ci(supply-chain): pin actions to SHAs + Dependabot + zizmor audit#36
Merged
Conversation
- Pin third-party actions to full commit SHAs (with a `# vX.Y.Z` comment) in
ci.yml and cli-pr-review.yml so a moved/compromised tag can't change what runs:
actions/checkout -> de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
oven-sh/setup-bun -> 0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
anthropics/claude-code-action -> 787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
(Latest release within each current major — no major upgrades.)
- Add .github/dependabot.yml (github-actions ecosystem, weekly, grouped) so the
pinned SHAs get bumped automatically.
- Add .github/workflows/zizmor.yml: static security audit of the workflows on
pull_request + push to main. Non-blocking (step continue-on-error) because it
surfaces pre-existing/by-design items; findings go to the run summary.
📝 WalkthroughWalkthroughThis PR adds a Dependabot config for GitHub Actions, pins external action references to specific commit SHAs across CI and PR-review workflows, and adds a Zizmor workflow that runs non-blocking static audits on workflow files and publishes findings. ChangesGitHub Actions Configuration & Security
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/cli-pr-review.yml (1)
30-34:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRemove
github.actorfrom thepull_requestallowlist incli-pr-review.yml.
jobs.reviewhas write-scoped permissions (contents/pull-requests/issues/id-token), but the Scenario A/C gate allowspull_requestruns whengithub.actor == 'cursor[bot]'(line 33).github.actoris not a reliable, non-malleable identity for authorization; the gate should rely only on immutable PR metadata (e.g.,github.event.pull_request.user.login == 'cursor[bot]') and drop thegithub.actorclause.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cli-pr-review.yml around lines 30 - 34, Update the pull_request allowlist condition in the workflow to remove the mutable actor check: delete the `github.actor == 'cursor[bot]'` clause and keep only the immutable PR author check (`github.event.pull_request.user.login == 'cursor[bot]'`) so the gate relies solely on PR metadata; adjust the conditional expression around the existing OR group to ensure syntax remains valid after removing the `github.actor` clause.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/zizmor.yml:
- Line 40: The pipx invocation uses an unpinned package name ("pipx run zizmor
--persona=regular ..."), which allows floating versions; change the command to
pin zizmor to an explicit version by using the equality specifier (e.g., pipx
run "zizmor==X.Y.Z" --persona=regular .github/workflows/) so the workflow
installs a reproducible, fixed release of the zizmor tool.
---
Outside diff comments:
In @.github/workflows/cli-pr-review.yml:
- Around line 30-34: Update the pull_request allowlist condition in the workflow
to remove the mutable actor check: delete the `github.actor == 'cursor[bot]'`
clause and keep only the immutable PR author check
(`github.event.pull_request.user.login == 'cursor[bot]'`) so the gate relies
solely on PR metadata; adjust the conditional expression around the existing OR
group to ensure syntax remains valid after removing the `github.actor` clause.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: c00ac43f-f149-4826-b03f-84df45db4ba5
📒 Files selected for processing (4)
.github/dependabot.yml.github/workflows/ci.yml.github/workflows/cli-pr-review.yml.github/workflows/zizmor.yml
…r gate - zizmor.yml: pin the auditor to `zizmor==1.25.2` in the `pipx run` invocation for reproducible, supply-chain-stable audits (CodeRabbit, zizmor.yml:40). - cli-pr-review.yml: drop the `github.actor == 'cursor[bot]'` clause from the pull_request gate; `github.actor` is mutable/spoofable. The immutable `github.event.pull_request.user.login == 'cursor[bot]'` author check already covers every real Scenario A/C trigger. Clears zizmor's bot-conditions error and CodeRabbit's Major finding.
Member
Author
|
Addressed both CodeRabbit findings in 61c9420:
|
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/cli-pr-review.yml (1)
129-140:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDisable persisted checkout credentials in both paths.
