chore: harden Github Actions workflows - #3559
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThis pull request pins the ChangesPin
Estimated Code Review Effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@derberg @bandantonio @thulieblack Please take a look at this PR. Thanks! 👋 |
Florence-Njeri
changed the title
…xpressions into env variables to prevent attackers from injecting code into the templateable templates
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| steps: | ||
| - name: Checkout base commit | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
|
|
||
| - name: Checkout head commit | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
…olicy instead of teh workflows using default permissions
|
| steps: | ||
| - name: Checkout main branch | ||
| uses: actions/checkout@v3 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| run: ls -la | ||
| - name: Checkout one commit before last one | ||
| uses: actions/checkout@v3 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
3 participants
Description
Security hardening of workflow files:
permissions: {}at workflow level with minimal per-job overrides${{ }}template expressions intoenv:blocks to prevent shell/script injectionpersist-credentials: falseon checkoutsRelated issue(s)
Summary by CodeRabbit
Release Notes
actions/github-script(v9.0.0) instead of floating version references across automation workflows, enhancing stability and security.