Tighten dependency and CI security - #9
Conversation
|
Warning Review limit reached
Next review available in: 56 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughChangesCI hardening
Dependency override
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ef1df6e to
d6d6d7d
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 60: Disable checkout credential persistence for all four checkout steps
in .github/workflows/ci.yml at lines 20-22, 60-60, 100-100, and 132-132 by
setting persist-credentials to false; no authenticated Git access exception is
indicated.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 81cbf705-b3b8-4f71-8794-d100d27f2e15
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
.github/workflows/ci.ymlpackage.json
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - uses: actions/setup-node@v5 | ||
| - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
nl -ba .github/workflows/ci.yml | sed -n '1,170p'
echo
echo "== checkout steps with context =="
python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/ci.yml')
for i,line in enumerate(p.read_text().splitlines(),1):
if 'uses: actions/checkout' in line or 'persist-credentials' in line or 'pnpm' in line or 'bun' in line or 'python' in line or 'run:' in line:
lo=max(1,i-3); hi=min(p.read_text().splitlines().__len__(),i+5)
lines=p.read_text().splitlines()
print(f"\n--- around .github/workflows/ci.yml:{i} ---")
for n in range(lo,hi+1):
print(f"{n}: {lines[n-1]}")
PYRepository: om-surushe/SendPlug
Length of output: 220
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
awk '{printf "%6d: %s\n", NR, $0}' .github/workflows/ci.yml | sed -n '1,170p'
echo
echo "== checkout steps with context =="
python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/ci.yml')
lines=p.read_text().splitlines()
for i,line in enumerate(lines,1):
if 'uses: actions/checkout' in line or 'persist-credentials' in line or 'pnpm' in line or 'bun' in line or 'python' in line or 'run:' in line:
lo=max(1,i-3); hi=min(len(lines),i+5)
print(f"\n--- around .github/workflows/ci.yml:{i} ---")
for n in range(lo,hi+1):
print(f"{n}: {lines[n-1]}")
PYRepository: om-surushe/SendPlug
Length of output: 19230
🌐 Web query:
actions/checkout v6 persist-credentials default true README
💡 Result:
In actions/checkout v6, the persist-credentials input defaults to true [1]. This setting configures the action to persist the authentication token or SSH key in the local git configuration, enabling subsequent steps in your workflow to execute authenticated git commands [2][3]. As of v6, the implementation of this setting includes security improvements: the credentials are no longer stored directly in the.git/config file, but instead in a separate file located within the $RUNNER_TEMP directory [2][4]. This change is designed to prevent sensitive credentials from being accidentally leaked through mechanisms like artifact uploads [5]. If you wish to prevent the persistence of these credentials, you can explicitly set the input to false in your workflow file [2]: - uses: actions/checkout@v6 with: persist-credentials: false
Citations:
- 1: https://raw.githubusercontent.com/actions/checkout/v6/action.yml
- 2: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 3: https://github.com/actions/checkout/?tab=readme-ov-file
- 4: https://github.com/actions/checkout/tree/v6.0.0
- 5: [security] Escalate concerning default
persist-credentials=trueplease actions/checkout#2312
Disable checkout credential persistence in all four jobs.
These checkout steps use actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5, where the persist-credentials input defaults to true. Subsequent repository-controlled run commands can read the persisted GitHub token in the job environment. Add persist-credentials: false to every checkout step unless authenticated Git access is required for that step.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 60-60: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 1 file
.github/workflows/ci.yml#L60-L60(this comment).github/workflows/ci.yml#L20-L22.github/workflows/ci.yml#L100-L100.github/workflows/ci.yml#L132-L132
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 60, Disable checkout credential persistence
for all four checkout steps in .github/workflows/ci.yml at lines 20-22, 60-60,
100-100, and 132-132 by setting persist-credentials to false; no authenticated
Git access exception is indicated.
Source: Linters/SAST tools
1 participant
Summary
Verified without Docker
Docker validation is delegated to bounded CI: each image build has a 3-minute limit and the job has an 8-minute limit.
Summary by CodeRabbit
Security
Reliability
Chores