pin GitHub Actions to commit SHA#360
Conversation
|
Caution Review failedAn error occurred during the review process. Please try again later. 📝 WalkthroughWalkthroughGitHub Actions references are changed from floating version tags to pinned commit SHAs across benchmark and CI workflows. Result-repository jobs also update previous-data preparation, and the changelog adds a v1.20.7 release entry dated 06 Sep 2025. ChangesWorkflow action pinning
Release changelog
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/benchmarkdotnet.yml (1)
24-24: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUse the updated repository name for the benchmark action.
This workflow still references the outdated
rhysdnamespace, whereas the repository has moved tobenchmark-action(as used in other workflows). For consistency and to avoid relying on GitHub redirects, consider updating the namespace here and on line 38.♻️ Proposed refactor
- uses: rhysd/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1 + uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/benchmarkdotnet.yml at line 24, Update both benchmark action references in the workflow to use the current benchmark-action repository namespace instead of rhysd, while preserving the existing pinned revision and workflow behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/commit-comment.yml:
- Line 16: Add persist-credentials: false to every actions/checkout step in
.github/workflows/commit-comment.yml:16, .github/workflows/cpp.yml:16,
.github/workflows/go.yml:16, .github/workflows/java.yml:16,
.github/workflows/julia.yml:25, .github/workflows/minimal.yml:16,
.github/workflows/pytest.yml:16, and .github/workflows/rust-criterion-rs.yml:16;
leave the existing checkout revisions unchanged.
---
Nitpick comments:
In @.github/workflows/benchmarkdotnet.yml:
- Line 24: Update both benchmark action references in the workflow to use the
current benchmark-action repository namespace instead of rhysd, while preserving
the existing pinned revision and workflow behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: fa1a20ab-3506-413a-babb-7bae3bbd0644
📒 Files selected for processing (17)
.github/workflows/benchmarkdotnet.yml.github/workflows/benchmarkjs.yml.github/workflows/catch2.yml.github/workflows/catch2_v2.yml.github/workflows/ci-results-repo.yml.github/workflows/ci.yml.github/workflows/commit-comment.yml.github/workflows/cpp.yml.github/workflows/go.yml.github/workflows/java.yml.github/workflows/julia.yml.github/workflows/minimal.yml.github/workflows/pytest.yml.github/workflows/rust-criterion-rs.yml.github/workflows/rust.yml.github/workflows/validate-action-typings.ymlCHANGELOG.md
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/setup-go@v4 | ||
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable checkout credential persistence in these workflows.
actions/checkout writes the GitHub token into local git config by default. Add persist-credentials: false to each checkout step in:
.github/workflows/commit-comment.yml.github/workflows/cpp.yml.github/workflows/go.yml.github/workflows/java.yml.github/workflows/julia.yml.github/workflows/minimal.yml.github/workflows/pytest.yml.github/workflows/rust-criterion-rs.yml
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 16-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 8 files
.github/workflows/commit-comment.yml#L16-L16(this comment).github/workflows/cpp.yml#L16-L16.github/workflows/go.yml#L16-L16.github/workflows/java.yml#L16-L16.github/workflows/julia.yml#L25-L25.github/workflows/minimal.yml#L16-L16.github/workflows/pytest.yml#L16-L16.github/workflows/rust-criterion-rs.yml#L16-L16
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/commit-comment.yml at line 16, Add persist-credentials:
false to every actions/checkout step in .github/workflows/commit-comment.yml:16,
.github/workflows/cpp.yml:16, .github/workflows/go.yml:16,
.github/workflows/java.yml:16, .github/workflows/julia.yml:25,
.github/workflows/minimal.yml:16, .github/workflows/pytest.yml:16, and
.github/workflows/rust-criterion-rs.yml:16; leave the existing checkout
revisions unchanged.
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/ci.yml (1)
11-14: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winExplicitly declare workflow permissions.
To adhere to the principle of least privilege, explicitly declare a
permissionsblock at the workflow or job level rather than relying on defaults. Depending on repository settings, default permissions may grant overly broadwrite-allaccess.As per static analysis hints, this workflow is flagged for excessive permissions because it relies on default access.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 11 - 14, Update the CI workflow or the benchmarkdotnet-framework job to explicitly declare a least-privilege permissions block, granting only the access required by its steps and avoiding inherited or write-all defaults.Source: Linters/SAST tools
🧹 Nitpick comments (1)
.github/workflows/ci-results-repo.yml (1)
11-14: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDefine explicit workflow or job permissions.
The workflow relies on default token permissions because a
permissionsblock is not defined. To follow the principle of least privilege and mitigate security risks, explicitly define permissions (e.g.,contents: read) at the workflow or job level.As per static analysis hints from
zizmor, default permissions are used due to a missing permissions block (excessive-permissions).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci-results-repo.yml around lines 11 - 14, Add an explicit least-privilege permissions block to the workflow containing the benchmarkdotnet-framework job, granting only contents: read unless a narrower permission is required by the existing steps. Keep the job’s current behavior unchanged.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 11-14: Update the CI workflow or the benchmarkdotnet-framework job
to explicitly declare a least-privilege permissions block, granting only the
access required by its steps and avoiding inherited or write-all defaults.
---
Nitpick comments:
In @.github/workflows/ci-results-repo.yml:
- Around line 11-14: Add an explicit least-privilege permissions block to the
workflow containing the benchmarkdotnet-framework job, granting only contents:
read unless a narrower permission is required by the existing steps. Keep the
job’s current behavior unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: dc53b373-273a-4f73-a0fc-a90f0c1a5bc5
📒 Files selected for processing (3)
.github/workflows/benchmarkjs.yml.github/workflows/ci-results-repo.yml.github/workflows/ci.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/benchmarkjs.yml
2 participants
Summary by CodeRabbit
Reliability
Documentation