit ref parameter to support fork PR checkouts. Add a ref input parameter to the reusable workflow's inputs section, then pass this ref to the actions/checkout action by adding a ref field under the with section. In the calling workflow agents-80-pr-event-hub.yml, pass the appropriate safe ref value when invoking this reusable workflow: use github.event.pull_request.base.sha for pull_request_target triggers and github.event.workflow_run.head_commit.id for workflow_run triggers to ensure secure fork PR compatibility.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/agents-capability-check.yml:
- Around line 27-28: The Checkout repository step using actions/checkout is
missing the persist-credentials configuration. Add persist-credentials: false as
a parameter to the actions/checkout step to prevent Git credentials from being
persisted in the repository configuration, since this workflow only performs
read operations and uses GitHub API for any modifications.
In @.github/workflows/agents-decompose.yml:
- Around line 22-23: The checkout action is persisting credentials by default,
which is unnecessary since this job only reads repository files and makes GitHub
API calls via github-script without performing any git operations. Add the
`persist-credentials: false` parameter to the
`actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0` action to prevent
the git credentials token from being unnecessarily exposed in the git
configuration.
In @.github/workflows/agents-dedup.yml:
- Around line 31-32: The checkout step using actions/checkout is missing the
persist-credentials input parameter. Add the persist-credentials input with a
value of false to the checkout action configuration to prevent Git credentials
from being persisted after the repository clone, since the workflow only
performs read operations and API calls that do not require authentication.
In @.github/workflows/agents-verifier.yml:
- Around line 332-336: The second checkout step for the state_fingerprint.py
script is missing an explicit ref parameter, which causes it to be blocked by
the v7.0.0 security enhancement when running on fork pull requests with
pull_request_target events. Add a ref parameter to the checkout action in the
"Checkout state fingerprint helper" step that explicitly specifies the reference
to checkout, using the appropriate GitHub context variable (such as
github.event.pull_request.head.ref for pull requests) to ensure the correct ref
is checked out regardless of the event type.
In @.github/workflows/ci.yml:
- Around line 38-39: Replace the floating version tag `@v7` in the
`actions/checkout` action with the pinned commit SHA
`@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0` to match the pattern used
in other workflows in this PR. This ensures consistency across workflows and
provides better security and reproducibility by referencing an exact commit
instead of a floating tag.
In @.github/workflows/maint-dependabot-auto-lock.yml:
- Around line 23-26: Add the `persist-credentials: false` configuration to the
`with` block of the `actions/checkout@v7` step to prevent the GitHub token from
persisting in the local git config. This will ensure that the token is not
exposed to subsequent workflow steps or captured in artifacts, improving the
security posture of the workflow by limiting credential exposure.
- Line 23: The `actions/checkout@v7` step is using a version tag instead of a
pinned commit SHA, creating a security and reproducibility risk. Replace the
`actions/checkout@v7` reference with the pinned commit SHA
`9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0` to match the pattern used in
all other workflows in this PR cohort. This ensures the workflow uses a
specific, immutable commit rather than a movable tag.
In @.github/workflows/pr-00-gate.yml:
- Around line 52-54: The actions/checkout action in the pr-00-gate.yml file is
pinned to a specific commit SHA instead of using the semantic version reference,
and it is missing the explicit ref and repository parameters that align with the
stranske/Workflows standard template. Update the actions/checkout action to use
`@v7` instead of the full commit SHA, add the ref parameter with the value ${{
github.event.pull_request.head.sha || github.sha }}, and add the repository
parameter for clarity to match the standard gate workflow template.
