ci(sec): publish.yml actions 全部 SHA 固定到 node24#4
Conversation
将 publish.yml 中四个 Actions 从浮动大版本 tag 固定到 node24 全 commit SHA： [email protected]、[email protected]、SpraxDev/[email protected]、[email protected]。 对齐 ci-workflows 在 CVE-2025-30066 后的全 SHA 固定姿态。with 输入保持不变。 Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
📝 WalkthroughWalkthroughThe publish workflow pins four third-party GitHub Actions to specific commit SHAs instead of floating tag references. This hardens the workflow against unexpected upstream changes while maintaining identical input configuration for each action. ChangesWorkflow Actions Pinning
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 22-24: The checkout step in publish.yml uses actions/checkout (the
job step with "uses: actions/checkout@93cb6efe18208431c...") but only sets
fetch-depth: 0; add the option persist-credentials: false to that checkout step
to prevent the GITHUB_TOKEN from being written to local git config and persisted
for later steps (modify the actions/checkout step to include
persist-credentials: false alongside fetch-depth: 0).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2d5f2f43-c6a9-40ff-8509-14288f9f5aa6
📒 Files selected for processing (1)
.github/workflows/publish.yml
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | ||
| with: | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify checkout hardening across workflows (read-only)
rg -n --iglob '.github/workflows/*.yml' 'uses:\s*actions/checkout@' -A6 -B1Repository: UltiKits/UltiBot
Length of output: 209
Harden actions/checkout by disabling credential persistence in publish.yml.
The checkout step only sets fetch-depth: 0; add persist-credentials: false to prevent the GitHub token from being persisted in local git config for later steps.
Suggested patch
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
with:
fetch-depth: 0
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 22-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish.yml around lines 22 - 24, The checkout step in
publish.yml uses actions/checkout (the job step with "uses:
actions/checkout@93cb6efe18208431c...") but only sets fetch-depth: 0; add the
option persist-credentials: false to that checkout step to prevent the
GITHUB_TOKEN from being written to local git config and persisted for later
steps (modify the actions/checkout step to include persist-credentials: false
alongside fetch-depth: 0).
1 participant
把 publish.yml 里那四个 Actions 都从浮动 tag 改成了完整 commit SHA 固定，跟之前 ci-workflows 那边一样的做法，CVE-2025-30066 那次浮动 tag 被投毒的事之后就该全 SHA 了。
四个改动：
四个 SHA 都已经核对过对应的 tag、并且 action.yml 都是 using: node24。只动了 uses: 这四行，with: 输入（fetch-depth、java 21、versions 1.21.1 remapped、node 20）全都没碰。
publish.yml 是 push-to-master + workflow_dispatch 触发的，PR 不会跑它，所以这个 PR 上只有 maven-ci.yml 会跑（走 ci-workflows@v1），用来证明仓库还能正常构建。
Summary by CodeRabbit