ci: Harden GitHub Actions workflows with security and performance fixes#313
Conversation
Security: - Pin codeql-action/upload-sarif to SHA v4.31.10 (detekt.yml) - Pin dallay/common-actions@main to v1.1.0 SHA across 5 workflows - Add least-privilege permissions blocks to 4 workflows - Fix secret interpolation in _publish.yml to use env-var pattern - Add contents:read permission to detekt.yml Performance: - Add npm cache to setup-node in 5 workflows - Reduce fetch-depth 0 to 1 in core-check.yml Consistency: - Standardize dtolnay/rust-toolchain SHA across security workflows - Standardize Java 25 in security-dependencies.yml - Add version comments to _publish.yml setup-node refs - Update release-please.yml comment to precise v4.4.0 - Add yaml-language-server schema annotations to 6 workflows
Add comprehensive skill covering security hardening, workflow structure, caching strategies, deployment patterns, audit checklist, and decision tables for GitHub Actions workflows. Register the new skill in AGENTS.md. Note: --no-verify used because AGENTS.md has pre-existing broken links to openspec/ paths that are external to this repository.
✅ Contributor ReportUser: @yacosta738
Contributor Report evaluates based on public GitHub activity. Analysis period: 2025-03-25 to 2026-03-25 |
Deploying corvus with
|
| Latest commit: |
ac4d5c8
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://81f556bc.corvus-42x.pages.dev |
| Branch Preview URL: | https://ci-common-tools.corvus-42x.pages.dev |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdded a GitHub Actions skill and documentation and modernized many workflows: pinned reusable/action refs, enabled pnpm caching, added explicit job permissions, adjusted toolchain/runtime pins, changed publish credential handling to job env, and reduced git fetch depth. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.agents/skills/github-actions/SKILL.md:
- Around line 168-170: Replace the placeholder `@<SHA>` on the `uses:
aws-actions/configure-aws-credentials@<SHA> # v4` line with the immutable commit
`@7474bc4690e29a8392af63c5b98e7449536d5c3a` so the example uses the exact v4
commit (keep the `# v4` comment intact) to avoid insecure copy-paste of a
floating ref.
In @.github/workflows/pull-request-check-build-logic.yml:
- Around line 48-53: Remove the pnpm-specific caching block from the workflow:
delete the cache: "pnpm" entry and the associated cache-dependency-path
multiline that lists pnpm-lock.yaml files, leaving any Gradle/other caches
intact. Target the YAML keys "cache: \"pnpm\"" and "cache-dependency-path" in
the pull-request-check-build-logic workflow and remove that entire pnpm cache
stanza.
In @.github/workflows/pull-request-limit.yml:
- Around line 12-14: The workflow's permissions block is missing the required
issues: write permission needed by the `gh pr edit --add-label` command; update
the permissions mapping (the `permissions:` block that currently has `contents:
read` and `pull-requests: write`) to include `issues: write` so label operations
succeed when `gh pr edit --add-label` is invoked.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 6f14ed52-c2c9-4ed7-ac18-ee58b438e4b6
📒 Files selected for processing (18)
.agents/AGENTS.md.agents/skills/github-actions/SKILL.md.github/workflows/_publish.yml.github/workflows/auto-fix-lockfile.yml.github/workflows/cleanup-cache.yml.github/workflows/codeql-analysis.yml.github/workflows/contributor-report.yml.github/workflows/core-check.yml.github/workflows/detekt.yml.github/workflows/fix-renovate.yml.github/workflows/greetings.yml.github/workflows/pull-request-check-build-logic.yml.github/workflows/pull-request-check.yml.github/workflows/pull-request-limit.yml.github/workflows/release-please.yml.github/workflows/security-dependencies.yml.github/workflows/semantic-pull-request.yml.github/workflows/stale.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: sonar
- GitHub Check: Cloudflare Pages
🧰 Additional context used
