chore: hardening the GA workflows#2092
Conversation
Florence-Njeri
requested review from
asyncapi-bot-eve,
derberg,
jonaslagoni and
magicmatatjahu
as code owners
|
What reviewer looks at during PR reviewThe following are ideal points maintainers look for during review. Reviewing these points yourself beforehand can help streamline the review process and reduce time to merge.
|
📝 WalkthroughWalkthroughThis pull request updates many GitHub Actions workflows to pin third-party actions to specific commit SHAs, adds explicit workflow/job permissions and credential persistence changes, and adds Netlify docs-preview build and deploy workflows. ChangesGitHub Actions version pinning & workflow adjustments
🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@derberg @jonaslagoni @magicmatatjahu Please take a look at this PR. Thanks! 👋 |
…cope the write permissions and prevent pwn requests when using pull_request_target
…rator into hardening-GA
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
.github/workflows/update-docs-in-website.yml (1)
38-40: 💤 Low valuegit config still uses
--globaldespite PR description.The PR description states "Scope git config to the repository instead of --global", but lines 39-40 still use
--global. While this isn't harmful in an ephemeral CI environment, consider using local config for consistency with the stated hardening objective:Suggested change
run: | - git config --global user.name asyncapi-bot - git config --global user.email info@asyncapi.io + git config user.name asyncapi-bot + git config user.email info@asyncapi.io🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/update-docs-in-website.yml around lines 38 - 40, The git config calls currently use --global; change them to set repository-local config instead by removing --global (or using --local) for the two commands that set user.name and user.email so that git config user.name asyncapi-bot and git config user.email info@asyncapi.io are applied only to the repository in the update-docs-in-website.yml workflow.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/manual_netlify_preview.yml:
- Around line 67-68: The deployment directory precedence is wrong: change the
logic that sets DEPLOY_DIR so a static build (site/out) is preferred over
site/.next; instead of defaulting DEPLOY_DIR to site/.next when that directory
exists, first check for site/out and set DEPLOY_DIR="site/out" if present,
otherwise fall back to site/.next. Update the lines that currently set
DEPLOY_DIR and the conditional [ -d "site/.next" ] check so they reference the
functions/variables DEPLOY_DIR and the directories "site/out" and "site/.next"
in that order.
In @.github/workflows/manual-netlify-build.yml:
- Around line 33-34: Replace the fragile rm commands in the workflow that remove
README.md and the jsdoc2md-handlebars directory with idempotent variants: use rm
-f for the file removal and rm -rf (or rm -rf for the directory) so the steps
succeed even if the targets are missing; update the two commands shown ("rm
website/markdown/docs/tools/generator/README.md" and "rm -r
website/markdown/docs/tools/generator/jsdoc2md-handlebars") to their
force/recursive-force equivalents to make the cleanup resilient.
In @.github/workflows/pr-review-checklist.yml:
- Line 4: The workflow currently triggers on pull_request and uses
secrets.GH_TOKEN to post the checklist, which fails for forked PRs; change the
trigger to pull_request_target or split the posting into a separate job that
runs only for trusted contexts, and ensure any steps that run untrusted PR code
(e.g., actions/checkout of head ref or test/build steps) are not executed under
pull_request_target; specifically, replace the trigger 'pull_request' with
'pull_request_target' or add logic to run the checklist-posting step (the step
that uses secrets.GH_TOKEN) only when the event originates from the same repo or
use a dedicated job that posts comments while avoiding checking out PR code with
elevated secrets.
In @.github/workflows/pr-testing-with-test-project.yml:
- Around line 47-49: The condition currently compares github.actor to a numeric
ID which will never match; update the conditional expression in the workflow to
either compare the login string (github.actor == 'allcontributors[bot]') or use
the numeric id field (github.actor_id == 46447321) so the clause with
startsWith(github.event.pull_request.title, 'docs: add') can evaluate correctly;
modify the expression that references github.actor to use github.actor_id or
change the literal to 'allcontributors[bot]'.
