Add permission to coderabbit retry top workflow - #358
Conversation
WalkthroughThe Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
3 similar comments
|
@coderabbitai review |
|
@coderabbitai review |
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/coderabbit-retry.yml:
- Line 17: Update the reusable workflow reference in the coderabbit retry
configuration to pin it to the current full commit SHA instead of the mutable
`@main` branch. Preserve the existing workflow path and optionally add a version
comment.
- Line 18: Update the reusable workflow invocation around the secrets
configuration to remove secrets: inherit and pass only the explicit GitHub token
required by coderabbit-retry.yml, using the callee’s expected secret name.
Preserve the existing permissions and workflow behavior without forwarding
unrelated repository secrets.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 958b81fd-e916-42d9-bc09-60c562c74571
📒 Files selected for processing (1)
.github/workflows/coderabbit-retry.yml
📜 Review details
🧰 Additional context used
🪛 zizmor (1.26.1)
.github/workflows/coderabbit-retry.yml
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 15-15: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[warning] 17-17: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🔇 Additional comments (1)
.github/workflows/coderabbit-retry.yml (1)
14-16: LGTM!
| permissions: | ||
| pull-requests: write | ||
| contents: read | ||
| uses: chairemobilite/transition/.github/workflows/coderabbit-retry.yml@main |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repo files matching workflow =="
git ls-files | rg '(^|/)\.github/workflows/.*\.yml$' || true
echo "== target workflow excerpt =="
if [ -f .github/workflows/coderabbit-retry.yml ]; then
nl -ba .github/workflows/coderabbit-retry.yml | sed -n '1,80p'
else
echo "missing target"
fi
echo "== call references to same workflow =="
rg -n "coderabbit-retry\.yml|ch airmobilité/transition/.github/workflows/coderabbit-retry|chair e mobilite/transition/.github/workflows/coderabbit-retry|uses:\s*.*coderabbit-retry\.yml" .github workflows 2>/dev/null || true
echo "== git branch/tag availability =="
git remote -v || true
git branch -a | sed -n '1,40p' || true
git tag | sed -n '1,40p' || true
echo "== if gh is available, inspect target ref =="
if command -v gh >/dev/null 2>&1; then
gh auth status >/dev/null 2>&1 || true
gh api repos/chairemobilite/transition/git/refs/heads/main --jq '{ref, object}' 2>/dev/null || true
gh api repos/chairemobilite/transition/git/refs/tags/main --jq '{ref, object}' 2>/dev/null || true
else
echo "gh not available"
fiRepository: chairemobilite/trRouting
Length of output: 453
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== target workflow excerpt =="
awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/coderabbit-retry.yml | sed -n '1,80p'
echo "== call references to same workflow =="
rg -n "coderabbit-retry\.yml|ch airmobilité/transition/.github/workflows/coderabbit-retry|chair e mobilite/transition/.github/workflows/coderabbit-retry|uses:\s*.*coderabbit-retry\.yml" .github workflows 2>/dev/null || true
echo "== gh availability =="
command -v gh >/dev/null 2>&1 && echo "gh available" || echo "gh not available"
echo "== git branch/tag summary =="
git branch -a 2>/dev/null | sed -n '1,40p' || true
git tag 2>/dev/null | sed -n '1,40p' || true
echo "== repository refs for referenced workflow (if gh available) =="
if command -v gh >/dev/null 2>&1; then
gh api repos/chairemobilite/transition/git/refs/heads/main --jq '{ref, object: {sha, type}}' 2>/dev/null || true
gh api repos/chairemobilite/transition/git/refs/tags/main --jq '{ref, object: {sha, type}}' 2>/dev/null || true
fiRepository: chairemobilite/trRouting
Length of output: 1300
🌐 Web query:
GitHub Actions reusable workflows security best practices pin to SHA
💡 Result:
Pinning GitHub Actions and reusable workflows to a full-length commit SHA is a critical security best practice to prevent supply chain attacks where mutable tags (e.g., @v1, @main) are hijacked or compromised [1][2][3]. Why Pin to SHA Reference tags and branches are mutable pointers [2][3]. If an upstream repository is compromised or a maintainer forces a tag update, any workflow referencing that tag will automatically execute the new, potentially malicious code [2][3]. Pinning to a full 40-character commit SHA ensures the workflow remains immutable, meaning the code executed cannot be changed even if the upstream repository is altered [4][5]. Key Best Practices for Reusable Workflows 1. Pin Everything: You must pin not only the primary reusable workflow reference in your caller workflow but also every action or sub-workflow referenced internally within that reusable workflow [6][2][7]. Failing to pin internal references creates a "blind spot" where your callers inherit mutable dependencies they cannot control [6][7]. 2. Maintain Updateability: To keep receiving updates while maintaining immutability, pin to the SHA but include the human-readable version as a trailing comment (e.g., uses: owner/repo@sha123 # v1.2.3) [2][3]. Tools like Dependabot and Renovate are designed to recognize this pattern and will continue to suggest updates to new SHAs [2][3]. 