ci: use commit hash for github action version instead of version number or branch #895
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -18,7 +18,7 @@ jobs: | |||||||||||||||
| commit-checks: | ||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||
| steps: | ||||||||||||||||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | ||||||||||||||||
| with: | ||||||||||||||||
| fetch-depth: 0 | ||||||||||||||||
|
Comment on lines
+21
to
23
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/pr-title-lint.yml
printf '%s\n' '--- candidate files and references ---'
git ls-files | rg '(^|/)(pr_title_lint\.py|.*pr.*title.*lint.*|.*workflow.*)$' || true
rg -n --hidden --glob '!.git' 'pr_title_lint\.py|persist-credentials|git (fetch|push|pull|clone)|GITHUB_TOKEN|github\.token|actions/checkout' .github . 2>/dev/null | head -300Repository: linux-system-roles/network Length of output: 9071 🏁 Script executed: #!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
path = Path(".github/workflows/pr-title-lint.yml")
text = path.read_text()
checkout = re.search(
r"uses:\s*actions/checkout@[^\n]+\n(?P<with>(?:\s+.*\n)*)",
text,
)
with_block = checkout.group("with") if checkout else ""
has_persist_false = bool(re.search(r"^\s+persist-credentials:\s*false\s*$", with_block, re.M))
downloads_script = bool(re.search(r"curl\s+-o\s+pr_title_lint\.py\s+https://raw\.githubusercontent\.com/", text))
executes_script = bool(re.search(r"python3\s+pr_title_lint\.py\b", text))
has_authenticated_git = bool(re.search(r"^\s*(?:run:.*\b|-\s+run:.*\b)(?:git\s+(?:fetch|pull|push|clone)|gh\s+)", text, re.M))
print({
"checkout_present": checkout is not None,
"persist_credentials_false": has_persist_false,
"downloads_external_python": downloads_script,
"executes_downloaded_python": executes_script,
"later_authenticated_git_command": has_authenticated_git,
"contents_read_permission": bool(re.search(r"^\s+contents:\s*read\s*$", text, re.M)),
})
PYRepository: linux-system-roles/network Length of output: 374 🌐 Web query:
💡 Result: In the official actions/checkout GitHub Action, the persist-credentials input determines whether the authentication token or SSH key used to fetch the repository is configured within the local git environment [1][2]. Key details include: Default Behavior: The default value for persist-credentials is true [1][2]. When enabled, the action configures the provided token or SSH key in the local git environment, which allows subsequent steps in the same job to execute authenticated git commands (e.g., git push or git fetch) without additional configuration [1][2]. Security and Cleanup: The credentials are removed during the post-job cleanup process [1][2]. Recent updates have improved security by storing these credentials in a file under $RUNNER_TEMP instead of directly within the local.git/config file, requiring a minimum Actions Runner version of v2.329.0 for this approach [3][4]. Opting Out: To prevent the action from configuring credentials in the local git environment, you can explicitly set persist-credentials to false in your workflow step [1][5]: - uses: actions/checkout@v4 with: persist-credentials: false While there has been community discussion and proposals regarding changing this default to false for security reasons, it remains true by default in the current version [6][7]. Citations:
🏁 Script executed: #!/bin/bash
set -eu
sha='3d3c42e5aac5ba805825da76410c181273ba90b1'
base="https://raw.githubusercontent.com/actions/checkout/${sha}"
printf '%s\n' '--- pinned action.yml ---'
curl -fsSL "$base/action.yml" | sed -n '1,180p'
printf '%s\n' '--- pinned package/source references ---'
curl -fsSL "$base/action.yml" | rg -n 'runs:|main:|persist-credentials|version' || true
curl -fsSL "https://api.github.com/repos/actions/checkout/commits/${sha}" |
jq -r '{sha: .sha, message: .commit.message, date: .commit.committer.date}'Repository: linux-system-roles/network Length of output: 5912 🌐 Web query:
💡 Result: The commit SHA Citations:
Disable checkout credential persistence. Because the job executes downloaded Python code, set Proposed fix - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: 0
+ persist-credentials: false📝 Committable suggestion
Suggested change
🧰 Tools🪛 zizmor (1.29.0)[warning] 21-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||||||||||||||||
|
|
||||||||||||||||