In @.github/workflows/welcome-first-time-contrib.yml:
- Around line 19-21: The workflow permissions use an invalid scope name
'pull_requests'; update the permissions mapping to replace the 'pull_requests'
key with the correct GitHub Actions scope 'pull-requests' so the permissions
block (the permissions: mapping containing 'issues: write' and the erroneous
'pull_requests: write') uses 'pull-requests: write' to allow PR review actions.
---
Nitpick comments:
In @.github/workflows/update-docs-in-website.yml:
- Around line 38-40: The git config calls currently use --global; change them to
set repository-local config instead by removing --global (or using --local) for
the two commands that set user.name and user.email so that git config user.name
asyncapi-bot and git config user.email info@asyncapi.io are applied only to the
repository in the update-docs-in-website.yml workflow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: c5de0b44-964a-4fec-9017-634835142729
📒 Files selected for processing (27)
.github/workflows/add-good-first-issue-labels.yml.github/workflows/automerge-for-humans-add-ready-to-merge-or-do-not-merge-label.yml.github/workflows/automerge-for-humans-merging.yml.github/workflows/automerge-for-humans-remove-ready-to-merge-label-on-edit.yml.github/workflows/automerge-orphans.yml.github/workflows/automerge.yml.github/workflows/bounty-program-commands.yml.github/workflows/bump.yml.github/workflows/help-command.yml.github/workflows/if-nodejs-pr-testing.yml.github/workflows/local-generate-files.yml.github/workflows/manual-netlify-build.yml.github/workflows/manual-netlify-preview.yml.github/workflows/manual_netlify_preview.yml.github/workflows/microgrant-program-commands.yml.github/workflows/notify-tsc-members-mention.yml.github/workflows/please-take-a-look-command.yml.github/workflows/pr-review-checklist.yml.github/workflows/pr-testing-with-test-project.yml.github/workflows/release-announcements.yml.github/workflows/release-with-changesets.yml.github/workflows/transfer-issue.yml.github/workflows/update-docs-in-website.yml.github/workflows/update-docs-on-docs-commits.yml.github/workflows/update-maintainers.yml.github/workflows/update-pr.yml.github/workflows/welcome-first-time-contrib.yml
💤 Files with no reviewable changes (1)
- .github/workflows/manual-netlify-preview.yml
✅ Files skipped from review due to trivial changes (3)
- .github/workflows/update-pr.yml
- .github/workflows/please-take-a-look-command.yml
- .github/workflows/transfer-issue.yml
| DEPLOY_DIR="site/out" | ||
| [ -d "site/.next" ] && DEPLOY_DIR="site/.next" |
There was a problem hiding this comment.
Deploy dir precedence can publish the wrong artifact.
This currently prefers site/.next whenever it exists. If both site/out and site/.next are present, it can deploy a non-static build output and break docs preview.
Suggested patch
- DEPLOY_DIR="site/out"
- [ -d "site/.next" ] && DEPLOY_DIR="site/.next"
+ if [ -d "site/out" ]; then
+ DEPLOY_DIR="site/out"
+ elif [ -d "site/.next" ]; then
+ DEPLOY_DIR="site/.next"
+ else
+ echo "No deployable output found (expected site/out or site/.next)"
+ exit 1
+ fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| DEPLOY_DIR="site/out" | |
| [ -d "site/.next" ] && DEPLOY_DIR="site/.next" | |
| if [ -d "site/out" ]; then | |
| DEPLOY_DIR="site/out" | |
| elif [ -d "site/.next" ]; then | |
| DEPLOY_DIR="site/.next" | |
| else | |
| echo "No deployable output found (expected site/out or site/.next)" | |
| exit 1 | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/manual_netlify_preview.yml around lines 67 - 68, The
deployment directory precedence is wrong: change the logic that sets DEPLOY_DIR
so a static build (site/out) is preferred over site/.next; instead of defaulting
DEPLOY_DIR to site/.next when that directory exists, first check for site/out
and set DEPLOY_DIR="site/out" if present, otherwise fall back to site/.next.
Update the lines that currently set DEPLOY_DIR and the conditional [ -d
"site/.next" ] check so they reference the functions/variables DEPLOY_DIR and
the directories "site/out" and "site/.next" in that order.
| rm website/markdown/docs/tools/generator/README.md | ||
| rm -r website/markdown/docs/tools/generator/jsdoc2md-handlebars |
There was a problem hiding this comment.