---
Outside diff comments:
In @.github/workflows/agents-80-pr-event-hub.yml:
- Around line 75-83: All unsafe `actions/checkout` steps in workflows using
`pull_request_target` must be updated to include explicit `ref` parameters. In
autofix.yml at lines 94 and 521, in agents-verifier.yml at lines 89 and 333, in
agents-verify-to-new-pr.yml at line 69, and in agents-guard.yml at line 141, add
a `ref` parameter with a safe fallback sequence starting with
`github.event.pull_request.base.sha` (matching the pattern used in
agents-80-pr-event-hub.yml). For the external repository checkout in
agents-verify-to-new-pr.yml at line 69 that checks out the stranske/Workflows
repository, also include an explicit ref parameter to ensure safe operation on
fork PRs with actions/checkout@v7.0.0.
In @.github/workflows/agents-auto-pilot.yml:
- Around line 73-83: The checkout steps at the specified locations unnecessarily
persist GitHub credentials since these steps only read files and do not perform
any git operations like push or commit. Add the persist-credentials: false
parameter to both the Checkout eligibility action step (which includes the
sparse-checkout and sparse-checkout-cone-mode configuration) and the second
checkout step at lines 156-194 to prevent the GitHub token from being written to
the git config file.
In @.github/workflows/agents-autofix-dispatcher.yml:
- Around line 30-41: Add the parameter persist-credentials: false to the with
section of the "Checkout workflow helpers" step (the actions/checkout step).
This should be added as a sibling to the existing token, sparse-checkout,
sparse-checkout-cone-mode, and fetch-depth parameters to prevent GitHub
credentials from persisting in the worktree after the checkout is complete,
since the credentials are only needed during the checkout operation itself.
In @.github/workflows/agents-guard.yml:
- Around line 33-42: Add the parameter persist-credentials: false to all three
checkout steps in the workflow file to prevent unnecessary credential exposure.
Locate each actions/checkout step (including the one named "Checkout eligibility
action" shown in the diff) and add persist-credentials: false as a parameter
under the with section of each checkout action. This ensures that git
credentials are not persisted in the config for these read-only operations,
improving security especially in the pull_request_target context.
In @.github/workflows/agents-issue-optimizer.yml:
- Around line 118-131: The workflow has two actions/checkout steps that download
scripts and source code without making any subsequent modifications or pushes.
Add the parameter persist-credentials: false to both checkout steps: the first
one that checks out the main repository and the second one that checks out the
Workflows repository for scripts. This prevents GitHub tokens from being
persisted in the worktree when they are not needed for any write operations.
In @.github/workflows/agents-keepalive-loop-reporter.yml:
- Around line 26-33: The checkout step for keepalive scripts needs an explicit
ref parameter to handle workflow_run events from forks safely. Add a `ref`
parameter to the `with` block of the "Checkout keepalive scripts" step using
either `${{ github.event.workflow_run.head_sha }}` or `${{
github.event.workflow_run.base_sha }}` as the value to prevent checkout failures
when this workflow is triggered by fork PRs.
In @.github/workflows/agents-verifier.yml:
- Around line 88-97: The actions/checkout action at version v7.0.0 requires an
explicit ref parameter when used with pull_request_target events to support fork
PRs. Add a ref parameter to the "Checkout retry helpers" step that specifies the
base branch reference (use github.base_ref) to safely check out the base branch
instead of the fork's head, which will allow the workflow to access the helper
scripts for fork PRs without failing.
In @.github/workflows/agents-verify-to-new-pr.yml:
- Around line 67-83: The "Checkout repository" step that checks out
stranske/Workflows is missing an explicit ref parameter, which is required by
actions/checkout v7.0.0 when used in pull_request_target workflows due to
security enhancements. Add a ref field to this checkout action specifying the
main branch (such as ref: main or ref: refs/heads/main) to ensure the action can
properly validate the checkout operation when triggered by fork PRs in the
pull_request_target context.
In @.github/workflows/autofix.yml:
- Around line 92-104: The "Checkout for API helpers" step in the autofix.yml
workflow is missing an explicit ref parameter, which causes the checkout to fail
for fork PRs when triggered by pull_request_target events in actions/checkout
v7.0.0. Add a ref parameter to this checkout step using the same safe reference
pattern employed in the first checkout step of the workflow
(github.event.pull_request.base.sha) to ensure fork PRs can be checked out
successfully.
