chore: resolve CodeQL issues (#DS-5215) - #207
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - run: npm run e2e:docker:update-snapshots | ||
| - uses: stefanzweifel/git-auto-commit-action@v7 | ||
| - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0 |
| - run: yarn run build --configuration=development | ||
| - uses: FirebaseExtended/action-hosting-deploy@v0.11.0 | ||
| - uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0.11.0 |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
🚧 Files skipped from review as they are similar to previous changes (8)
📝 WalkthroughWalkthroughGitHub Actions and workflow references now use immutable commit SHAs. Several workflows declare read-only or empty permissions. Commitlint passes the pull request title through an environment variable, and selected workflows check out commits by SHA. ChangesWorkflow hardening
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Visit the preview URL for this PR (updated for commit 2f5ce4b): https://data-grid-next--data-grid-pr-207-mglo9hu2.web.app (expires Sat, 15 Aug 2026 10:32:53 GMT) 🔥 via Firebase Hosting GitHub Action 🌎 Sign: b9d49913f5b5988e9af8690a8b37f16143707448 |
There was a problem hiding this comment.
Pull request overview
This PR addresses CodeQL findings in GitHub Actions workflows by tightening GITHUB_TOKEN permissions and pinning third-party actions to immutable commit SHAs to reduce supply-chain risk.
Changes:
- Pin GitHub Actions (checkout/setup-node/upload-artifact/comment/firebase/mattermost/git-auto-commit) to specific commit SHAs.
- Add explicit
permissions:blocks (mostlycontents: read, andpermissions: {}for thepull_request_targetnotification workflow) to follow least-privilege. - Harden commitlint invocation by avoiding direct interpolation in the shell pipeline.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/units.yml | Adds least-privilege permissions and pins actions/checkout. |
| .github/workflows/linters.yml | Adds least-privilege permissions and pins actions/checkout. |
| .github/workflows/build.yml | Adds least-privilege permissions and pins actions/checkout. |
| .github/workflows/commitlint.yml | Adds least-privilege permissions, pins actions/checkout, and hardens PR title piping. |
| .github/actions/setup-node/action.yml | Pins actions/setup-node to a commit SHA. |
| .github/workflows/e2e.yml | Pins actions/checkout, actions/upload-artifact, and PR comment action. |
| .github/workflows/e2e-approve-snapshots.yml | Pins actions and adjusts checkout ref used for snapshot update flow. |
| .github/workflows/deploy-preview.yml | Pins actions/checkout and Firebase deploy action. |
| .github/workflows/deploy-next.yml | Pins actions/checkout and Firebase deploy action. |
| .github/workflows/redeploy-preview.yml | Pins actions and adjusts checkout ref for comment-triggered redeploy. |
| .github/workflows/publish.yml | Pins actions/checkout and Mattermost notify action. |
| .github/workflows/pr-notification.yml | Pins Mattermost notify action and explicitly removes token permissions for pull_request_target. |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| ref: ${{ steps.comment-branch.outputs.head_ref }} | ||
| ref: ${{ steps.comment-branch.outputs.head_sha }} | ||
| - run: npm run e2e:docker:update-snapshots |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build.yml:
- Line 16: Update the actions/checkout steps in .github/workflows/build.yml
lines 16-17, .github/workflows/linters.yml lines 16-18, and
.github/workflows/units.yml lines 16-17 to set persist-credentials to false,
preventing GITHUB_TOKEN from being persisted or exposed to later commands.
In @.github/workflows/deploy-next.yml:
- Around line 18-20: Disable credential persistence on the pinned
actions/checkout steps by adding persist-credentials: false in
.github/workflows/deploy-next.yml lines 18-20 and .github/workflows/publish.yml
lines 21-23; no other workflow behavior needs to change.