|
|
||||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -43,7 +43,7 @@ jobs: | |
| sudo apt install -y git | ||
|
|
||
| - name: checkout PR | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- workflow excerpts ---'
for f in .github/workflows/python-unit-test.yml .github/workflows/qemu-kvm-integration-tests.yml; do
echo "### $f"
nl -ba "$f" | sed -n '1,140p'
done
printf '%s\n' '--- checkout usage and workflow permissions ---'
rg -n -C 3 'actions/checkout|persist-credentials|permissions:|run:' .github/workflows/python-unit-test.yml .github/workflows/qemu-kvm-integration-tests.ymlRepository: linux-system-roles/network Length of output: 10972 🏁 Script executed: #!/bin/bash
set -eu
for f in .github/workflows/python-unit-test.yml .github/workflows/qemu-kvm-integration-tests.yml; do
echo "### $f"
wc -l "$f"
sed -n '1,240p' "$f"
doneRepository: linux-system-roles/network Length of output: 13217 🌐 Web query:
💡 Result: The default value for the persist-credentials input in the actions/checkout GitHub Action is currently true [1][2][3]. When set to true (the default), the action configures the authentication token or SSH key in the local git configuration, which allows subsequent steps in the same job to execute authenticated git commands [1][3][4]. The credentials are removed during the post-job cleanup [1][2][4]. If you wish to prevent the action from persisting these credentials, you must explicitly set persist-credentials to false in your workflow file [1][2][5]. This opt-out is recommended to reduce the risk of exposing the GITHUB_TOKEN or other credentials to subsequent steps in a workflow [6][5]. Note that there have been ongoing discussions and pull requests within the actions/checkout repository aimed at changing this default to false to improve security [6][5]. Citations:
🏁 Script executed: #!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
files = [
Path(".github/workflows/python-unit-test.yml"),
Path(".github/workflows/qemu-kvm-integration-tests.yml"),
]
for path in files:
text = path.read_text()
checkout = re.search(
r"(?m)^\s*-\s+name:.*\n\s+uses:\s+actions/checkout@[^ \n]+(?P<rest>.*(?:\n\s+.+)*)?",
text,
)
# Use line-oriented parsing to avoid treating unrelated `with:` blocks as
# checkout inputs.
lines = text.splitlines()
checkout_index = next(
i for i, line in enumerate(lines)
if re.match(r"\s*uses:\s*actions/checkout@", line)
)
next_step = next(
(i for i in range(checkout_index + 1, len(lines))
if re.match(r"\s*-\s+name:", lines[i])),
len(lines),
)
checkout_block = lines[checkout_index:next_step]
later_run = [
(i + 1, line.strip())
for i, line in enumerate(lines[next_step:], start=next_step)
if re.match(r"\s*run:", line)
]
permissions = []
in_permissions = False
for line in lines:
if re.match(r"^permissions:\s*$", line):
in_permissions = True
continue
if in_permissions and line and not line[0].isspace():
in_permissions = False
if in_permissions and re.match(r"^\s+[A-Za-z-]+:\s+\S+", line):
permissions.append(line.strip())
print(path)
print(" checkout:", lines[checkout_index].strip())
print(" checkout block:", [line.strip() for line in checkout_block])
print(" persist-credentials present:",
any("persist-credentials:" in line for line in checkout_block))
print(" later run steps:", len(later_run), later_run[:5])
print(" permissions:", permissions)
PYRepository: linux-system-roles/network Length of output: 921 Disable checkout credential persistence in both workflows. Add
🧰 Tools🪛 zizmor (1.29.0)[warning] 45-46: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 📍 Affects 2 files
🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
|
|
||
| - name: Set up Python 2.7 | ||
| if: ${{ matrix.pyver_os.ver == '2.7' }} | ||
|
|
@@ -53,7 +53,7 @@ jobs: | |
|
|
||
| - name: Set up Python 3 | ||
| if: ${{ matrix.pyver_os.ver != '2.7' }} | ||
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 | ||
| with: | ||
| python-version: ${{ matrix.pyver_os.ver }} | ||
|
|
||
|
|
@@ -70,7 +70,7 @@ jobs: | |
| tox=tox | ||
| virtualenv=virtualenv | ||
| fi | ||
| pip install "$tox" "$virtualenv" "git+https://github.com/linux-system-roles/tox-lsr@d594be24ed56e586a5796720d51c261e40c20496" | ||
| # If you have additional OS dependency packages e.g. libcairo2-dev | ||
| # then put them in .github/config/ubuntu-requirements.txt, one | ||
| # package per line. | ||
|
