chore(ci): adopt gitleaks and scorecard workflows #48

coderabbitai · 2026-07-02T15:05:56Z

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Check if other workflows in this repo already pin third-party/reusable-workflow refs to a SHA, # to see whether `@main` is an established (if risky) convention here. rg -n 'uses:\s*konradmichalik/reusable-github-actions' .github/workflows

Repository: move-elevator/typo3-styleguide

Length of output: 638

🏁 Script executed:

#!/bin/bash set -euo pipefail printf '\n== release.yml ==\n' cat -n .github/workflows/release.yml printf '\n== other reusable-workflow calls ==\n' rg -n -A2 -B1 'uses:\s*konradmichalik/reusable-github-actions' .github/workflows

Repository: move-elevator/typo3-styleguide

Length of output: 1466

🏁 Script executed:

#!/bin/bash set -euo pipefail printf '\n== workflow files ==\n' git ls-files .github/workflows printf '\n== release.yml lines ==\n' sed -n '1,40p' .github/workflows/release.yml printf '\n== scorecard/security/cgl snippets ==\n' for f in .github/workflows/cgl.yml .github/workflows/scorecard.yml .github/workflows/security.yml; do printf '\n--- %s ---\n' "$f" sed -n '1,30p' "$f" done

Repository: move-elevator/typo3-styleguide

Length of output: 1375

Pin the reusable workflow reference
This job grants contents: write to konradmichalik/reusable-github-actions/.github/workflows/release.yml@main, which is mutable. Pin it to a commit SHA before merging.

🔒 Suggested fix

- uses: konradmichalik/reusable-github-actions/.github/workflows/release.yml@main + uses: konradmichalik/reusable-github-actions/.github/workflows/release.yml@<full-length-commit-sha> # main

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 10 - 12, The reusable workflow reference in the release job is pinned to a mutable branch, so update the workflow call to use a specific commit SHA instead of main. Change the external workflow reference in the release job while keeping the existing permissions block intact, and use the same reusable workflow identifier so it is easy to locate and verify.

coderabbitai · 2026-07-02T15:05:56Z

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

sed -n '1,80p' .github/workflows/scorecard.yml

Repository: move-elevator/typo3-styleguide

Length of output: 503

🌐 Web query:

GitHub Actions reusable workflow branch pinning security-events write id-token write best practices

💡 Result:

To secure GitHub Actions reusable workflows, you must address both the reference mechanism (pinning) and the execution context (permissions and secrets). PINNING BEST PRACTICES - Always pin to a full-length (40-character) commit SHA [1][2][3]. Using branch or tag references (e.g., @main, @v1) creates a supply chain risk, as these are mutable and can be silently updated by maintainers or compromised accounts [1][2][4]. - When referencing a reusable workflow, use: uses: owner/repo/.github/workflows/file.yaml@<commit-sha> [1][3]. - Automate enforcement: Use organization-level policies where available to require full-length commit SHAs, and incorporate linting tools (like actionlint) in your CI pipeline to reject non-SHA references [3]. - Conduct periodic drift audits to ensure that the referenced SHA still corresponds to the intended version, as upstream maintainers can technically re-point tags to different commits [3]. - Verify the origin: Ensure the commit SHA belongs to the expected repository to prevent dependency confusion attacks [5]. PERMISSION AND SECURITY BEST PRACTICES - Follow the principle of least privilege: Set permissions: {} at the top level of your workflow to disable all default permissions [6][5]. Grant only the specific, minimal permissions required for each job [7][8][9]. - Regarding security-events: write: This permission is required if the workflow needs to upload code scanning results (e.g., SARIF files) [10]. Only grant this to jobs specifically performing security analysis. - Regarding id-token: write: This is necessary for workflows using OpenID Connect (OIDC) to authenticate with external cloud providers (e.g., AWS, Azure, GCP). This is a best practice as it removes the need to store long-lived cloud credentials as GitHub Secrets [2]. - Use explicit secret passing: Avoid secrets: inherit [2][5]. Explicitly declare which secrets are passed to the reusable workflow to prevent accidental exposure of environment or repository secrets to components that do not require them [2][5][11]. - Validate inputs: Reusable workflows should treat all inputs as untrusted. Use choice types for fixed options or implement runtime regex validation for string inputs to prevent command injection [2][11]. - Implement caller allowlists: If possible, have the reusable workflow validate the calling repository (github.repository) to ensure only authorized workflows can execute it [2][12]. For auditing permissions, consider using tools that monitor GitHub API interactions during a workflow run to suggest the minimal set of permissions needed, rather than defaulting to "write-all" [9].