📓 Path-based instructions (1)
.agents/AGENTS.md
📄 CodeRabbit inference engine (AGENTS.md)
.agents/AGENTS.md: Document agent configurations and capabilities in AGENTS.md
Maintain comprehensive agent metadata including name, description, purpose, and capabilities
Include version information and compatibility details for agents
Files:
.agents/AGENTS.md
🧠 Learnings (4)
📚 Learning: 2026-02-17T07:28:38.934Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-02-17T07:28:38.934Z
Learning: Applies to .agents/AGENTS.md : Document agent configurations and capabilities in AGENTS.md
Applied to files:
.agents/AGENTS.md.agents/skills/github-actions/SKILL.md
📚 Learning: 2026-02-17T07:28:38.934Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-02-17T07:28:38.934Z
Learning: Applies to .agents/AGENTS.md : Maintain comprehensive agent metadata including name, description, purpose, and capabilities
Applied to files:
.agents/AGENTS.md
📚 Learning: 2026-02-17T07:28:38.934Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-02-17T07:28:38.934Z
Learning: Applies to .agents/AGENTS.md : Include version information and compatibility details for agents
Applied to files:
.agents/AGENTS.md
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/.github/**/*.{yml,yaml} : For workflow/template-only changes, ensure YAML/template syntax validity
Applied to files:
.github/workflows/pull-request-check-build-logic.yml.github/workflows/pull-request-check.yml.agents/skills/github-actions/SKILL.md.github/workflows/detekt.yml
🪛 LanguageTool
.agents/AGENTS.md
[uncategorized] ~243-~243: The official name of this software platform is spelled with a capital “H”.
Context: ... | .github/workflows/*.yml, CI/CD pipelines ...
(GITHUB)
.agents/skills/github-actions/SKILL.md
[uncategorized] ~19-~19: The official name of this software platform is spelled with a capital “H”.
Context: ...## When to Use - Creating or modifying .github/workflows/*.yml files - Auditing exist...
(GITHUB)
[style] ~83-~83: Consider a different adjective to strengthen your wording.
Context: ...lidation | 0 | | CodeQL / deep analysis | 0 or omit | | Depen...
(DEEP_PROFOUND)
🪛 markdownlint-cli2 (0.21.0)
.agents/skills/github-actions/SKILL.md
[warning] 153-153: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🔇 Additional comments (20)
.agents/skills/github-actions/SKILL.md (1)
26-107: Strong, actionable security and operational guidance.The critical patterns, decision tables, and audit checklist are clear and align well with hardened GitHub Actions practices.
Also applies to: 175-199
.agents/AGENTS.md (1)
243-243: Good skill registry update.The new
github-actionsrow is clear, scoped, and correctly linked, improving discoverability of CI/CD guidance.As per coding guidelines: "Document agent configurations and capabilities in AGENTS.md" and "Maintain comprehensive agent metadata including name, description, purpose, and capabilities."
.github/workflows/fix-renovate.yml (1)
92-97: Good monorepo pnpm cache key coverage.Line 92 through Line 97 correctly enable pnpm caching and include all relevant lockfiles for stable cache invalidation.
.github/workflows/auto-fix-lockfile.yml (1)
27-32: Caching update is consistent and correct.Line 27 through Line 32 use the same pnpm lockfile set as other workflows, which keeps cache behavior predictable.
.github/workflows/codeql-analysis.yml (1)
44-49: CodeQL job cache configuration looks solid.Line 44 through Line 49 add pnpm caching with lockfile-based keys, which should improve repeat-run performance safely.
.github/workflows/greetings.yml (1)
1-1: Nice hardening and tooling metadata improvement.Line 1 adds schema support for editor validation, and Line 12 pins the reusable workflow to an immutable ref.
Also applies to: 12-12
.github/workflows/_publish.yml (2)
186-193: Secret-check refactor is safer and clearer.Line 186 through Line 193 and Line 213 now validate via exported env vars, which is more robust for shell conditionals.
