chore(ci): adopt gitleaks and scorecard workflows - #48
Conversation
📝 WalkthroughWalkthroughThis PR modifies CI configuration by adding ChangesCI Workflow Updates
Estimated code review effort: 1 (Trivial) | ~5 minutes Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested labels: ci, github-actions Suggested reviewers: move-elevator maintainers Poem 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This reverts commit 327526a.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 10-12: The reusable workflow reference in the release job is
pinned to a mutable branch, so update the workflow call to use a specific commit
SHA instead of main. Change the external workflow reference in the release job
while keeping the existing permissions block intact, and use the same reusable
workflow identifier so it is easy to locate and verify.
In @.github/workflows/scorecard.yml:
- Around line 10-17: The scorecard job currently references a reusable workflow
via a mutable branch ref, so update the workflow call in the scorecard job to
pin it to a full commit SHA instead of `@main`. Locate the reusable workflow
reference under the scorecard job and replace the branch selector with the
immutable commit SHA for the exact workflow version you intend to run. Keep the
existing permissions unchanged while making the reference deterministic and
security-safe.
In @.github/workflows/security.yml:
- Around line 9-12: The security job is still referencing the reusable workflow
from the moving main branch, so update the uses reference in the security
workflow to a specific commit SHA instead of `@main`. Keep the existing job name
and permissions intact, and only change the reusable workflow identifier to the
pinned SHA so the security workflow stays on a fixed version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 58859915-c634-401f-8718-20e4cb36ece4
📒 Files selected for processing (3)
.github/workflows/release.yml.github/workflows/scorecard.yml.github/workflows/security.yml
| uses: konradmichalik/reusable-github-actions/.github/workflows/release.yml@main | ||
| permissions: | ||
| contents: write No newline at end of file |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if other workflows in this repo already pin third-party/reusable-workflow refs to a SHA,
# to see whether `@main` is an established (if risky) convention here.
rg -n 'uses:\s*konradmichalik/reusable-github-actions' .github/workflowsRepository: move-elevator/typo3-styleguide
Length of output: 638
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== release.yml ==\n'
cat -n .github/workflows/release.yml
printf '\n== other reusable-workflow calls ==\n'
rg -n -A2 -B1 'uses:\s*konradmichalik/reusable-github-actions' .github/workflowsRepository: move-elevator/typo3-styleguide
Length of output: 1466
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== workflow files ==\n'
git ls-files .github/workflows
printf '\n== release.yml lines ==\n'
sed -n '1,40p' .github/workflows/release.yml
printf '\n== scorecard/security/cgl snippets ==\n'
for f in .github/workflows/cgl.yml .github/workflows/scorecard.yml .github/workflows/security.yml; do
printf '\n--- %s ---\n' "$f"
sed -n '1,30p' "$f"
doneRepository: move-elevator/typo3-styleguide
Length of output: 1375
Pin the reusable workflow reference
This job grants contents: write to konradmichalik/reusable-github-actions/.github/workflows/release.yml@main, which is mutable. Pin it to a commit SHA before merging.
🔒 Suggested fix
- uses: konradmichalik/reusable-github-actions/.github/workflows/release.yml@main
+ uses: konradmichalik/reusable-github-actions/.github/workflows/release.yml@<full-length-commit-sha> # main🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 10 - 12, The reusable workflow
reference in the release job is pinned to a mutable branch, so update the
workflow call to use a specific commit SHA instead of main. Change the external
workflow reference in the release job while keeping the existing permissions
block intact, and use the same reusable workflow identifier so it is easy to
locate and verify.