Make docs cleanup resilient to missing files/directories.
rm here will fail when those paths are absent, which can unnecessarily fail the preview build. Use force flags for idempotent cleanup.
Suggested patch
- rm website/markdown/docs/tools/generator/README.md
- rm -r website/markdown/docs/tools/generator/jsdoc2md-handlebars
+ rm -f website/markdown/docs/tools/generator/README.md
+ rm -rf website/markdown/docs/tools/generator/jsdoc2md-handlebars📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| rm website/markdown/docs/tools/generator/README.md | |
| rm -r website/markdown/docs/tools/generator/jsdoc2md-handlebars | |
| rm -f website/markdown/docs/tools/generator/README.md | |
| rm -rf website/markdown/docs/tools/generator/jsdoc2md-handlebars |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/manual-netlify-build.yml around lines 33 - 34, Replace the
fragile rm commands in the workflow that remove README.md and the
jsdoc2md-handlebars directory with idempotent variants: use rm -f for the file
removal and rm -rf (or rm -rf for the directory) so the steps succeed even if
the targets are missing; update the two commands shown ("rm
website/markdown/docs/tools/generator/README.md" and "rm -r
website/markdown/docs/tools/generator/jsdoc2md-handlebars") to their
force/recursive-force equivalents to make the cleanup resilient.
|
|
||
| on: | ||
| pull_request_target: | ||
| pull_request: |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
For GitHub Actions triggered by pull_request from forks, are repository secrets available? Also, can GITHUB_TOKEN with pull-requests: write post PR comments in this context?
💡 Result:
Yes—when a workflow is triggered by pull_request from a fork, repository Actions secrets are not available to the workflow run; only the automatically-provided GITHUB_TOKEN is available, and it has reduced permissions by default in this context [1][2]. As for commenting on the PR: a workflow triggered by pull_request from a fork will get a GITHUB_TOKEN with write access limited by the fork security restrictions. In particular, GitHub documents that workflows triggered from a fork using the pull_request event have read-only permissions and have no access to secrets [2]. Therefore, you should not expect to be able to post PR comments using GITHUB_TOKEN with pull-requests: write in this exact forked pull_request context, even if you set permissions in the workflow—fork safety downgrades write permissions to read-only for pull request events from forks (except pull_request_target) [3][2]. If you need to comment, the typical safe approach is to use pull_request_target (runs in the base repo context and can access secrets / write token permissions) but it must be handled carefully because it executes in a more privileged context [2].
Citations:
- 1: https://github.com/github/docs/blob/main/content/code-security/reference/secret-security/understanding-github-secret-types.md
- 2: https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md
- 3: https://github.com/github/docs/blob/main/content/actions/concepts/security/compromised-runners.md
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/pr-review-checklist.yml"
echo "=== Lines 1-120 ==="
nl -ba "$FILE" | sed -n '1,120p'
echo
echo "=== Search for tokens/permissions ==="
rg -n "GH_TOKEN|GITHUB_TOKEN|pull_request_target|pull-requests: write|permissions:" "$FILE" || trueRepository: asyncapi/generator
Length of output: 143
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/pr-review-checklist.yml"
echo "=== Check file exists ==="
ls -la "$FILE"
echo
echo "=== Lines 1-140 ==="
awk '{printf "%6d:%s\n", NR, $0}' "$FILE" | sed -n '1,140p'
echo
echo "=== Search tokens/permissions ==="
rg -n "GH_TOKEN|GITHUB_TOKEN|pull_request_target|pull-requests: write|permissions:" "$FILE" || true
echo
echo "=== Search jobs/steps for comment posting ==="
rg -n "comment|issues\.createComment|pulls\.comments|octokit|actions/github-script|create-comment|rest\.issues|rest\.pulls" "$FILE" || trueRepository: asyncapi/generator
Length of output: 2148
Fix checklist posting for fork PRs (secrets token won’t be available).