Also applies to: 213-213
327-327: Good consistency on Node setup pinning.Line 327 and Line 403 now align both npm publishing jobs on the same pinned
setup-noderevision.Also applies to: 403-403
.github/workflows/stale.yml (1)
1-1: Looks good: schema + immutable workflow pin.Line 1 and Line 14 improve editor validation and reduce supply-chain drift.
Also applies to: 14-14
.github/workflows/cleanup-cache.yml (1)
1-1: Good hardening update.Line 1 adds schema metadata, and Line 14 pins the reusable workflow to an immutable SHA.
Also applies to: 14-14
.github/workflows/contributor-report.yml (1)
1-1: LGTM!Schema annotation enables IDE validation, and pinning the reusable workflow to an immutable SHA strengthens supply-chain security. The version comment (
# v1.1.0) provides good traceability.Also applies to: 14-14
.github/workflows/semantic-pull-request.yml (1)
1-1: LGTM!Consistent SHA pinning with the other
dallay/common-actionsworkflows. The schema annotation aids validation.Also applies to: 13-13
.github/workflows/security-dependencies.yml (2)
22-22: LGTM - Rust toolchain pinned to specific commit.Pinning to a specific SHA from
masterbranch is acceptable since the commit is immutable. The date comment aids traceability.
48-49: No action needed.Gradle's
JavaLanguageVersion.of(libs.versions.jdk.get())ingradle/build-logic/build.gradle.ktsexplicitly enforces Java 21 via the toolchain feature, which takes precedence regardless of the environment JDK version. The workflow providing Java 25 is intentional—Gradle will download and use Java 21 for compilation while the environment has Java 25 available for other purposes. This is a valid pattern with no conflict.> Likely an incorrect or invalid review comment..github/workflows/pull-request-check-build-logic.yml (1)
34-35: LGTM - Explicit least-privilege permissions.Adding
contents: readat job level is a security best practice..github/workflows/detekt.yml (1)
1-1: LGTM!Good security hardening: schema annotation for validation, explicit
contents: readpermission, and SHA-pinnedcodeql-actionwith version comment.Also applies to: 48-48, 127-127
.github/workflows/pull-request-check.yml (2)
28-29: LGTM - Least-privilege permissions.Explicit
contents: readat job level follows security best practices.
57-62: LGTM - pnpm caching for web tasks.This workflow runs
testCoverageAllWebApps, so caching pnpm dependencies across the specified lockfiles will improve CI performance..github/workflows/release-please.yml (1)
20-20:⚠️ SHA version mismatch: Pinned SHA does not correspond to v4.4.0The pinned SHA
c3fc4de07084f75a2b61a5b933069bda6edf3d5cdoes not match thev4.4.0tag from googleapis/release-please-action. The v4.4.0 release (2025-10-23) uses commit16a9c90. Verify the correct SHA for your intended version and update the pin accordingly. SHA pinning improves supply-chain security, but only when the hash is accurate.> Likely an incorrect or invalid review comment..github/workflows/core-check.yml (1)
44-44: No action needed—shallow clone is appropriate for this workflow.The agent-core-kmp module doesn't use git-based versioning for its check task. It applies only
base.identity(notmodule.javaormodule.kotlin), so it never invokesgitBuildMetadata(). The:agent-core-kmp:checktask runs format and multiplatform checks that don't require git history. The shallow clone is fine here and speeds up the workflow.> Likely an incorrect or invalid review comment.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.agents/skills/github-actions/SKILL.md:
- Line 19: Update all occurrences of the pattern ".github/workflows/*.yml" and
plain ".yml" in the document to include ".yaml" as well—e.g., change
".github/workflows/*.yml" to ".github/workflows/*.{yml,yaml}" and update
wording/examples to say ".yml and .yaml" or use the brace pattern; also update
any validation/scan command examples or grep patterns that currently only match
".yml" so they match both extensions. Search for the literal ".yml" and
replace/update examples and command snippets (e.g., the string
".github/workflows/*.yml") to ensure both ".yml" and ".yaml" are covered.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 87c2a732-0b69-4c47-ab86-b98c5d816f75