In @.github/workflows/reusable-pr-context.yml:
- Around line 138-142: The actions/checkout step in the reusable workflow is
missing the security hardening parameter persist-credentials: false. Add this
parameter to the with section of the actions/checkout step (the one that
configures sparse-checkout and sparse-checkout-cone-mode) to prevent the GitHub
token from persisting in the local git config, following security best practices
for credential management in reusable workflows.
- Around line 138-142: The actions/checkout@v7.0.0 action in the reusable
workflow needs an explicit ref parameter to support fork PR checkouts. Add a ref
input parameter to the reusable workflow's inputs section, then pass this ref to
the actions/checkout action by adding a ref field under the with section. In the
calling workflow agents-80-pr-event-hub.yml, pass the appropriate safe ref value
when invoking this reusable workflow: use github.event.pull_request.base.sha for
pull_request_target triggers and github.event.workflow_run.head_commit.id for
workflow_run triggers to ensure secure fork PR compatibility.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: e0325ce7-cfe9-4d2e-8b09-edca737644db
📒 Files selected for processing (25)
.github/workflows/agents-71-codex-belt-dispatcher.yml.github/workflows/agents-72-codex-belt-worker.yml.github/workflows/agents-73-codex-belt-conveyor.yml.github/workflows/agents-80-pr-event-hub.yml.github/workflows/agents-81-gate-followups.yml.github/workflows/agents-auto-label.yml.github/workflows/agents-auto-pilot.yml.github/workflows/agents-autofix-dispatcher.yml.github/workflows/agents-capability-check.yml.github/workflows/agents-decompose.yml.github/workflows/agents-dedup.yml.github/workflows/agents-guard.yml.github/workflows/agents-issue-optimizer.yml.github/workflows/agents-keepalive-loop-reporter.yml.github/workflows/agents-verifier.yml.github/workflows/agents-verify-to-new-pr.yml.github/workflows/agents-weekly-metrics.yml.github/workflows/autofix.yml.github/workflows/backplane-conformance.yml.github/workflows/ci.yml.github/workflows/maint-76-claude-code-review.yml.github/workflows/maint-coverage-guard.yml.github/workflows/maint-dependabot-auto-lock.yml.github/workflows/pr-00-gate.yml.github/workflows/reusable-pr-context.yml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
stranske/Workflows(auto-detected)
📜 Review details
🧰 Additional context used
📓 Path-based instructions (6)
{pyproject.toml,.github/workflows/**/*.{yml,yaml}}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Ensure coverage threshold settings in
pyproject.toml[tool.coverage.report] fail_undermatch thecoverage-minsettings in workflow files to prevent threshold conflicts
Files:
.github/workflows/agents-keepalive-loop-reporter.yml.github/workflows/agents-issue-optimizer.yml.github/workflows/agents-weekly-metrics.yml.github/workflows/agents-decompose.yml.github/workflows/agents-dedup.yml.github/workflows/reusable-pr-context.yml.github/workflows/agents-capability-check.yml.github/workflows/agents-autofix-dispatcher.yml.github/workflows/agents-guard.yml.github/workflows/ci.yml.github/workflows/maint-coverage-guard.yml.github/workflows/agents-verify-to-new-pr.yml.github/workflows/maint-dependabot-auto-lock.yml.github/workflows/agents-71-codex-belt-dispatcher.yml.github/workflows/pr-00-gate.yml.github/workflows/agents-73-codex-belt-conveyor.yml.github/workflows/backplane-conformance.yml.github/workflows/agents-verifier.yml.github/workflows/maint-76-claude-code-review.yml.github/workflows/autofix.yml.github/workflows/agents-auto-label.yml.github/workflows/agents-80-pr-event-hub.yml.github/workflows/agents-72-codex-belt-worker.yml.github/workflows/agents-auto-pilot.yml.github/workflows/agents-81-gate-followups.yml
.github/workflows/**/*.{yml,yaml}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
For
startup_failureGitHub Actions workflow errors, verify YAML syntax validity, avoidpermissions:block onworkflow_callreusable workflows, and check for circular workflow referencesReference reusable workflows with
@mainunless intentionally pinning to an exact commit SHA for a controlled reason.