3. Enable Organization Policies: Administrators can enforce this standard globally. GitHub offers an organization-level policy, "Require actions to be pinned to a full-length commit SHA," which causes any workflow using mutable tags to fail [6][4][8]. This is increasingly becoming a standard compliance requirement to prevent unauthorized code execution [7]. 4. Transitive Security: Because reusable workflows run in the caller's repository security context and have access to the caller's secrets, they effectively serve as a single point of compromise for all downstream consumers [6][2]. Always treat shared-workflow repositories with the same rigorous change control as production software [2]. Remediation If your workflows are not currently pinned: 1. Identify all uses: references in your workflows (including nested ones). 2. Resolve the current tag or branch reference to its corresponding 40-character commit SHA. 3. Update the uses: line to the SHA and append the version as a comment for maintainability [3]. 4. Consider using automated tools like Dependabot or Renovate to manage these pins moving forward [2][3].
Citations:
- 1: https://adaptive-enforcement-lab.com/secure/github-actions-security/workflows/reusable/caller-validation-pinning/
- 2: https://safeguard.sh/resources/blog/securing-github-actions-reusable-workflows-at-scale
- 3: https://starsling.dev/best-practices/github-actions/pin-action-shas
- 4: https://docs.github.com/en/actions/reference/security/secure-use
- 5: https://www.stepsecurity.io/blog/pinning-github-actions-for-enhanced-security-a-complete-guide
- 6: https://www.systemshardening.com/articles/cicd/github-actions-reusable-workflow-pinning-audit/
- 7: https://www.romainlespinasse.dev/posts/github-actions-commit-sha-pinning/
- 8: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
Pin the reusable workflow to a full commit SHA.
@main is a mutable branch reference, so the retried workflow could change without review while inheriting this repo’s permissions/secrets. Use the current full commit SHA for the uses: line and include a version comment if helpful.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 17-17: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/coderabbit-retry.yml at line 17, Update the reusable
workflow reference in the coderabbit retry configuration to pin it to the
current full commit SHA instead of the mutable `@main` branch. Preserve the
existing workflow path and optionally add a version comment.
Source: Linters/SAST tools
| pull-requests: write | ||
| contents: read | ||
| uses: chairemobilite/transition/.github/workflows/coderabbit-retry.yml@main | ||
| secrets: inherit |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate and inspect the reusable workflow and any references to it.
if [ -f .github/workflows/coderabbit-retry.yml ]; then
echo "=== workflow file ==="
cat -n .github/workflows/coderabbit-retry.yml
else
echo "Workflow file not found at .github/workflows/coderabbit-retry.yml"
fi
echo
echo "=== references/calls to reusable workflow ==="
rg -n "coderabbit-retry|code-rabbit|CodeRabbit|coderabbit" .github/workflows .github/coderabbit 2>/dev/null || true
echo
echo "=== available workflows ==="
git ls-files .github/workflows .github/coderabbit 2>/dev/null | sortRepository: chairemobilite/trRouting
Length of output: 1190
🌐 Web query:
GitHub Actions reusable workflows secrets inherit expose all secrets caller repository documentation
💡 Result:
In GitHub Actions, the secrets: inherit keyword allows a calling workflow to automatically pass all secrets available to it (including repository and organization secrets) to a directly called reusable workflow [1][2]. When you use secrets: inherit, you are effectively granting the reusable workflow access to the caller's entire secret store [3][4]. This behavior has significant security implications: 1. Exposure: The called workflow—and any actions or scripts contained within it—can access all secrets available to the caller, regardless of whether the reusable workflow actually requires them [3][4][5]. 2. Increased Blast Radius: If the reusable workflow is compromised (or if it is maintained by a third party or a different team), that compromise can result in the exfiltration of all secrets available to the calling workflow [3][4][5]. 3. Principle of Least Privilege: Security best practices and official guidance strongly recommend explicitly passing only the specific secrets required by the reusable workflow [3][4][5]. Explicitly naming secrets limits access to only what is necessary, reducing the potential impact of a security incident [3][5]. The inherit keyword is a convenience feature intended to simplify workflow configuration [6][4]. While it is technically functional, it is widely considered an anti-pattern for workflows that handle sensitive credentials (such as deployment keys or registry tokens) due to the risk of over-privileged access [3][4][5]. Tools like Semgrep and OpenRewrite provide rules specifically designed to detect and flag the use of secrets: inherit in order to encourage safer, explicit secret management [7][5].