Both
actions/checkoutsteps keep the defaultpersist-credentials: true, which leaves the job token in.git/configfor the rest of the run. In this workflow the checked-out workspace is later handed to a third-party action, so this unnecessarily widens the blast radius if the workspace is ever exfiltrated or artifacted. Setpersist-credentials: falsehere, then add git auth only in the narrow Scenario B push path that actually needs it.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cli-pr-review.yml around lines 129 - 140, The two actions/checkout steps (the step named "Checkout PR branch (pull_request / pull_request_review events)" and the step named "Checkout default branch then PR branch (issue_comment)") keep persist-credentials enabled; change both to set persist-credentials: false to avoid leaving the job token in .git/config, and then ensure you only add transient git authentication in the narrow Scenario B push path that requires pushing (add auth there instead of globally).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/cli-pr-review.yml:
- Around line 129-140: The two actions/checkout steps (the step named "Checkout
PR branch (pull_request / pull_request_review events)" and the step named
"Checkout default branch then PR branch (issue_comment)") keep
persist-credentials enabled; change both to set persist-credentials: false to
avoid leaving the job token in .git/config, and then ensure you only add
transient git authentication in the narrow Scenario B push path that requires
pushing (add auth there instead of globally).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 1c67d1a8-783a-4c7e-8c51-663477a395a5
📒 Files selected for processing (2)
.github/workflows/cli-pr-review.yml.github/workflows/zizmor.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/zizmor.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Supply-chain hardening for the agent-flow CI. No application source (
src/**) touched.Pin third-party actions to full commit SHAs (with a trailing
# vX.Y.Zcomment) inci.ymlandcli-pr-review.yml, so a moved or compromised mutable tag cannot change what executes. Pinned to the latest release within each current major (no major upgrades):actions/checkoutde0fac2e4500dabe0009e67214ff5f5447ce83ddv6.0.2oven-sh/setup-bun0c5077e51419868618aeaa5fe8019c62421857d6v2.2.0anthropics/claude-code-action787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251v1.0.133SHAs resolved via
gh api repos/<owner>/<repo>/commits/<tag> --jq .sha. Nopeter-evans/*actions are used anywhere..github/dependabot.yml—github-actionsecosystem, weekly, grouped into one PR,cicommit prefix,agent-flowlabel. Keeps the pinned SHAs (and their# vX.Y.Zcomments) current automatically..github/workflows/zizmor.yml— static security audit (zizmor v1.25.2) of the workflows onpull_request+push: [main]. Runs viapipx run zizmor(preinstalled on the runner — no extra third-party action). Non-blocking: the audit step iscontinue-on-error: trueand findings are written to the run summary, because zizmor flags several pre-existing/by-design items. Triage below.zizmor findings (for triage — all currently non-blocking)
In-scope files hardened by this work:
cli-pr-review.yml: notemplate-injectionfindings — PR ci: harden agent review workflow against prompt injection + bound the loop #35 already moved untrusted webhook bodies toenv:, which cleared them. Remaining:bot-conditions(thegithub.actor == 'cursor[bot]'check at line 33 is "spoofable" — by design, it's one branch of a multi-condition gate) and 2×artipacked(help-level; the steward intentionally keeps checkout credentials so Scenario B can push fixes — must NOT setpersist-credentials: falsehere).ci.yml: 3×artipacked(help-level;actions/checkoutwithoutpersist-credentials: false). Safe to set false here later (these jobs never push); left as a follow-up to keep this PR focused.Out-of-scope (pre-existing, in the release workflows — not modified here):
release-binaries.yaml:dangerous-triggers(workflow_run),excessive-permissions,unpinned-uses(checkout/setup-bun on@v6/@v2), severaltemplate-injectionin the Homebrew-formulasedsteps.release.yaml:unpinned-uses+secrets-inheriton thephoton-hq/buildspace/...@mainreusable workflow.These can be addressed in a dedicated follow-up; Dependabot will also start proposing pins/bumps for the action refs it understands.
Test plan
ci.ymlchecks (typecheck,test,build,deps-policy,snapshot-policy,smoke) pass with the pinned SHAs.zizmor (advisory)check runs and stays green (non-blocking) with findings in its summary.reviewworkflow showsskipping(human-authored PR).Made with Cursor
Need help on this PR? Tag
@codesmithwith what you need. Autofix is disabled.Summary by CodeRabbit