Files:
.github/workflows/agents-keepalive-loop-reporter.yml.github/workflows/agents-issue-optimizer.yml.github/workflows/agents-weekly-metrics.yml.github/workflows/agents-decompose.yml.github/workflows/agents-dedup.yml.github/workflows/reusable-pr-context.yml.github/workflows/agents-capability-check.yml.github/workflows/agents-autofix-dispatcher.yml.github/workflows/agents-guard.yml.github/workflows/ci.yml.github/workflows/maint-coverage-guard.yml.github/workflows/agents-verify-to-new-pr.yml.github/workflows/maint-dependabot-auto-lock.yml.github/workflows/agents-71-codex-belt-dispatcher.yml.github/workflows/pr-00-gate.yml.github/workflows/agents-73-codex-belt-conveyor.yml.github/workflows/backplane-conformance.yml.github/workflows/agents-verifier.yml.github/workflows/maint-76-claude-code-review.yml.github/workflows/autofix.yml.github/workflows/agents-auto-label.yml.github/workflows/agents-80-pr-event-hub.yml.github/workflows/agents-72-codex-belt-worker.yml.github/workflows/agents-auto-pilot.yml.github/workflows/agents-81-gate-followups.yml
**/.github/workflows/*.{yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
First-party consumer repos should reference reusable workflows with
@mainunless intentionally pinning to an exact commit SHA for a controlled reason
Files:
.github/workflows/agents-keepalive-loop-reporter.yml.github/workflows/agents-issue-optimizer.yml.github/workflows/agents-weekly-metrics.yml.github/workflows/agents-decompose.yml.github/workflows/agents-dedup.yml.github/workflows/reusable-pr-context.yml.github/workflows/agents-capability-check.yml.github/workflows/agents-autofix-dispatcher.yml.github/workflows/agents-guard.yml.github/workflows/ci.yml.github/workflows/maint-coverage-guard.yml.github/workflows/agents-verify-to-new-pr.yml.github/workflows/maint-dependabot-auto-lock.yml.github/workflows/agents-71-codex-belt-dispatcher.yml.github/workflows/pr-00-gate.yml.github/workflows/agents-73-codex-belt-conveyor.yml.github/workflows/backplane-conformance.yml.github/workflows/agents-verifier.yml.github/workflows/maint-76-claude-code-review.yml.github/workflows/autofix.yml.github/workflows/agents-auto-label.yml.github/workflows/agents-80-pr-event-hub.yml.github/workflows/agents-72-codex-belt-worker.yml.github/workflows/agents-auto-pilot.yml.github/workflows/agents-81-gate-followups.yml
**/.github/workflows/ci.{yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
ci.yml is repo-specific and should be edited locally to configure repo-specific CI wiring
Files:
.github/workflows/ci.yml
.github/workflows/pr-00-gate.{yml,yaml}
📄 CodeRabbit inference engine (CLAUDE.md)
pr-00-gate.ymlis a create-only standard file that should be kept aligned with the standard gate instranske/Workflowsunless this repo has a documented reason to diverge.