Citations:
- 1: https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
- 2: https://github.com/github/docs/blob/main/content/actions/how-tos/reuse-automations/reuse-workflows.md
- 3: https://actsense.dev/vulnerabilities/secrets_inherit/
- 4: https://safeguard.sh/resources/blog/securing-github-actions-reusable-workflows-at-scale
- 5: Add GitHub Actions
secrets: inheritdetection rule semgrep/semgrep-rules#3803 - 6: https://github.blog/changelog/2022-05-03-github-actions-simplify-using-secrets-with-reusable-workflows/
- 7: https://docs.openrewrite.org/recipes/github/security/secretsinherit
🌐 Web query:
chairemobilite transition .github/workflows/coderabbit-retry.yml main secrets inputs
💡 Result:
There is no public GitHub repository at chairemobilite/transition that contains a file named.github/workflows/coderabbit-retry.yml. The chairemobilite/transition repository is a real project focused on public transit planning, but it does not appear to use the specific CodeRabbit retry workflow you mentioned [1]. The workflow file.github/workflows/coderabbit-retry.yml is a commonly used configuration associated with the third-party GitHub Action idrinth/coderabbit-retry-action, which is used by various unrelated repositories to automatically retry failed CodeRabbit reviews [2][3]. If you are looking to configure this workflow in a project, you typically define it in your repository's.github/workflows directory with inputs for things like dry-run mode, using the idrinth/coderabbit-retry-action: name: CodeRabbit Retry on: schedule: - cron: '0 * * * *' workflow_dispatch: inputs: dry-run: description: 'Dry run mode' type: boolean default: false jobs: retry: runs-on: ubuntu-latest steps: - name: Retry CodeRabbit Reviews uses: idrinth/coderabbit-retry-action@v1 with: github-token: ${{ secrets.GITHUB_TOKEN }} dry-run: ${{ inputs.dry-run || 'false' }} The secrets.GITHUB_TOKEN is automatically provided by GitHub Actions to authenticate the workflow [2].
Citations:
- 1: https://github.com/chairemobilite/transition
- 2: https://github.com/Idrinth/coderabbit-retry-action
- 3: https://github.com/ONEGAYI/sentaurus-syntax-highlight/blob/main/.github/workflows/coderabbit-retry.yml
🌐 Web query:
site:github.com/Idrinth/coderabbit-retry-action README secrets GITHUB_TOKEN
💡 Result:
You should never include GITHUB_TOKEN or any other sensitive secrets directly in a README file or any other file within your repository [1]. GITHUB_TOKEN is an automatically generated token that GitHub provides for use within GitHub Actions workflows to authenticate against your repository [1]. It is intended to be used exclusively within the context of a workflow file (usually YAML) to perform actions like pushing code or creating comments [1]. Because a README file is part of the repository's source code and is visible to anyone who has access to the repository, placing a token there would expose it to anyone, allowing them to use the token to perform unauthorized actions on your behalf [1]. If you need to provide instructions in a README on how to set up an action that requires a token, you should instruct users to generate their own personal access token or use their own secret and store it in their repository's secret settings, rather than sharing the token itself [1]. Correct usage in a GitHub Actions workflow file: - name: Example step uses: example/action@v1 with: github-token: ${{ secrets.GITHUB_TOKEN }} Never commit secrets to your repository. If you accidentally commit a GITHUB_TOKEN or another secret to a public repository, you should consider it compromised and revoke it immediately.
Citations:
Avoid inheriting secrets for this reusable workflow call.
secrets: inherit automatically passes the caller’s available secrets to chairemobilite/transition/.github/workflows/coderabbit-retry.yml, which only needs pull-requests: write, contents: read, and likely github-token: ${{ secrets.GITHUB_TOKEN }}. Pass only that explicit secret unless the callee’s contract actually requires repository secrets.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/coderabbit-retry.yml at line 18, Update the reusable
workflow invocation around the secrets configuration to remove secrets: inherit
and pass only the explicit GitHub token required by coderabbit-retry.yml, using
the callee’s expected secret name. Preserve the existing permissions and
workflow behavior without forwarding unrelated repository secrets.
Source: Linters/SAST tools
1 participant
Summary by CodeRabbit