ci: GitHub Actions workflow security cleanup#132
Conversation
Set persist-credentials: false on actions/checkout invocations so the default GITHUB_TOKEN is not persisted in the local git config after checkout. Workflow steps that need the token continue to use it via explicit env/secrets references.
Add an empty top-level permissions block and grant each job only the GITHUB_TOKEN scopes it actually needs. Most jobs only need contents: read for checkout; code-coverage additionally needs checks: write for the xcresulttool action; check-documentation retains its existing scopes for AWS OIDC and deployments; all-checks-completed needs none.
Replace direct ${{ ... }} expansions inside shell run blocks with env
bindings, then reference the resulting variables in the script. This
avoids interpolating workflow context straight into shell source where
a malicious value could be expanded before quoting takes effect.
|
Warning Review limit reached
More reviews will be available in 29 minutes and 49 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Routine hygiene pass over the GitHub Actions workflow in this repo, addressing findings from a workflow security audit. Changes are split into four commits, one per finding type:
actions/checkoutsteps so the defaultGITHUB_TOKENis not left in the local git config after checkout.permissions: {}, with each job granted only theGITHUB_TOKENscopes it actually needs.${{ matrix.platform }}, step outputs) out ofrun:shell source and intoenv:bindings.No behavioural changes intended — the workflow runs the same checks against the same inputs.