Citations:

1: https://github.com/ActionsCI/reusable-workflows

2: https://adaptive-enforcement-lab.com/secure/github-actions-security/workflows/reusable/caller-validation-pinning/

3: https://www.systemshardening.com/articles/cicd/github-actions-reusable-workflow-pinning-audit/

4: https://devopsil.com/articles/2026-03-22-github-actions-reusable-workflows-guide

5: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html

6: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.md

7: https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/

8: https://github.com/github/docs/blob/main/content/actions/reference/security/secure-use.md

9: https://github.blog/security/new-tool-to-secure-your-github-actions/

10: https://github.com/orgs/community/discussions/29710

11: https://adaptive-enforcement-lab.com/secure/github-actions-security/workflows/reusable/

12: https://getpguard.com/blog/secure-reusable-workflows-governance-pattern

Pin this reusable workflow to a full-length commit SHA. @main is mutable, and this job runs with security-events: write and id-token: write, so an upstream change could alter a security-sensitive workflow.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/scorecard.yml around lines 10 - 17, The scorecard job currently references a reusable workflow via a mutable branch ref, so update the workflow call in the scorecard job to pin it to a full commit SHA instead of `@main`. Locate the reusable workflow reference under the scorecard job and replace the branch selector with the immutable commit SHA for the exact workflow version you intend to run. Keep the existing permissions unchanged while making the reference deterministic and security-safe.

coderabbitai · 2026-07-02T15:05:56Z

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

[skip_cloning]

Repository: move-elevator/typo3-styleguide

Length of output: 220

🏁 Script executed:

#!/bin/bash # Inspect the actual reusable "security.yml" workflow to confirm whether it uploads SARIF # (and thus needs security-events: write) or otherwise requires more than contents: read. curl -s https://raw.githubusercontent.com/konradmichalik/reusable-github-actions/main/.github/workflows/security.yml

Repository: move-elevator/typo3-styleguide

Length of output: 845

Pin the reusable workflow to a commit SHA .github/workflows/security.yml still references konradmichalik/reusable-github-actions/.github/workflows/security.yml@main; replace it with a full commit SHA to avoid pulling in unexpected workflow changes.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/security.yml around lines 9 - 12, The security job is still referencing the reusable workflow from the moving main branch, so update the uses reference in the security workflow to a specific commit SHA instead of `@main`. Keep the existing job name and permissions intact, and only change the reusable workflow identifier to the pinned SHA so the security workflow stays on a fixed version.

-Original file line number
+Diff line change
@@ -0,0 +1,17 @@
+    name: OpenSSF Scorecard
+    on:
+      push:
+        branches:
+          - main
+      schedule:
+        - cron: '0 0 * * 0'
+      workflow_dispatch:
+    jobs:
+      scorecard:
+        uses: konradmichalik/reusable-github-actions/.github/workflows/scorecard.yml@main
+        permissions:
+          contents: read
+          security-events: write
+          id-token: write
+          actions: read

-Original file line number
+Diff line change
@@ -0,0 +1,12 @@
+    name: Security
+    on:
+      push:
+        branches:
+          - main
+      pull_request: ~
+    jobs:
+      security:
+        uses: konradmichalik/reusable-github-actions/.github/workflows/security.yml@main
+        permissions:
+          contents: read

Navigation Menu

Uh oh!

chore(ci): adopt gitleaks and scorecard workflows #48

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai Bot Jul 2, 2026

Uh oh!

coderabbitai Bot Jul 2, 2026

Uh oh!

coderabbitai Bot Jul 2, 2026

Uh oh!

Uh oh!

-Original file line number
+Diff line change
@@ Expand Up / @@ -7,4 +7,6 @@ on: @@
     jobs:
       release:
-        uses: konradmichalik/reusable-github-actions/.github/workflows/release.yml@main
+        uses: konradmichalik/reusable-github-actions/.github/workflows/release.yml@main
+        permissions:
+          contents: write

Uh oh!

chore(ci): adopt gitleaks and scorecard workflows #48

Uh oh!

chore(ci): adopt gitleaks and scorecard workflows #48

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai Bot Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!