The workflow runs on pull_request (line 4) but posts the comment using token: ${{ secrets.GH_TOKEN }} (line 30). For fork-origin PRs, repository secrets aren’t provided to pull_request runs, so this step can fail and the checklist won’t be posted for many external contributions. Use a fork-safe approach (typically pull_request_target, with careful handling of untrusted code) or split behavior so fork PRs don’t rely on repo secrets.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-review-checklist.yml at line 4, The workflow currently
triggers on pull_request and uses secrets.GH_TOKEN to post the checklist, which
fails for forked PRs; change the trigger to pull_request_target or split the
posting into a separate job that runs only for trusted contexts, and ensure any
steps that run untrusted PR code (e.g., actions/checkout of head ref or
test/build steps) are not executed under pull_request_target; specifically,
replace the trigger 'pull_request' with 'pull_request_target' or add logic to
run the checklist-posting step (the step that uses secrets.GH_TOKEN) only when
the event originates from the same repo or use a dedicated job that posts
comments while avoiding checking out PR code with elevated secrets.
| (github.actor == '46447321' && | ||
| startsWith(github.event.pull_request.title, 'docs: add') | ||
| ) |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify if 46447321 is a user ID and find the corresponding username
curl -s "https://api.github.com/user/46447321" | jq -r '.login // "User not found"'Repository: asyncapi/generator
Length of output: 83
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/pr-testing-with-test-project.yml"
echo "== File = $FILE =="
echo "== Lines 35-75 =="
nl -ba "$FILE" | sed -n '35,75p'
echo
echo "== Search for github.actor == "
rg -n "github\.actor" "$FILE" || true
echo
echo "== Search for pull_request\.user\.id or actor-id like fields =="
rg -n "pull_request\.(user|author)\.id|\.user\.id|actor.*id|github\.event\.pull_request\..*id" "$FILE" || trueRepository: asyncapi/generator
Length of output: 205
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/pr-testing-with-test-project.yml"
echo "== File = $FILE =="
echo "== Lines 35-75 =="
python3 - <<PY
from pathlib import Path
p=Path("$FILE")
lines=p.read_text().splitlines()
for i in range(35, min(76, len(lines)+1)):
print(f"{i:4d}: {lines[i-1]}")
PY
echo
echo "== Search for github.actor =="
rg -n "github\.actor" "$FILE" || true
echo
echo "== Search for pull_request.user.id/actor-id patterns =="
rg -n "pull_request\.(user|author)\.id|\.user\.id|actor.*id|github\.event\.pull_request\..*id" "$FILE" || trueRepository: asyncapi/generator
Length of output: 2482
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== GitHub API for /user/46447321 =="
curl -s "https://api.github.com/user/46447321" | jq '{id,login,html_url,type}'
echo
echo "== Search workflow for 46447321 / allcontributors =="
FILE=".github/workflows/pr-testing-with-test-project.yml"
rg -n "46447321|allcontributors" "$FILE" || trueRepository: asyncapi/generator
Length of output: 328
🌐 Web query:
What does GitHub Actions context variable github.actor contain (login/username vs user id)?
💡 Result:
In GitHub Actions, the context variable github.actor contains the username/login (a string handle), not the user’s numeric ID. [1][2] If you need the account’s numeric ID, use github.actor_id (account ID of the person or app that triggered the initial workflow run). [1]
Citations:
- 1: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts
- 2: https://github.com/github/docs/blob/main/content/actions/reference/workflows-and-actions/contexts.md
Fix github.actor == '46447321' condition (wrong context value).
github.actor is the actor login string, but 46447321 is a numeric account id (it maps to allcontributors[bot]). So this condition will never be true.
Use either github.actor == 'allcontributors[bot]' or github.actor_id == 46447321 at .github/workflows/pr-testing-with-test-project.yml lines 47-49.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-testing-with-test-project.yml around lines 47 - 49, The
condition currently compares github.actor to a numeric ID which will never
match; update the conditional expression in the workflow to either compare the
login string (github.actor == 'allcontributors[bot]') or use the numeric id
field (github.actor_id == 46447321) so the clause with
startsWith(github.event.pull_request.title, 'docs: add') can evaluate correctly;
modify the expression that references github.actor to use github.actor_id or
change the literal to 'allcontributors[bot]'.
| permissions: | ||
| issues: write # createComment on issues | ||
| pull_requests: write # createReview on PRs |
There was a problem hiding this comment.