In @.github/workflows/e2e-approve-snapshots.yml:
- Around line 27-30: Set persist-credentials to false for the actions/checkout
steps in .github/workflows/e2e-approve-snapshots.yml:27-30,
.github/workflows/commitlint.yml:12, and .github/workflows/e2e.yml:18. In the
e2e-approve-snapshots workflow, provide secrets.GITHUB_TOKEN only to
stefanzweifel/git-auto-commit-action if required for committing snapshot
updates.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 1ab78f7f-8bc4-4e71-a76c-fb9ab1d8d5ea
📒 Files selected for processing (12)
.github/actions/setup-node/action.yml.github/workflows/build.yml.github/workflows/commitlint.yml.github/workflows/deploy-next.yml.github/workflows/deploy-preview.yml.github/workflows/e2e-approve-snapshots.yml.github/workflows/e2e.yml.github/workflows/linters.yml.github/workflows/pr-notification.yml.github/workflows/publish.yml.github/workflows/redeploy-preview.yml.github/workflows/units.yml
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| ref: ${{ steps.comment-branch.outputs.head_ref }} | ||
| ref: ${{ steps.comment-branch.outputs.head_sha }} | ||
| - run: npm run e2e:docker:update-snapshots |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files =="
for f in .github/workflows/e2e-approve-snapshots.yml .github/workflows/commitlint.yml .github/workflows/e2e.yml; do
if [ -f "$f" ]; then
echo "--- $f $(wc -l < "$f") lines ---"
cat -n "$f"
else
echo "MISSING $f"
fi
done
echo
echo "== references to checkout and commit auto action =="
rg -n "actions/checkout|GITHUB_TOKEN|token:|auto-|persist-credentials|permissions:" .github/workflows -S || true
echo
echo "== package/scripts relevant =="
if [ -f package.json ]; then
node -e "const p=require('./package.json'); console.log(JSON.stringify({scripts:p.scripts}, null, 2));"
fiRepository: koobiq/data-grid
Length of output: 10354
🌐 Web query:
actions/checkout v7 persist-credentials default true local git configuration GITHUB_TOKEN
💡 Result:
In actions/checkout v7, the persist-credentials input defaults to true [1]. When set to true, the action configures the authentication token (or SSH key) in the local git configuration, enabling your workflow scripts to run authenticated git commands like git push or git fetch [2][3][4]. Key details regarding this behavior include: Storage location: As of v6 and maintained in v7, the action persists these credentials to a separate file (typically under $RUNNER_TEMP) rather than directly within the.git/config file, which improves credential security by preventing potential leaks through artifacts or other accidental exposures [5][6][7]. Cleanup: The action automatically removes these persisted credentials during the post-job cleanup phase [2][4]. Security: While the default remains true, setting persist-credentials to false is the recommended way to opt out if your workflow does not require authenticated git operations [2][3]. Even when set to true, the credentials are scoped to the checkout step and its subsequent environment, and they are cleared after the job completes [2][4]. If you are using GITHUB_TOKEN, this token is automatically used for authentication by default when persist-credentials is true, unless you provide a different token via the token input [4][8].
Citations:
- 1: https://github.com/actions/checkout/blob/34e114876b0b11c390a56381ad16ebd13914f8d5/action.yml
- 2: https://github.com/actions/checkout
- 3: https://github.com/actions/checkout/blob/main/README.md
- 4: https://github.com/actions/checkout/?tab=readme-ov-file
- 5: actions/checkout@v4.2.2...v7
- 6: [security] Escalate concerning default
persist-credentials=trueplease actions/checkout#2312 - 7: actions/checkout@v4.2.2...v7.0.1
- 8: https://github.com/marketplace/actions/checkout
Disable persisted checkout credentials before running PR-controlled code.
actions/checkout defaults to persisting the workflow token, and these workflows then run that code with the current git credentials in the runner environment.
- Set
persist-credentials: falseon.github/workflows/e2e-approve-snapshots.yml:27,.github/workflows/commitlint.yml:12, and.github/workflows/e2e.yml:18. - In
e2e-approve-snapshots.yml, passtoken: ${{ secrets.GITHUB_TOKEN }}only tostefanzweifel/git-auto-commit-action, if it requires it for the commit.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 27-29: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 3 files
.github/workflows/e2e-approve-snapshots.yml#L27-L30(this comment).github/workflows/commitlint.yml#L12-L12.github/workflows/e2e.yml#L18-L18
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-approve-snapshots.yml around lines 27 - 30, Set
persist-credentials to false for the actions/checkout steps in
.github/workflows/e2e-approve-snapshots.yml:27-30,
.github/workflows/commitlint.yml:12, and .github/workflows/e2e.yml:18. In the
e2e-approve-snapshots workflow, provide secrets.GITHUB_TOKEN only to
stefanzweifel/git-auto-commit-action if required for committing snapshot
updates.
Sources: Linters/SAST tools, Pipeline failures
ee03632 to
2f5ce4b
Compare
Summary by CodeRabbit