CI: update GitHub Actions and add zizmor workflow scan#13
Merged
Conversation
- Upgrade checkout and setup-java to current major versions (Node 24 runtime) - Switch JDK distribution from adopt to temurin for setup-java v5 - Set explicit minimal permissions on the Maven workflow job - Add zizmor static analysis for workflow configuration issues (annotations, no Advanced Security upload) Co-authored-by: Mike Houston <mike@kothar.net>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughUpdated Maven CI workflow: upgraded Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
- Pinned action avoids ambiguous v5 resolution; v5 uses cache client compatible with GitHub cache API (fixes 400 from v2). - actions: write is required to save/restore caches when workflow permissions are restricted. Co-authored-by: Mike Houston <mike@kothar.net>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/maven.yml:
- Around line 21-23: Replace the mutable tags for the two GitHub Actions with
their corresponding full 40-character commit SHAs: update the uses entries that
reference actions/checkout@v6 and actions/setup-java@v5 to
actions/checkout@<full-commit-sha> and actions/setup-java@<full-commit-sha>
respectively (obtain the exact SHAs from each action's GitHub repo/releases) so
both actions are pinned to immutable SHAs; ensure the SHAs are full 40-character
values and keep the rest of the workflow unchanged.
- Line 21: The checkout step currently uses "uses: actions/checkout@v6" without
disabling credential persistence; update that checkout step to include
persist-credentials: false so the action does not leave GITHUB_TOKEN in the
workspace for this read-only build workflow, ensuring least-privilege for the
workflow.
In @.github/workflows/zizmor.yml:
- Around line 21-27: Replace the mutable GitHub Action tags with immutable full
40-character commit SHAs: update the actions/checkout@v6 reference to
actions/checkout@<full-commit-sha> and update zizmorcore/zizmor-action@v0.5.2 to
zizmorcore/zizmor-action@<full-commit-sha>; locate the two uses of
actions/checkout and zizmorcore/zizmor-action in the workflow and substitute the
tag versions with their respective pinned commit SHAs (ensure each SHA is the
exact 40-character commit hash from the action's repository).
🪄 Autofix (Beta)
❌ Autofix failed (check again to retry)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 271b65a7-a4ec-4ed4-b2aa-75f76ec8f701
📒 Files selected for processing (2)
.github/workflows/maven.yml.github/workflows/zizmor.yml
There was a problem hiding this comment.
♻️ Duplicate comments (2)
.github/workflows/maven.yml (2)
23-23:⚠️ Potential issue | 🟠 MajorDisable checkout credential persistence for this build job.
For this read-only build flow, add
persist-credentials: falseon checkout to reduce token exposure surface in subsequent steps/artifacts.Suggested change
- - uses: actions/checkout@v6 + - uses: actions/checkout@v6 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/maven.yml at line 23, The checkout step currently uses "uses: actions/checkout@v6" without disabling credential persistence; update the checkout step to include "persist-credentials: false" so the Actions token is not persisted to later steps/artifacts—locate the checkout step (uses: actions/checkout@v6) in the workflow and add the persist-credentials: false input under that step.
23-25:⚠️ Potential issue | 🔴 CriticalPin action references to full 40-char SHAs (still unresolved).
Both
actions/checkout@v6andactions/setup-java@v5.2.0are mutable tags and still violate the unpinned-actions policy.Suggested change
- - uses: actions/checkout@v6 + - uses: actions/checkout@<FULL_40_CHAR_SHA> # v6.x @@ - uses: actions/setup-java@v5.2.0 + uses: actions/setup-java@<FULL_40_CHAR_SHA> # v5.2.0Find the full 40-character commit SHAs currently pointed to by: 1) actions/checkout tag v6 (or exact v6.x used) 2) actions/setup-java tag v5.2.0 Use official GitHub release/tag pages only.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/maven.yml around lines 23 - 25, The workflow is using mutable tags actions/checkout@v6 and actions/setup-java@v5.2.0 which violate the unpinned-actions policy; replace each tag with its corresponding full 40-character commit SHA from the official GitHub release/tag pages (lookup the v6 reference for actions/checkout and v5.2.0 for actions/setup-java on their GitHub repos and copy the exact commit SHA), and update the uses lines to actions/checkout@<full-sha> and actions/setup-java@<full-sha> so the workflow references immutable commits; after updating, verify the SHAs by re-checking the official tag pages to ensure they match.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In @.github/workflows/maven.yml:
- Line 23: The checkout step currently uses "uses: actions/checkout@v6" without
disabling credential persistence; update the checkout step to include
"persist-credentials: false" so the Actions token is not persisted to later
steps/artifacts—locate the checkout step (uses: actions/checkout@v6) in the
workflow and add the persist-credentials: false input under that step.
- Around line 23-25: The workflow is using mutable tags actions/checkout@v6 and
actions/setup-java@v5.2.0 which violate the unpinned-actions policy; replace
each tag with its corresponding full 40-character commit SHA from the official
GitHub release/tag pages (lookup the v6 reference for actions/checkout and
v5.2.0 for actions/setup-java on their GitHub repos and copy the exact commit
SHA), and update the uses lines to actions/checkout@<full-sha> and
actions/setup-java@<full-sha> so the workflow references immutable commits;
after updating, verify the SHAs by re-checking the official tag pages to ensure
they match.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9981e64e-8f25-45ab-85f8-963d95fbe782
📒 Files selected for processing (1)
.github/workflows/maven.yml
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. An unexpected error occurred while generating fixes: Resource not accessible by integration - https://docs.github.com/rest/git/trees#create-a-tree |
…stence - actions/checkout and setup-java/zizmor-action use immutable commit pins - Maven job checkout sets persist-credentials: false (zizmor already had it) Co-authored-by: Mike Houston <mike@kothar.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
actions/checkoutandactions/setup-javaso runners use a supported Node runtime and Maven caching uses a cache client compatible with GitHub’s API (fixes "Cache service responded with 400" with oldsetup-java; see actions/setup-java#902).actions/checkoutv6.0.2,actions/setup-javav5.2.0,zizmorcore/zizmor-actionv0.5.2) with version comments.persist-credentials: false(zizmor job already had it). Job permissions:contents: read,actions: writefor Maven cache with restricted top-levelpermissions.advanced-security: falseandannotations: true.Testing
Summary by CodeRabbit