|
@@ -92,4 +92,4 @@ jobs: | |
| TOXENV="$toxenvs" lsr_ci_runtox | ||
|
|
||
| - name: Upload coverage reports to Codecov | ||
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7 | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: linux-system-roles/network
Length of output: 22448
🌐 Web query:
actions/checkout persist-credentials false official README token local git config💡 Result:
In the actions/checkout GitHub Action, the persist-credentials input determines whether the authentication token (or SSH key) used to clone the repository is configured in the local git configuration [1][2]. When persist-credentials is set to true (the default), the action configures the authentication credentials into the local git environment [1][2]. This allows your workflow scripts to run authenticated git commands (such as git push or git pull) without manually providing the token or key again [1][2]. These credentials are automatically removed during the post-job cleanup phase [1][2]. When you set persist-credentials: false, the action will not configure these credentials in the local git configuration [1][2]. This is often used to prevent the runner from having persistent authenticated access to the repository, which can be a security consideration if you are running untrusted scripts or want to strictly limit the scope of the token's availability [3]. It is important to note that in newer versions of actions/checkout (starting with v6), the way credentials are persisted has been updated [4]. Instead of being written directly into the main.git/config file, credentials are now stored in a separate configuration file in the runner's temporary directory ($RUNNER_TEMP) and included using Git's includeIf mechanism [4]. This change improves security by isolating the credentials from the primary repository configuration [4]. If you set persist-credentials: false, your scripts will not have the repository's access token available via the local git configuration, meaning git commands requiring authentication will fail unless you provide alternative authentication methods [1][2].
Citations:
persist-credentials=trueplease actions/checkout#2312🌐 Web query:
ad-m github-push-action github_token authentication README official💡 Result:
For the ad-m/github-push-action, authentication is primarily handled via the token input, which supports the default GITHUB_TOKEN or a personal access token (PAT) [1][2][3]. Key points regarding authentication and configuration: 1. Recommended Input: The preferred input name is token, which aligns with common conventions used by other actions like actions/checkout [3][4]. 2. Backward Compatibility: The github_token input remains supported as a non-breaking configuration option [1][2]. It defaults to ${{ github.token }} [3]. 3. Required Permissions: To push changes to a repository, the GITHUB_TOKEN must be configured with read and write permissions [1][3]. This is managed in the repository settings under Actions > General > Workflow permissions [1]. 4. Important Checkout Configuration: If you are using actions/checkout to prepare your workspace, you must set persist-credentials: false in the checkout step to prevent it from persisting the default credentials, which would otherwise override the token you intend to use for the push [5][3]. 5. Cross-Repository Pushing: If you need to push to a different repository, you must use a personal access token (PAT) or a GitHub App Token and pass it to the token input [1][5][6]. For further implementation details and examples, including how to set up GitHub App Tokens, you can refer to the official repository README [1][6].
Citations:
🏁 Script executed:
Repository: linux-system-roles/network
Length of output: 650
🏁 Script executed:
Repository: linux-system-roles/network
Length of output: 736
Disable credential persistence on all five checkout steps.
Set
persist-credentials: falsefor each listed checkout. Provide authentication explicitly forgit ls-remote,git push, andgit fetch --all --tags. The existinggithub_tokeninput keeps the finalgithub-push-actionpush authenticated.📍 Affects 3 files
.github/workflows/build_docs.yml#L28-L28(this comment).github/workflows/build_docs.yml#L51-L56.github/workflows/changelog_to_tag.yml#L25-L25.github/workflows/test_converting_readme.yml#L32-L32🤖 Prompt for AI Agents
Source: Linters/SAST tools