ci: GitHub Actions workflow security cleanup - #484
Conversation
Sets a workflow-level permissions: {} default and grants each job only
contents: read (the minimum required for actions/checkout). The
check-documentation job retains its existing deployments / id-token
scopes; the all-checks-completed job needs nothing, so {} is explicit.
Identified by a workflow security audit. Previously the workflow
inherited the default GITHUB_TOKEN scopes, which include write access
to several APIs that no job here uses.
Adds persist-credentials: false to every actions/checkout step. The workflow does not need to push back to the repo or carry the token beyond checkout, so persisting the credential in .git/config only widens the window in which a later step could read it. Identified by a workflow security audit.
Replaces inline ${{ ... }} expansions inside shell run blocks with env
bindings that the script then reads as "$VAR". The expression syntax
substitutes text directly into the shell command before it executes,
so a crafted value could escape the intended argument; env vars are
treated as data by the shell.
Identified by a workflow security audit. The current sources of these
values (build matrix and a trusted action's output) are not
attacker-controlled today, but the env-var idiom is robust if that
changes.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThe workflow hardening adds explicit job-level permissions (mostly ChangesGitHub Actions Workflow Hardening and Platform Configuration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@emptyhammond I suspect this was opened during that GitHub Actions outage, can you trigger CI again please? |
2732c65 to
68d907b
Compare
Done @lawrence-forooghian - still one failure, which I'll check |
|
That failure is unrelated, merging |
2 participants
Routine hygiene pass over the GitHub Actions workflow in this repo, addressing findings from a workflow security audit. Changes are split into four commits, one per finding type:
actions/checkoutsteps so the defaultGITHUB_TOKENis not left in the local git config after checkout.permissions: {}, with each job granted only theGITHUB_TOKENscopes it actually needs.${{ matrix.platform }}, step outputs) out ofrun:shell source and intoenv:bindings.No behavioural changes intended — the workflow runs the same checks against the same inputs.
Summary by CodeRabbit