| jobs: | ||
| scorecard: | ||
| uses: konradmichalik/reusable-github-actions/.github/workflows/scorecard.yml@main | ||
| permissions: | ||
| contents: read | ||
| security-events: write | ||
| id-token: write | ||
| actions: read |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '1,80p' .github/workflows/scorecard.ymlRepository: move-elevator/typo3-styleguide
Length of output: 503
🌐 Web query:
GitHub Actions reusable workflow branch pinning security-events write id-token write best practices
💡 Result:
To secure GitHub Actions reusable workflows, you must address both the reference mechanism (pinning) and the execution context (permissions and secrets). PINNING BEST PRACTICES - Always pin to a full-length (40-character) commit SHA [1][2][3]. Using branch or tag references (e.g., @main, @v1) creates a supply chain risk, as these are mutable and can be silently updated by maintainers or compromised accounts [1][2][4]. - When referencing a reusable workflow, use: uses: owner/repo/.github/workflows/file.yaml@<commit-sha> [1][3]. - Automate enforcement: Use organization-level policies where available to require full-length commit SHAs, and incorporate linting tools (like actionlint) in your CI pipeline to reject non-SHA references [3]. - Conduct periodic drift audits to ensure that the referenced SHA still corresponds to the intended version, as upstream maintainers can technically re-point tags to different commits [3]. - Verify the origin: Ensure the commit SHA belongs to the expected repository to prevent dependency confusion attacks [5]. PERMISSION AND SECURITY BEST PRACTICES - Follow the principle of least privilege: Set permissions: {} at the top level of your workflow to disable all default permissions [6][5]. Grant only the specific, minimal permissions required for each job [7][8][9]. - Regarding security-events: write: This permission is required if the workflow needs to upload code scanning results (e.g., SARIF files) [10]. Only grant this to jobs specifically performing security analysis. - Regarding id-token: write: This is necessary for workflows using OpenID Connect (OIDC) to authenticate with external cloud providers (e.g., AWS, Azure, GCP). This is a best practice as it removes the need to store long-lived cloud credentials as GitHub Secrets [2]. - Use explicit secret passing: Avoid secrets: inherit [2][5]. Explicitly declare which secrets are passed to the reusable workflow to prevent accidental exposure of environment or repository secrets to components that do not require them [2][5][11]. - Validate inputs: Reusable workflows should treat all inputs as untrusted. Use choice types for fixed options or implement runtime regex validation for string inputs to prevent command injection [2][11]. - Implement caller allowlists: If possible, have the reusable workflow validate the calling repository (github.repository) to ensure only authorized workflows can execute it [2][12]. For auditing permissions, consider using tools that monitor GitHub API interactions during a workflow run to suggest the minimal set of permissions needed, rather than defaulting to "write-all" [9].
Citations:
- 1: https://github.com/ActionsCI/reusable-workflows
- 2: https://adaptive-enforcement-lab.com/secure/github-actions-security/workflows/reusable/caller-validation-pinning/
- 3: https://www.systemshardening.com/articles/cicd/github-actions-reusable-workflow-pinning-audit/
- 4: https://devopsil.com/articles/2026-03-22-github-actions-reusable-workflows-guide
- 5: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html
- 6: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.md
- 7: https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/
- 8: https://github.com/github/docs/blob/main/content/actions/reference/security/secure-use.md
- 9: https://github.blog/security/new-tool-to-secure-your-github-actions/
- 10: https://github.com/orgs/community/discussions/29710
- 11: https://adaptive-enforcement-lab.com/secure/github-actions-security/workflows/reusable/
- 12: https://getpguard.com/blog/secure-reusable-workflows-governance-pattern
Pin this reusable workflow to a full-length commit SHA. @main is mutable, and this job runs with security-events: write and id-token: write, so an upstream change could alter a security-sensitive workflow.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/scorecard.yml around lines 10 - 17, The scorecard job
currently references a reusable workflow via a mutable branch ref, so update the
workflow call in the scorecard job to pin it to a full commit SHA instead of
`@main`. Locate the reusable workflow reference under the scorecard job and
replace the branch selector with the immutable commit SHA for the exact workflow
version you intend to run. Keep the existing permissions unchanged while making
the reference deterministic and security-safe.
| security: | ||
| uses: konradmichalik/reusable-github-actions/.github/workflows/security.yml@main | ||
| permissions: | ||
| contents: read |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
[skip_cloning]Repository: move-elevator/typo3-styleguide
Length of output: 220
🏁 Script executed:
#!/bin/bash
# Inspect the actual reusable "security.yml" workflow to confirm whether it uploads SARIF
# (and thus needs security-events: write) or otherwise requires more than contents: read.
curl -s https://raw.githubusercontent.com/konradmichalik/reusable-github-actions/main/.github/workflows/security.ymlRepository: move-elevator/typo3-styleguide
Length of output: 845
Pin the reusable workflow to a commit SHA .github/workflows/security.yml still references konradmichalik/reusable-github-actions/.github/workflows/security.yml@main; replace it with a full commit SHA to avoid pulling in unexpected workflow changes.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.yml around lines 9 - 12, The security job is
still referencing the reusable workflow from the moving main branch, so update
the uses reference in the security workflow to a specific commit SHA instead of
`@main`. Keep the existing job name and permissions intact, and only change the
reusable workflow identifier to the pinned SHA so the security workflow stays on
a fixed version.
1 participant
Summary
contents: writeto the release workflow caller (required once the repo's default token is read-only)These changes bring this repository in line with the security hardening recently added to konradmichalik/reusable-github-actions.
Summary by CodeRabbit