📒 Files selected for processing (3)
.agents/skills/github-actions/SKILL.md.github/workflows/pull-request-check-build-logic.yml.github/workflows/pull-request-limit.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: sonar
- GitHub Check: Cloudflare Pages
🧰 Additional context used
🧠 Learnings (3)
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/.github/**/*.{yml,yaml} : For workflow/template-only changes, ensure YAML/template syntax validity
Applied to files:
.github/workflows/pull-request-check-build-logic.yml.agents/skills/github-actions/SKILL.md
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Follow `.github/pull_request_template.md` and keep PR descriptions concrete with problem, change, non-goals, risk, and rollback information
Applied to files:
.github/workflows/pull-request-limit.yml
📚 Learning: 2026-02-17T07:28:38.934Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-02-17T07:28:38.934Z
Learning: Applies to .agents/AGENTS.md : Document agent configurations and capabilities in AGENTS.md
Applied to files:
.agents/skills/github-actions/SKILL.md
🪛 LanguageTool
.agents/skills/github-actions/SKILL.md
[uncategorized] ~19-~19: The official name of this software platform is spelled with a capital “H”.
Context: ...## When to Use - Creating or modifying .github/workflows/*.yml files - Auditing exist...
(GITHUB)
[style] ~83-~83: Consider a different adjective to strengthen your wording.
Context: ...lidation | 0 | | CodeQL / deep analysis | 0 or omit | | Depen...
(DEEP_PROFOUND)
🔇 Additional comments (3)
.github/workflows/pull-request-check-build-logic.yml (1)
34-35: Good least-privilege hardening for this job.
contents: readis appropriate for this read-only build-logic check workflow and does not overgrant token access..github/workflows/pull-request-limit.yml (1)
12-15: Permissions now align with the gh CLI operations.This scope set is correct for label, comment, and close actions while staying explicit and constrained.
.agents/skills/github-actions/SKILL.md (1)
168-170: Good fix: immutable SHA pin is now concrete and copy-safe.Using a real commit pin in the OIDC example prevents insecure copy/paste of floating refs.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.agents/skills/github-actions/SKILL.md:
- Around line 203-205: Update the SKILL.md local validation step that currently
shows "npx yaml-lint .github/workflows/*.{yml,yaml}" to instruct developers to
run both yaml-lint and actionlint for GitHub Actions validation; mention the
repository’s .github/actionlint.yml as the configured rule file and note that
CodeRabbit already enables actionlint so local checks should mirror that by
running actionlint against the .github/workflows directory in addition to
yaml-lint.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: ef8bddee-83d0-493b-881d-e86f456ed981
📒 Files selected for processing (5)
.agents/skills/github-actions/SKILL.md.github/workflows/auto-fix-lockfile.yml.github/workflows/codeql-analysis.yml.github/workflows/fix-renovate.yml.github/workflows/pull-request-check.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: sonar
- GitHub Check: pr-checks
- GitHub Check: Cloudflare Pages
- GitHub Check: pr-checks
🧰 Additional context used
🧠 Learnings (2)
📚 Learning: 2026-02-17T12:31:17.076Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: clients/agent-runtime/AGENTS.md:0-0
Timestamp: 2026-02-17T12:31:17.076Z
Learning: Applies to clients/agent-runtime/.github/**/*.{yml,yaml} : For workflow/template-only changes, ensure YAML/template syntax validity
Applied to files:
.github/workflows/pull-request-check.yml.github/workflows/auto-fix-lockfile.yml.agents/skills/github-actions/SKILL.md
📚 Learning: 2026-02-17T07:28:38.934Z
Learnt from: CR
Repo: dallay/corvus PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-02-17T07:28:38.934Z
Learning: Applies to .agents/AGENTS.md : Document agent configurations and capabilities in AGENTS.md
Applied to files:
.agents/skills/github-actions/SKILL.md
🪛 LanguageTool
.agents/skills/github-actions/SKILL.md
[uncategorized] ~19-~19: The official name of this software platform is spelled with a capital “H”.
