fix: pin 4 unpinned action(s),extract 3 unsafe expression(s) to env vars#1106
fix: pin 4 unpinned action(s),extract 3 unsafe expression(s) to env vars#1106
Conversation
Automated security fixes applied by Runner Guard (https://github.com/Vigilant-LLC/runner-guard). Changes: .github/workflows/docker-publish.yml | 8 ++++---- .github/workflows/reset-credits.yml | 5 ++++- .github/workflows/spam-check.lock.yml | 6 ++++-- 3 files changed, 12 insertions(+), 7 deletions(-)
📝 WalkthroughWalkthroughGitHub Actions workflows were updated across three files: version tag references were replaced with commit-SHA references in the Docker publish workflow, the reset-credits workflow now uses environment variables for secret handling, and the spam-check workflow introduces explicit GitHub token environment variable management for Git operations. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/spam-check.lock.yml (1)
16-16:⚠️ Potential issue | 🟡 MinorAuto-generated file: Security fixes may be overwritten on regeneration.
This file is marked as auto-generated by
gh-awwith a "DO NOT EDIT" instruction. The security fixes applied in the compiled workflow (extracting${{ github.token }}expressions to env variables at lines 295-301 and 762-768) exist only in this.lock.ymlfile, not in the source.github/workflows/spam-check.mdspecification. When regenerated viagh aw compile, these fixes will be lost unless the gh-aw tool itself implements this security pattern.Either:
- Contribute the Runner Guard security pattern to the gh-aw tooling so all generated workflows include it by default
- Document this as a required post-generation security patching step with a script or checklist
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/spam-check.lock.yml at line 16, The generated workflow lock file contains ad-hoc security fixes (extraction of `${{ github.token }}` to env vars) that will be lost on regeneration by gh-aw; either update the gh-aw generator to implement the "Runner Guard" security pattern so compiled outputs always replace direct `${{ github.token }}` usages with environment variables (preserve this behavior in the gh-aw compile step), or add a post-generation step/script that patches the compiled spam-check.lock.yml (looking for `${{ github.token }}` occurrences in the compiled output) to move tokens into env variables and inject the necessary guard logic; ensure the fix is applied automatically after `gh-aw compile` so the security change is not overwritten.
🧹 Nitpick comments (1)
.github/workflows/docker-publish.yml (1)
48-48: Consider automating SHA refresh for pinned actions.With strict SHA pinning, updates can silently lag. Consider enabling Dependabot/Renovate for GitHub Actions so security patches are proposed automatically.
Also applies to: 51-51, 59-59, 69-69
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/docker-publish.yml at line 48, The workflow pins several actions by SHA (e.g., docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f and the other uses: entries at lines 51, 59, 69) which can silently fall behind; enable automated updates by adding Dependabot (or Renovate) for GitHub Actions (create a .github/dependabot.yml with package-ecosystem: "github-actions" and appropriate schedule) so PRs are opened to refresh those SHAs regularly, or alternatively switch to a stable tag/pinned major if automation is not desired.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In @.github/workflows/spam-check.lock.yml:
- Line 16: The generated workflow lock file contains ad-hoc security fixes
(extraction of `${{ github.token }}` to env vars) that will be lost on
regeneration by gh-aw; either update the gh-aw generator to implement the
"Runner Guard" security pattern so compiled outputs always replace direct `${{
github.token }}` usages with environment variables (preserve this behavior in
the gh-aw compile step), or add a post-generation step/script that patches the
compiled spam-check.lock.yml (looking for `${{ github.token }}` occurrences in
the compiled output) to move tokens into env variables and inject the necessary
guard logic; ensure the fix is applied automatically after `gh-aw compile` so
the security change is not overwritten.
---
Nitpick comments:
In @.github/workflows/docker-publish.yml:
- Line 48: The workflow pins several actions by SHA (e.g.,
docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f and the
other uses: entries at lines 51, 59, 69) which can silently fall behind; enable
automated updates by adding Dependabot (or Renovate) for GitHub Actions (create
a .github/dependabot.yml with package-ecosystem: "github-actions" and
appropriate schedule) so PRs are opened to refresh those SHAs regularly, or
alternatively switch to a stable tag/pinned major if automation is not desired.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7af08777-1172-443b-b293-4e77bccee0a8
📒 Files selected for processing (3)
.github/workflows/docker-publish.yml.github/workflows/reset-credits.yml.github/workflows/spam-check.lock.yml
|
Resubmitted as #1109. Had a problem with my fork, apologies for the noise. |
3 participants
Fix: CI/CD Security Vulnerabilities in GitHub Actions
Hi! Runner Guard, an open-source
CI/CD security scanner by Vigilant Cyber Security,
identified security vulnerabilities in this repository's GitHub Actions workflows.
This PR applies automated fixes where possible and reports additional findings
for your review.
Fixes applied (in this PR)
.github/workflows/docker-publish.yml.github/workflows/reset-credits.yml.github/workflows/spam-check.lock.ymlAdvisory: additional findings (manual review recommended)
| Rule | Severity | File | Description |
| RGS-012 | high |
.github/workflows/reset-credits.yml| Secret Exfiltration via Outbound HTTP Request |Why this matters
GitHub Actions workflows that use untrusted input in
run:blocks, exposesecrets inline, or use unpinned third-party actions are vulnerable to
code injection, credential theft, and supply chain attacks. These are the same
vulnerability classes exploited in the tj-actions/changed-files incident
and subsequent supply chain attacks, which compromised CI secrets across
thousands of repositories.
How to verify
Review the diff — each change is mechanical and preserves workflow behavior:
${{ }}expressions fromrun:blocks intoenv:mappings, preventing shell injection(original version tag preserved as comment)
ACTIONS_RUNNER_DEBUG/ACTIONS_STEP_DEBUGwhich leak secrets in workflow logs
Run
brew install Vigilant-LLC/tap/runner-guard && runner-guard scan .or install from therepo to verify.
Found by Runner Guard | Built by Vigilant Cyber Security | Learn more
If this PR is not welcome, just close it -- we won't send another.
Summary by CodeRabbit