Removed internal workflows + updated pr-gitleaks.yml - #17
Conversation
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
WalkthroughThe PR replaces the reusable secret-scanning workflow with an inline Gitleaks job that collects changed files and scans full repository history. It also removes the PR lint script, PR lint workflow, and PR size-check workflow. ChangesSecurity workflow migration
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 1✅ Passed checks (1 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/pr-gitleaks.yml (2)
23-27: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin action references to full commit SHAs.
Both actions currently use mutable major tags. Pin verified release commits so this security workflow always executes reviewed code. GitHub recommends full-length SHA pinning for third-party actions. (docs.github.com)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-gitleaks.yml around lines 23 - 27, Update the actions/checkout and gitleaks/gitleaks-action references in the workflow to verified, full-length release commit SHAs instead of mutable major tags, preserving their existing configuration and execution order.
23-25: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDisable checkout credential persistence.
actions/checkoutpersists the token by default in local Git configuration, making it accessible to subsequent actions. Setpersist-credentials: false; retain the explicit token only where required. (github.com)Proposed hardening
- uses: actions/checkout@v4 with: fetch-depth: 0 + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-gitleaks.yml around lines 23 - 25, Update the actions/checkout step to set persist-credentials to false while retaining fetch-depth: 0; keep any explicit token configuration only in steps that require it.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-gitleaks.yml:
- Line 27: Update the Gitleaks workflow by changing the gitleaks/gitleaks-action
reference from `@v2` to `@v3` and the existing actions/checkout reference to `@v6`,
preserving the rest of the workflow configuration.
- Around line 7-10: Update the scan job permissions for the gitleaks workflow to
explicitly grant contents: read and pull-requests: write, allowing
gitleaks/gitleaks-action to post PR comments. If comments are intentionally
disabled instead, configure the action accordingly and retain read-only token
permissions.
---
Nitpick comments:
In @.github/workflows/pr-gitleaks.yml:
- Around line 23-27: Update the actions/checkout and gitleaks/gitleaks-action
references in the workflow to verified, full-length release commit SHAs instead
of mutable major tags, preserving their existing configuration and execution
order.
- Around line 23-25: Update the actions/checkout step to set persist-credentials
to false while retaining fetch-depth: 0; keep any explicit token configuration
only in steps that require it.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 7044f385-b017-498a-ace4-91a57a819239
📒 Files selected for processing (4)
.github/workflows/pr-gitleaks.yml.github/workflows/pr-lint.js.github/workflows/pr-lint.yml.github/workflows/pr-size-check.yml
💤 Files with no reviewable changes (3)
- .github/workflows/pr-lint.yml
- .github/workflows/pr-lint.js
- .github/workflows/pr-size-check.yml
2 participants
CHANGELOG
REPLACE_ME_WITH_CHANGELOG
SUMMARY
REPLACE_ME_WITH_SUMMARY_OF_THE_CHANGES
FUNCTIONAL AUTOMATION CHANGES PR
AUTOMATION TEST REPORT URL
REPLACE_ME_WITH_TEST_REPORT_URL
AREAS OF IMPACT
REPLACE_ME_WITH_AREAS_OF_IMPACT_OR_NA
TYPE OF CHANGE
DOCUMENTATION
REPLACE_ME_WITH_DOCUMENTATION_LINK_OR_NA
Updated PR secret scanning to use an inline Gitleaks workflow that scans changed files. Removed internal PR linting and PR size-check workflows, including the associated Danger configuration and bypass handling.