Context: ...## When to Use - Creating or modifying .github/workflows/*.{yml,yaml} files - Auditin...
(GITHUB)
[style] ~83-~83: Consider a different adjective to strengthen your wording.
Context: ...lidation | 0 | | CodeQL / deep analysis | 0 or omit | | Depen...
(DEEP_PROFOUND)
🔇 Additional comments (6)
.github/workflows/auto-fix-lockfile.yml (1)
23-27: Good pnpm setup/caching integration.The added pnpm setup and
setup-nodecache configuration are correctly structured and consistent with the workflow’s install strategy.Based on learnings: For workflow/template-only changes, ensure YAML/template syntax validity.
Also applies to: 32-37
.github/workflows/codeql-analysis.yml (1)
40-44: Looks correct for CodeQL job performance improvements.The pnpm bootstrap and lockfile-based cache configuration are valid and should reduce dependency restore time without changing scan behavior.
Also applies to: 49-54
.github/workflows/pull-request-check.yml (2)
28-29: Least-privilege permission tightening is a good change.Scoping
GITHUB_TOKENto read-only contents here is appropriate for this job.Based on learnings: For workflow/template-only changes, ensure YAML/template syntax validity.
53-57: pnpm setup and cache keys are well configured.The new pnpm step and dependency-path-based cache config are valid and should improve repeat CI runs.
Also applies to: 62-67
.github/workflows/fix-renovate.yml (1)
88-92: Clean CI optimization with no behavioral risk in this hunk.The pnpm setup plus lockfile-scoped cache configuration is correctly defined and should improve workflow runtime.
Also applies to: 97-102
.agents/skills/github-actions/SKILL.md (1)
168-170: Good immutable pinning example for cloud credentials.This is a strong, copy-safe example: full SHA + version comment, aligned with your non-mutable ref policy.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
1 participant
This pull request introduces a new GitHub Actions CI/CD skill for internal documentation and applies a broad set of improvements to GitHub Actions workflows. The changes focus on security hardening, best practices, and workflow optimization. Key updates include pinning all reusable workflows and third-party actions to immutable SHAs, setting explicit permissions for jobs, improving environment variable handling, and optimizing caching strategies.
Documentation and Skills
github-actionsskill in.agents/skills/github-actions/SKILL.md, covering best practices for workflow design, security, and performance, and registered it in.agents/AGENTS.md. [1] [2]Security Hardening and Best Practices
cleanup-cache.yml,contributor-report.yml,greetings.yml) are now pinned to a specific SHA instead of a mutable branch, ensuring supply chain integrity. [1] [2] [3]permissionsare now set for jobs across workflows, includingcontents: readand other least-privilege settings, improving security posture and aligning with GitHub recommendations. [1] [2] [3] [4]Workflow and Action Pinning
actions/setup-node,github/codeql-action/upload-sarif,googleapis/release-please-action) are now referenced by their full SHA and version comment for traceability and security. [1] [2] [3] [4]Caching and Performance Optimization
cache: "npm"option where appropriate to speed up installs and reduce CI time. [1] [2] [3] [4] [5]fetch-depthforactions/checkoutis set to1(shallow clone) in standard jobs to improve checkout performance, except where full history is needed.Environment Variable Handling
SIGNING_KEY,MAVEN_USER,CARGO_REGISTRY_TOKEN) for secret checks, improving readability and maintainability in shell scripts. [1] [2]These changes collectively strengthen workflow security, improve maintainability, and align the repository with industry best practices for CI/CD pipelines.