chore: resolve CodeQL issues (#DS-5215) #207
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -19,16 +19,16 @@ | |
| runs-on: ubuntu-24.04-arm | ||
| timeout-minutes: 10 | ||
| steps: | ||
| - uses: xt0rted/pull-request-comment-branch@e8b8daa837e8ea7331c0003c9c316a64c6d8b0b1 # v3.0.0 | ||
| id: comment-branch | ||
| - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 | ||
| with: | ||
| message: 🔄 [Updating](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) snapshots. | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| ref: ${{ steps.comment-branch.outputs.head_sha }} | ||
| - run: npm run e2e:docker:update-snapshots | ||
|
Comment on lines
+27
to
30
Comment on lines
+27
to
30
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== workflow files =="
for f in .github/workflows/e2e-approve-snapshots.yml .github/workflows/commitlint.yml .github/workflows/e2e.yml; do
if [ -f "$f" ]; then
echo "--- $f $(wc -l < "$f") lines ---"
cat -n "$f"
else
echo "MISSING $f"
fi
done
echo
echo "== references to checkout and commit auto action =="
rg -n "actions/checkout|GITHUB_TOKEN|token:|auto-|persist-credentials|permissions:" .github/workflows -S || true
echo
echo "== package/scripts relevant =="
if [ -f package.json ]; then
node -e "const p=require('./package.json'); console.log(JSON.stringify({scripts:p.scripts}, null, 2));"
fiRepository: koobiq/data-grid Length of output: 10354 🌐 Web query:
💡 Result: In actions/checkout v7, the persist-credentials input defaults to true [1]. When set to true, the action configures the authentication token (or SSH key) in the local git configuration, enabling your workflow scripts to run authenticated git commands like git push or git fetch [2][3][4]. Key details regarding this behavior include: Storage location: As of v6 and maintained in v7, the action persists these credentials to a separate file (typically under $RUNNER_TEMP) rather than directly within the.git/config file, which improves credential security by preventing potential leaks through artifacts or other accidental exposures [5][6][7]. Cleanup: The action automatically removes these persisted credentials during the post-job cleanup phase [2][4]. Security: While the default remains true, setting persist-credentials to false is the recommended way to opt out if your workflow does not require authenticated git operations [2][3]. Even when set to true, the credentials are scoped to the checkout step and its subsequent environment, and they are cleared after the job completes [2][4]. If you are using GITHUB_TOKEN, this token is automatically used for authentication by default when persist-credentials is true, unless you provide a different token via the token input [4][8]. Citations:
Disable persisted checkout credentials before running PR-controlled code.
🧰 Tools🪛 zizmor (1.29.0)[warning] 27-29: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 📍 Affects 3 files
🤖 Prompt for AI AgentsSources: Linters/SAST tools, Pipeline failures |
||
| - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0 | ||
|
Comment on lines
30
to
+31
|
||
| id: commit-and-push | ||
| with: | ||
| commit_message: 'test: updated e2e snapshots' | ||
|
|
@@ -37,11 +37,11 @@ | |
| if: ${{ steps.commit-and-push.outputs.changes_detected == 'true' }} | ||
| with: | ||
| message: ✅ Snapshots [updated](https://github.com/${{ github.repository }}/pull/${{ github.event.issue.number }}/commits/${{ steps.commit-and-push.outputs.commit_hash }})! | ||
| - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 | ||
| if: ${{ steps.commit-and-push.outputs.changes_detected != 'true' }} | ||
| with: | ||
| message: ⚠️ No snapshots changes detected. | ||
| - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 | ||
| if: ${{ failure() }} | ||
| with: | ||
| message: 🚨 Failed to [update](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) snapshots. | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.