Skip to content

pin GitHub Actions #100

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shogo82148 merged 1 commit into from
Jul 31, 2026
Merged

pin GitHub Actions #100

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/codeql-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
# We must fetch at least the immediate parents so that if this is
# a pull request then we can checkout the head.
Expand All @@ -43,7 +43,7 @@ jobs:

# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v4
uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
Expand All @@ -54,7 +54,7 @@ jobs:
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
uses: github/codeql-action/autobuild@v4
uses: github/codeql-action/autobuild@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4

# ℹ️ Command-line programs to run using the OS shell.
# 📚 https://git.io/JvXDl
Expand All @@ -68,4 +68,4 @@ jobs:
# make release

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4
uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
12 changes: 6 additions & 6 deletions .github/workflows/fuzz.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,12 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@v7
- uses: actions/setup-go@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

@coderabbitai coderabbitai Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/fuzz.yml
printf '%s\n' '--- checkout and token references ---'
rg -n -C 3 'actions/checkout|persist-credentials|github.token|token:|git ' .github/workflows/fuzz.yml
printf '%s\n' '--- repository references to fuzz action ---'
rg -n -C 3 'go-fuzz|fuzz' .github/workflows/fuzz.yml

Repository: shogo82148/androidbinary

Length of output: 3378

🏁 Script executed:

#!/bin/bash
set -eu
python3 - <<'PY'
import json
import urllib.request

urls = {
    "run_action_yml": "https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/action.yml",
    "list_action_yml": "https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/list/action.yml",
    "checkout_action_yml": "https://raw.githubusercontent.com/actions/checkout/3d3c42e5aac5ba805825da76410c181273ba90b1/action.yml",
}
for name, url in urls.items():
    print(f"--- {name}: {url} ---")
    try:
        with urllib.request.urlopen(url, timeout=15) as response:
            print(response.read().decode("utf-8", "replace"))
    except Exception as exc:
        print(f"ERROR: {exc}")
PY

Repository: shogo82148/androidbinary

Length of output: 1000

🌐 Web query:

actions/checkout persist-credentials false documentation token local git config

💡 Result:

In GitHub Actions, the actions/checkout action uses the persist-credentials input to control how the repository's authentication token is handled during the job [1][2]. When persist-credentials is set to its default value of true, the action configures Git to use the authentication token for subsequent Git commands within that workflow job [1][3]. Historically, this meant the token was stored directly in the local Git configuration (.git/config) [4][5]. However, starting in version v6.0.0, actions/checkout improved security by storing these credentials in a separate file under $RUNNER_TEMP rather than directly in the local .git/config [5][6]. This change reduces the risk of accidental exposure, such as through artifact publishing or repository copies [7]. The token is removed during post-job cleanup [1][4]. When you set persist-credentials: false, the action opts out of this automatic configuration [1][2]. This means the authentication token is not persisted to the local Git configuration or any temporary file, effectively preventing subsequent Git commands in the same job from using that specific token automatically [1][4]. Use this setting if your workflow does not require authenticated Git operations after the initial checkout, or if you prefer to manage Git authentication manually for security reasons [8][7].

Citations:

🏁 Script executed:

#!/bin/bash
set -eu
python3 - <<'PY'
import urllib.request

urls = {
    "run_action_yml": "https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/action.yml",
    "list_action_yml": "https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/list/action.yml",
    "checkout_action_yml": "https://raw.githubusercontent.com/actions/checkout/3d3c42e5aac5ba805825da76410c181273ba90b1/action.yml",
}
for name, url in urls.items():
    print(f"--- {name} ---")
    try:
        with urllib.request.urlopen(url, timeout=15) as response:
            print(response.read().decode("utf-8", "replace"))
    except Exception as exc:
        print(f"ERROR: {exc}")
PY

Repository: shogo82148/androidbinary

Length of output: 663

🏁 Script executed:

#!/bin/bash
set -eu
for spec in \
  "run_action_yml|https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/action.yml" \
  "list_action_yml|https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/list/action.yml" \
  "checkout_action_yml|https://raw.githubusercontent.com/actions/checkout/3d3c42e5aac5ba805825da76410c181273ba90b1/action.yml"
do
  name=${spec%%|*}
  url=${spec#*|}
  printf '%s\n' "--- $name ---"
  curl --fail --silent --show-error --location --insecure "$url"
  printf '\n'
done

Repository: shogo82148/androidbinary

Length of output: 6534

🌐 Web query:

site:github.com/shogo82148/actions-go-fuzz "token" "action.yml"

💡 Result:

In GitHub Actions, action.yml is a mandatory configuration file used to define metadata for a custom action [1]. It specifies the action's inputs, outputs, and execution instructions, allowing the action to be used in workflow files [1]. While there is no specific field in the action.yml schema exclusively named token, action authors frequently define an input named token to accept authentication credentials [2]. This allows users of the action to pass a GitHub token—such as the default GITHUB_TOKEN provided by the environment—into the action [2]. A typical example of defining such an input in an action.yml file looks like this: inputs: token: description: "The GitHub token for the repository" required: false default: ${{ github.token }} By convention, this input is often configured to default to the standard GitHub Actions token, which enables the action to perform authorized operations within the repository [2].

Citations:

🏁 Script executed:

#!/bin/bash
set -eu
for spec in \
  "run_dist|https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/dist/index.js" \
  "list_dist|https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/dist/list.js"
do
  name=${spec%%|*}
  url=${spec#*|}
  printf '%s\n' "--- $name ---"
  content=$(curl --fail --silent --show-error --location --insecure "$url")
  printf '%s\n' "$content" | rg -n -i -C 2 'git|credential|token|github|exec|spawn|go test|go list' || true
  printf '%s\n' "--- $name size ---"
  printf '%s' "$content" | wc -c
done

Repository: shogo82148/androidbinary

Length of output: 281

🏁 Script executed:

#!/bin/bash
set -eu
url='https://raw.githubusercontent.com/shogo82148/actions-go-fuzz/7887fe2495518ecf2504c6ebdede1764dec11018/dist/index.js'
curl -k -L --fail --silent --show-error "$url" -o /tmp/actions-go-fuzz-index.js
printf '%s\n' '--- references ---'
rg -n -i -C 2 'git|credential|token|github|exec|spawn|go test|go list' /tmp/actions-go-fuzz-index.js || true
printf '%s\n' '--- size ---'
wc -c /tmp/actions-go-fuzz-index.js

Repository: shogo82148/androidbinary

Length of output: 264

Disable checkout credential persistence in both fuzz jobs.

Set persist-credentials: false on both actions/checkout steps. Neither job performs an authenticated Git operation, and the jobs grant write permissions. This prevents subsequent actions and repository code from using the checkout credential.

🧰 Tools
🪛 zizmor (1.28.0)

[warning] 16-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/fuzz.yml at line 16, Update both actions/checkout steps in
the fuzz jobs to set persist-credentials to false. Keep the existing checkout
references and job behavior unchanged while ensuring neither checkout leaves
credentials available to subsequent steps.

Source: Linters/SAST tools

- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: "stable"
- id: list
uses: shogo82148/actions-go-fuzz/list@v1
uses: shogo82148/actions-go-fuzz/list@7887fe2495518ecf2504c6ebdede1764dec11018 # v1.2.3
outputs:
fuzz-tests: ${{steps.list.outputs.fuzz-tests}}

Expand All @@ -31,11 +31,11 @@ jobs:
matrix:
include: ${{fromJson(needs.list.outputs.fuzz-tests)}}
steps:
- uses: actions/checkout@v7
- uses: actions/setup-go@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: "stable"
- uses: shogo82148/actions-go-fuzz/run@v1
- uses: shogo82148/actions-go-fuzz/run@7887fe2495518ecf2504c6ebdede1764dec11018 # v1.2.3
with:
packages: ${{ matrix.package }}
fuzz-regexp: ${{ matrix.func }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/go.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,10 +20,10 @@ jobs:

steps:
- name: Check out code into the Go module directory
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Set up Go ${{ matrix.go }}
uses: actions/setup-go@v7
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: ${{ matrix.go }}

Expand Down
Loading