Files:
.github/workflows/pr-00-gate.yml
**/.github/workflows/pr-00-gate.{yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
pr-00-gate.yml is a create-only standard file that should be kept aligned with the standard gate in stranske/Workflows unless this repo has a documented reason to diverge
Files:
.github/workflows/pr-00-gate.yml
🪛 zizmor (1.25.2)
.github/workflows/agents-decompose.yml
[warning] 22-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
.github/workflows/agents-dedup.yml
[warning] 31-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
.github/workflows/agents-capability-check.yml
[warning] 27-28: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
.github/workflows/ci.yml
[warning] 38-39: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 39-39: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
.github/workflows/maint-coverage-guard.yml
[warning] 120-121: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
.github/workflows/maint-dependabot-auto-lock.yml
[warning] 23-26: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
.github/workflows/backplane-conformance.yml
[warning] 28-28: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
.github/workflows/agents-auto-label.yml
[warning] 55-57: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
.github/workflows/agents-81-gate-followups.yml
[warning] 83-84: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 383-384: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 546-547: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🔀 Multi-repo context stranske/Workflows
Linked repositories findings
Critical Breaking Change Identified
stranske/Workflows - actions/checkout v7.0.0 Security Incompatibility
Summary: The upgrade from actions/checkout v6.0.3 to v7.0.0 introduces a breaking change for workflows using pull_request_target events without explicit ref parameters. The v7.0.0 release implements a security enhancement that blocks checking out fork PRs for pull_request_target and workflow_run events.
Affected Workflows:
-
agents-verifier.yml [::stranske/Workflows::]
- Uses
pull_request_targetevent (line:pull_request_target: types: [labeled]) - "Checkout retry helpers" step (uses
actions/checkout@v7) has no explicit ref parameter - Comment indicates intent to support fork PRs: "Uses pull_request_target instead of pull_request to ensure secrets are available for PRs from forks after merge"
- Impact: Will FAIL when triggered by fork PRs post-upgrade
- Uses
-
agents-verify-to-issue-v2.yml [::stranske/Workflows::]
- Uses
pull_request_targetevent - "Checkout repository" step (uses
actions/checkout@v7) checks outstranske/Workflowswithout explicit ref - Impact: Will FAIL on fork PRs
- Uses
-
agents-verify-to-new-pr.yml [::stranske/Workflows::]
- Uses
pull_request_targetevent - "Checkout repository" step (uses
actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0) checks outstranske/Workflowswithout explicit ref - Impact: Will FAIL on fork PRs
- Uses
-
autofix.yml [::stranske/Workflows::]
- Uses
pull_request_targetevent - "Checkout for API helpers" step (uses
actions/checkout@v7) has no explicit ref parameter - Impact: Will FAIL on fork PRs
- Uses
Impact on Consumer Repositories:
This repository provides reusable workflows to 13 registered first-party consumer repositories [::stranske/Workflows::]:
- Travel-Plan-Permission
- Template
- Counter_Risk
- Pension-Data
- Inv-Man-Intake
- Ready
- trip-planner
- Manager-Database
- Portable-Alpha-Extension-Model
- Trend_Model_Project
- Collab-Admin
- learning-management-system
- Fine-Art-Archive
These consumers will inherit the broken workflows when they sync/update their templates from this Workflows repository.
v7.0.0 Security Change Details:
According to the GitHub API response, v7.0.0 includes: "block checking out fork pr for pull_request_target and workflow_run" — this is a deliberate security feature to prevent accidental exposure of secrets to untrusted fork code.
Workaround Required:
Workflows using pull_request_target must specify an explicit safe ref, such as:
ref: ${{ github.event.pull_request.base.sha }}(base branch, safe for forks)- Or conditionally use different refs based on event type
🔇 Additional comments (15)
.github/workflows/agents-71-codex-belt-dispatcher.yml (1)
170-170: LGTM!Also applies to: 186-186, 296-296
.github/workflows/agents-72-codex-belt-worker.yml (1)
293-293: LGTM!Also applies to: 309-309, 572-576, 580-580
.github/workflows/agents-73-codex-belt-conveyor.yml (1)
187-187: LGTM!.github/workflows/agents-80-pr-event-hub.yml (1)
255-261: LGTM!Also applies to: 317-326
.github/workflows/agents-81-gate-followups.yml (1)
84-84: LGTM!Also applies to: 384-384, 486-486, 547-547, 846-846, 1283-1283, 1353-1353, 1551-1551
.github/workflows/agents-auto-label.yml (1)
36-44: LGTM!Also applies to: 57-57
.github/workflows/agents-weekly-metrics.yml (1)
29-45: LGTM!.github/workflows/autofix.yml (2)
69-78: LGTM!