Invalid permission scope: pull_requests should be pull-requests.
The permission scope pull_requests on line 21 is invalid. GitHub Actions permission scopes use hyphens, not underscores. The correct scope is pull-requests.
This will cause the workflow to either fail validation or lack the required permissions to create PR reviews.
Proposed fix
permissions:
issues: write # createComment on issues
- pull_requests: write # createReview on PRs
+ pull-requests: write # createReview on PRs📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| issues: write # createComment on issues | |
| pull_requests: write # createReview on PRs | |
| permissions: | |
| issues: write # createComment on issues | |
| pull-requests: write # createReview on PRs |
🧰 Tools
🪛 actionlint (1.7.12)
[error] 21-21: unknown permission scope "pull_requests". all available permission scopes are "actions", "artifact-metadata", "attestations", "checks", "contents", "deployments", "discussions", "id-token", "issues", "models", "packages", "pages", "pull-requests", "repository-projects", "security-events", "statuses"
(permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/welcome-first-time-contrib.yml around lines 19 - 21, The
workflow permissions use an invalid scope name 'pull_requests'; update the
permissions mapping to replace the 'pull_requests' key with the correct GitHub
Actions scope 'pull-requests' so the permissions block (the permissions: mapping
containing 'issues: write' and the erroneous 'pull_requests: write') uses
'pull-requests: write' to allow PR review actions.
|
There was a problem hiding this comment.
Pull request overview
This PR hardens GitHub Actions workflows by pinning many actions to commit SHAs, reducing default token permissions, and replacing the previous Netlify preview workflow with a split build/deploy workflow.
Changes:
- Pins many workflow actions to specific SHAs and adjusts checkout credential persistence.
- Adds deny-by-default workflow permissions with job-level scopes in several workflows.
- Replaces the Netlify docs preview workflow with separate pull request build and workflow-run deploy workflows.
Reviewed changes
Copilot reviewed 27 out of 27 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/add-good-first-issue-labels.yml |
Pins github-script. |
.github/workflows/automerge-for-humans-add-ready-to-merge-or-do-not-merge-label.yml |
Pins github-script steps. |
.github/workflows/automerge-for-humans-merging.yml |
Pins github-script steps. |
.github/workflows/automerge-for-humans-remove-ready-to-merge-label-on-edit.yml |
Pins github-script. |
.github/workflows/automerge-orphans.yml |
Pins checkout and github-script. |
.github/workflows/automerge.yml |
Pins github-script. |
.github/workflows/bounty-program-commands.yml |
Pins github-script steps. |
.github/workflows/bump.yml |
Adds default-deny permissions and pins checkout. |
.github/workflows/help-command.yml |
Pins github-script steps. |
.github/workflows/if-nodejs-pr-testing.yml |
Pins checkout, setup-node, and shared node-version action. |
.github/workflows/local-generate-files.yml |
Adds default-deny permissions, pins actions, and changes Slack notifier. |
.github/workflows/manual-netlify-preview.yml |
Removes the previous combined Netlify preview workflow. |
.github/workflows/manual-netlify-build.yml |
Adds pull request build workflow for docs preview artifacts. |
.github/workflows/manual_netlify_preview.yml |
Adds workflow-run deploy workflow for Netlify preview comments. |
.github/workflows/microgrant-program-commands.yml |
Pins github-script steps. |
.github/workflows/notify-tsc-members-mention.yml |
Pins checkout, setup-node, and github-script steps. |
.github/workflows/please-take-a-look-command.yml |
Pins github-script. |
.github/workflows/pr-review-checklist.yml |
Changes trigger and permissions while pinning checkout. |
.github/workflows/pr-testing-with-test-project.yml |
Adds reduced permissions and pins checkout/shared actions. |
.github/workflows/release-announcements.yml |
Pins checkout and github-script. |
.github/workflows/release-with-changesets.yml |
Adds reduced permissions, pins actions, and changes Slack notifier. |
.github/workflows/transfer-issue.yml |
Pins checkout and github-script. |
.github/workflows/update-docs-in-website.yml |
Hardens permissions, checkout credentials, and push behavior. |
.github/workflows/update-docs-on-docs-commits.yml |
Pins checkout, setup-node, and shared node-version action. |
.github/workflows/update-maintainers.yml |
Adds default-deny permissions, pins actions, updates Node, and hardens push flow. |
.github/workflows/update-pr.yml |
Pins github-script steps. |
.github/workflows/welcome-first-time-contrib.yml |
Adds job permissions and pins github-script. |
Comments suppressed due to low confidence (3)
.github/workflows/release-with-changesets.yml:85
- This switches to
rtCamp/action-slack-notifybut keeps the old8398a7/action-slackinputs andSLACK_WEBHOOK_URLvariable. The rtCamp action expects values such asSLACK_WEBHOOKandSLACK_MESSAGEinenv, so this failure notification will not be sent until the configuration is migrated to that action's interface.
uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
with:
status: ${{ job.status }}
fields: repo,action,workflow
text: "Release workflow failed in testing job"
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CI_FAIL_NOTIFY }}
.github/workflows/release-with-changesets.yml:153
- This failure notification was changed to
rtCamp/action-slack-notifybut still uses the old action'swithinputs andSLACK_WEBHOOK_URLenv name. Migrate these values to the rtCamp action's expected env variables, for exampleSLACK_WEBHOOKandSLACK_MESSAGE, otherwise release-job failures will not notify Slack.
uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
with:
status: ${{ job.status }}
fields: repo,action,workflow
text: "Release workflow failed in release job"
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CI_FAIL_NOTIFY }}
.github/workflows/local-generate-files.yml:58
- This action was migrated to
rtCamp/action-slack-notify, but the configuration is still for8398a7/action-slack(with.status,with.fields,with.text, andSLACK_WEBHOOK_URL). Use the rtCamp action's env-based configuration such asSLACK_WEBHOOKandSLACK_MESSAGE; otherwise release asset-generation failures will not produce Slack notifications.
uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
with:
status: ${{ job.status }}
fields: repo,action,workflow
text: 'Unable to bump the version in package.json after the release'
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CI_FAIL_NOTIFY }}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| runs-on: ubuntu-latest | ||
| permissions: | ||
| issues: write # createComment on issues | ||
| pull_requests: write # createReview on PRs |
| startsWith(github.event.pull_request.title, 'chore(release):') | ||
| )) || | ||
| (github.actor == 'allcontributors[bot]' && | ||
| (github.actor == '46447321' && |
|
|
||
| on: | ||
| pull_request_target: | ||
| pull_request: |
| # Pick whichever output directory the build produced. | ||
| DEPLOY_DIR="site/out" | ||
| [ -d "site/.next" ] && DEPLOY_DIR="site/.next" |
| @@ -52,10 +58,14 @@ jobs: | |||
| runs-on: ubuntu-latest | |||
Description
Pinned all unpinned actions to a commit SHA. The goal is to move from tag pinned to SHA pinned to avoid tag move compromised from affecting our org
The
manual_netlify_priview.ymlworkflow satisfied most of the requirements of apwn_requestso I split it into two which is Github best practices. chore: update build config #2091 (comment)Add a zizmor workflow which scans for common pipeline security issues such as:
harden
update-docs-in-website.ymlworkflowAdd
permissions: {}at workflow level with minimal job-level scopes(contents: write, pull-requests: write) to fix excessive-permissions (without this block, the workflow inherits the write-all permissions of the parent)
Set persist-credentials: false on the generator checkout since it is
read-only; keep it true on the website checkout for git push
Replace embedded-token push URL with git push origin HEAD to prevent
token exposure in logs and process listings (template-injection)
Move github.sha expansions into env vars to keep shell steps
injection-safe
Scope git config to the repository instead of --global
Related issue(s)
TBC
Summary by CodeRabbit
Chores
New Features