ci: fix TOB-SCREUC-8, do not persist git credentials #1139
Conversation
WalkthroughThe changes update multiple GitHub Actions workflows to disable credential persistence during the checkout step. Each affected workflow now includes the configuration Changes
Sequence Diagram(s)sequenceDiagram
participant Runner as GitHub Actions Runner
participant Checkout as Checkout Action
participant NextSteps as Subsequent Steps
Runner->>Checkout: Initiate checkout (persist-credentials: false)
Checkout-->>Runner: Checkout complete (credentials not persisted)
Runner->>NextSteps: Proceed to further steps
Suggested reviewers
Poem
Tip ⚡🧪 Multi-step agentic review comment chat (experimental)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/bump_version.yml (1)
51-56: Static Analysis Suggestion: Update Node.js Setup Action Version
Static analysis has flagged thatactions/setup-node@v3may be outdated for current runners. It is recommended to update to a more recent version of the setup-node action to benefit from the latest fixes and improvements.🧰 Tools
🪛 actionlint (1.7.4)
53-53: the runner of "actions/setup-node@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
.github/workflows/bump_version.yml(2 hunks).github/workflows/docker-arm64.yaml(1 hunks).github/workflows/docker.yaml(2 hunks).github/workflows/l2geth_ci.yml(6 hunks).github/workflows/semgrep.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/bump_version.yml
53-53: the runner of "actions/setup-node@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: test
🔇 Additional comments (10)
.github/workflows/semgrep.yml (1)
23-25: Security Improvement: Disabling Persisted Credentials
Addingpersist-credentials: falseto the checkout step ensures that GitHub credentials are not retained after checkout, which directly addresses the credential persistence warnings.🧰 Tools
🪛 actionlint (1.7.4)
23-23: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
.github/workflows/docker.yaml (1)
15-17: Security Enhancement: Prevent Credential Persistence in Docker Workflow
The addition ofpersist-credentials: falsein the checkout step helps avoid leaving credentials on the runner, aligning with the PR objective to mitigate unintended credential storage.🧰 Tools
🪛 actionlint (1.7.4)
15-15: the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
.github/workflows/docker-arm64.yaml (1)
21-23: Security Update: Disabling Credential Persistence in ARM64 Workflow
Includingpersist-credentials: falsein the checkout step ensures that sensitive credentials aren’t mistakenly persisted—this is consistent with security best practices across all workflows.🧰 Tools
🪛 actionlint (1.7.4)
21-21: the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
.github/workflows/l2geth_ci.yml (6)
26-30: CI Consistency: Disable Credential Persistence in Build Mock-CCC-Geth Job
By addingpersist-credentials: falsein this checkout step, the workflow further secures the CI process by ensuring no Git credentials are retained beyond the checkout phase.🧰 Tools
🪛 actionlint (1.7.4)
27-27: the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
51-55: CI Security: Checkout Credential Handling in Build Geth Job
This change prevents credential persistence during the checkout phase, which is critical for maintaining the overall security posture of the build process.🧰 Tools
🪛 actionlint (1.7.4)
52-52: the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
71-75: Security Fix: Preventing Credential Persistence in Check Job
Adding thepersist-credentials: falseoption here ensures that no Git credentials are carried over into subsequent steps, reinforcing the intended security measure.🧰 Tools
🪛 actionlint (1.7.4)
72-72: the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
93-97: Security Update: Disabling Credential Persistence in goimports-lint Job
This update keeps the workspace secure by ensuring that the checkout step does not leave behind persisted credentials.🧰 Tools
🪛 actionlint (1.7.4)
94-94: the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
116-120: Security Reinforcement: Credential Persistence Disabled for go-mod-tidy-lint Job
Consistently applyingpersist-credentials: falsein this step further aligns with the overall goal of preventing inadvertent credential exposure.🧰 Tools
🪛 actionlint (1.7.4)
117-117: the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
139-143: Test Job Security: Eliminating Credential Leakage in Checkout Step
The inclusion ofpersist-credentials: falsein the test job’s checkout step ensures that no credentials are unnecessarily persisted, enhancing the security across all CI stages.🧰 Tools
🪛 actionlint (1.7.4)
140-140: the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
.github/workflows/bump_version.yml (1)
18-23: Security Enhancement: Disabling Credential Persistence in Version Bump Workflow
The update to includepersist-credentials: falsein the checkout step ensures that Git credentials are not retained, supporting secure CI practices across all workflows.🧰 Tools
🪛 actionlint (1.7.4)
19-19: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
1. Purpose or design rationale of this PR
Fix multiple zizmor error like this:
2. PR title
Your PR title must follow conventional commits (as we are doing squash merge for each PR), so it must start with one of the following types:
3. Deployment tag versioning
Has the version in
params/version.gobeen updated?4. Breaking change label
Does this PR have the
breaking-changelabel?Summary by CodeRabbit