520-527: LGTM!.github/workflows/backplane-conformance.yml (1)
28-28: LGTM!.github/workflows/maint-76-claude-code-review.yml (1)
29-37: LGTM!Also applies to: 117-119, 185-187
.github/workflows/maint-coverage-guard.yml (1)
36-44: LGTM!Also applies to: 121-121
.github/workflows/pr-00-gate.yml (2)
52-54: LGTM!
95-100: LGTM!.github/workflows/maint-dependabot-auto-lock.yml (1)
23-26: No action needed. This workflow uses thepull_requestevent (notpull_request_targetorworkflow_run), which is unaffected by the actions/checkout v7.0.0 breaking change. Theref: ${{ github.head_ref }}parameter is correctly set for this trigger type.
| - name: Checkout repository | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/agents-capability-check.ymlRepository: stranske/Inv-Man-Intake
Length of output: 11555
Add persist-credentials: false to the checkout step.
This job only reads repository contents and makes all modifications via GitHub API calls. Git credentials are not needed and should not be persisted in .git/config.
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 27-28: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agents-capability-check.yml around lines 27 - 28, The
Checkout repository step using actions/checkout is missing the
persist-credentials configuration. Add persist-credentials: false as a parameter
to the actions/checkout step to prevent Git credentials from being persisted in
the repository configuration, since this workflow only performs read operations
and uses GitHub API for any modifications.
Source: Linters/SAST tools
| - name: Checkout repository | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check the workflow file structure and job details
cat -n .github/workflows/agents-decompose.yml | head -60Repository: stranske/Inv-Man-Intake
Length of output: 2250
🏁 Script executed:
#!/bin/bash
# Get full workflow to understand the job's purpose
wc -l .github/workflows/agents-decompose.ymlRepository: stranske/Inv-Man-Intake
Length of output: 110
🏁 Script executed:
#!/bin/bash
# Get the rest of the workflow to see all steps
cat -n .github/workflows/agents-decompose.yml | tail -160Repository: stranske/Inv-Man-Intake
Length of output: 7342
🏁 Script executed:
#!/bin/bash
# Verify that github-script write operations don't depend on git credentials
rg "github\.rest\." .github/workflows/agents-decompose.yml -A 2 -B 2Repository: stranske/Inv-Man-Intake
Length of output: 269
🏁 Script executed:
#!/bin/bash
# Check if there are any git operations in the workflow (commit, push, etc.)
rg "git " .github/workflows/agents-decompose.ymlRepository: stranske/Inv-Man-Intake
Length of output: 49
Disable persisted credentials on this checkout.
The job doesn't perform any git operations—it reads repository files and writes to GitHub API via github-script. No git credentials are needed, so persist-credentials: false prevents unnecessary token exposure in git config.
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 22-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agents-decompose.yml around lines 22 - 23, The checkout
action is persisting credentials by default, which is unnecessary since this job
only reads repository files and makes GitHub API calls via github-script without
performing any git operations. Add the `persist-credentials: false` parameter to
the `actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0` action to
prevent the git credentials token from being unnecessarily exposed in the git
configuration.
Source: Linters/SAST tools
| - name: Checkout repository | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Find and examine the agents-dedup.yml workflow file
find . -name "agents-dedup.yml" -type fRepository: stranske/Inv-Man-Intake
Length of output: 104
🏁 Script executed:
#!/bin/bash
# Read the workflow file to understand its purpose and operations
cat .github/workflows/agents-dedup.ymlRepository: stranske/Inv-Man-Intake
Length of output: 9173
Add persist-credentials: false to this checkout step.
The workflow only reads repository files and posts GitHub API comments—no git operations requiring authentication occur after clone. This eliminates unnecessary credential exposure.
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 31-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agents-dedup.yml around lines 31 - 32, The checkout step
using actions/checkout is missing the persist-credentials input parameter. Add
the persist-credentials input with a value of false to the checkout action
configuration to prevent Git credentials from being persisted after the
repository clone, since the workflow only performs read operations and API calls
that do not require authentication.
Source: Linters/SAST tools
| - name: Checkout state fingerprint helper | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| sparse-checkout: scripts/state_fingerprint.py | ||
| sparse-checkout-cone-mode: false |
There was a problem hiding this comment.
CRITICAL: Second checkout also affected by v7.0.0 fork PR blocking.
This is the same breaking change as the first checkout step. The v7.0.0 security enhancement blocks fork PR checkout for pull_request_target events, and this step also lacks an explicit ref parameter.
🔧 Required fix
- name: Checkout state fingerprint helper
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
+ ref: ${{ github.event.pull_request.base.sha }}
sparse-checkout: scripts/state_fingerprint.py
sparse-checkout-cone-mode: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout state fingerprint helper | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| sparse-checkout: scripts/state_fingerprint.py | |
| sparse-checkout-cone-mode: false | |
| - name: Checkout state fingerprint helper | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ github.event.pull_request.base.sha }} | |
| sparse-checkout: scripts/state_fingerprint.py | |
| sparse-checkout-cone-mode: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 332-336: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agents-verifier.yml around lines 332 - 336, The second
checkout step for the state_fingerprint.py script is missing an explicit ref
parameter, which causes it to be blocked by the v7.0.0 security enhancement when
running on fork pull requests with pull_request_target events. Add a ref
parameter to the checkout action in the "Checkout state fingerprint helper" step
that explicitly specifies the reference to checkout, using the appropriate
GitHub context variable (such as github.event.pull_request.head.ref for pull
requests) to ensure the correct ref is checked out regardless of the event type.
Source: Linked repositories
| - name: Checkout repository | ||
| uses: actions/checkout@v6 | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
Pin actions/checkout to SHA instead of using floating @v7 tag.
This checkout uses @v7 (floating tag) while all other workflows in this PR correctly pin to the full commit SHA (@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0). As per coding guidelines, actions should reference pinned commit SHAs for security and reproducibility.
🔒 Recommended fix to pin to v7.0.0 SHA
- name: Checkout repository
- uses: actions/checkout@v7
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0As per coding guidelines, "Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason" and "ci.yml is repo-specific and should be edited locally to configure repo-specific CI wiring."
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 38-39: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 39-39: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 38 - 39, Replace the floating version
tag `@v7` in the `actions/checkout` action with the pinned commit SHA
`@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0` to match the pattern used
in other workflows in this PR. This ensures consistency across workflows and
provides better security and reproducibility by referencing an exact commit
instead of a floating tag.
Sources: Coding guidelines, Linters/SAST tools
|
|
||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
Use pinned commit SHA for actions/checkout.
This workflow uses actions/checkout@v7 while all other workflows in this PR cohort use the pinned SHA 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0. This inconsistency creates a security and reproducibility risk, as the @v7 tag can be moved to point to different commits.
🔒 Proposed fix
- - uses: actions/checkout@v7
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
ref: ${{ github.head_ref }}
token: ${{ secrets.GITHUB_TOKEN }}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v7 | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ github.head_ref }} | |
| token: ${{ secrets.GITHUB_TOKEN }} |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 23-26: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/maint-dependabot-auto-lock.yml at line 23, The
`actions/checkout@v7` step is using a version tag instead of a pinned commit
SHA, creating a security and reproducibility risk. Replace the
`actions/checkout@v7` reference with the pinned commit SHA
`9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0` to match the pattern used in
all other workflows in this PR cohort. This ensures the workflow uses a
specific, immutable commit rather than a movable tag.
Source: Linters/SAST tools
| - uses: actions/checkout@v7 | ||
| with: | ||
| ref: ${{ github.head_ref }} | ||
| token: ${{ secrets.GITHUB_TOKEN }} |
There was a problem hiding this comment.
Add persist-credentials: false for security hardening.
The checkout step is missing persist-credentials: false, which means the GitHub token persists in the local git config and could be exposed through subsequent steps or artifacts.
🛡️ Proposed fix
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
ref: ${{ github.head_ref }}
token: ${{ secrets.GITHUB_TOKEN }}
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ github.head_ref }} | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ github.head_ref }} | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 23-26: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/maint-dependabot-auto-lock.yml around lines 23 - 26, Add
the `persist-credentials: false` configuration to the `with` block of the
`actions/checkout@v7` step to prevent the GitHub token from persisting in the
local git config. This will ensure that the token is not exposed to subsequent
workflow steps or captured in artifacts, improving the security posture of the
workflow by limiting credential exposure.
Source: Linters/SAST tools
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| persist-credentials: false |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check trigger events for this workflow
echo "=== Checking pr-00-gate.yml trigger events ==="
rg -n "^on:" -A 20 .github/workflows/pr-00-gate.yml
# Check if stranske/Workflows has the standard version
echo -e "\n=== Checking stranske/Workflows for standard pr-00-gate.yml ==="
gh api repos/stranske/Workflows/contents/.github/workflows/pr-00-gate.yml \
--jq '.download_url' | xargs curl -s | rg "actions/checkout" -A 2 | head -20Repository: stranske/Inv-Man-Intake
Length of output: 1691
🏁 Script executed:
#!/bin/bash
# Read the specific lines around 52-54 in context
echo "=== Inv-Man-Intake pr-00-gate.yml around lines 52-54 ==="
sed -n '45,60p' .github/workflows/pr-00-gate.yml
# Also check around line 95-100 mentioned in the review
echo -e "\n=== Inv-Man-Intake pr-00-gate.yml around lines 95-100 ==="
sed -n '90,105p' .github/workflows/pr-00-gate.ymlRepository: stranske/Inv-Man-Intake
Length of output: 1635
🏁 Script executed:
#!/bin/bash
# Read the standard pr-00-gate.yml for comparison
echo "=== Workflows standard pr-00-gate.yml (full file) ==="
cat .github/workflows/pr-00-gate.ymlRepository: stranske/Workflows
Length of output: 41631
Align pr-00-gate.yml with stranske/Workflows standard.
This file diverges from the standard gate in stranske/Workflows: it pins actions/checkout@v7.0.0 to a specific commit SHA instead of referencing @v7, and it omits explicit ref parameters that the standard includes (ref: ${{ github.event.pull_request.head.sha || github.sha }}). The standard also specifies repository: parameters for clarity.
The v7.0.0 security restriction documented in the linked findings (blocking fork PRs without explicit refs) applies only to pull_request_target and workflow_run events. Since this workflow uses standard pull_request: events, that restriction does not apply here. However, the misalignment with the standard template should be resolved per coding guidelines.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-00-gate.yml around lines 52 - 54, The actions/checkout
action in the pr-00-gate.yml file is pinned to a specific commit SHA instead of
using the semantic version reference, and it is missing the explicit ref and
repository parameters that align with the stranske/Workflows standard template.
Update the actions/checkout action to use `@v7` instead of the full commit SHA,
add the ref parameter with the value ${{ github.event.pull_request.head.sha ||
github.sha }}, and add the repository parameter for clarity to match the
standard gate workflow template.
Sources: Coding guidelines, MCP tools
c31a8f9 to
76819bc
Compare
1 participant
This PR contains the following updates:
v6.0.3→v7.0.0v6→v7Release Notes
actions/checkout (actions/checkout)
v7.0.0Compare Source
v7Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.