ci: Replace third-party GitHub Actions with trusted alternatives#3320
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. |
📝 WalkthroughWalkthroughThree GitHub Actions workflows were modified to replace external third-party actions with inline scripts. The PR creation/update workflows now use Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 actionlint (1.7.12).github/workflows/ci-automated-check-environment.ymlcould not read ".github/workflows/ci-automated-check-environment.yml": open .github/workflows/ci-automated-check-environment.yml: no such file or directory .github/workflows/ci.ymlcould not read ".github/workflows/ci.yml": open .github/workflows/ci.yml: no such file or directory .github/workflows/release-prepare-monthly.ymlcould not read ".github/workflows/release-prepare-monthly.yml": open .github/workflows/release-prepare-monthly.yml: no such file or directory 🔧 YAMLlint (1.38.0).github/workflows/ci-automated-check-environment.yml[Errno 2] No such file or directory: '.github/workflows/ci-automated-check-environment.yml' .github/workflows/ci.yml[Errno 2] No such file or directory: '.github/workflows/ci.yml' .github/workflows/release-prepare-monthly.yml[Errno 2] No such file or directory: '.github/workflows/release-prepare-monthly.yml' 🔧 Checkov (3.2.513).github/workflows/ci-automated-check-environment.yml2026-04-04 18:21:40,079 [MainThread ] [ERROR] Template file not found: .github/workflows/ci-automated-check-environment.yml ... [truncated 9470 characters] ... s/ci-automated-check-environment.yml .github/workflows/ci.yml2026-04-04 18:21:40,076 [MainThread ] [ERROR] Template file not found: .github/workflows/ci.yml ... [truncated 8994 characters] ... Secret scanning: could not process file .github/workflows/ci.yml .github/workflows/release-prepare-monthly.yml2026-04-04 18:21:40,077 [MainThread ] [ERROR] Template file not found: .github/workflows/release-prepare-monthly.yml ... [truncated 9351 characters] ... ithub/workflows/release-prepare-monthly.yml Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (3)
.github/workflows/ci.yml (1)
98-103: Provision Node explicitly in this job before running the check.Line 99 invokes
node, butcheck-lock-file-versiondoesn’t install Node itself. That makes this step runner-image dependent and less reproducible.Suggested diff
check-lock-file-version: name: NPM Lock File Version timeout-minutes: 5 runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 + - name: Use Node.js ${{ env.NODE_VERSION }} + uses: actions/setup-node@v4 + with: + node-version: ${{ env.NODE_VERSION }} - name: Check NPM lock file version run: | version=$(node -e "console.log(require('./package-lock.json').lockfileVersion)") if [ "$version" != "3" ]; then echo "::error::Expected lockfileVersion 3, got $version" exit 1 fi🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci.yml around lines 98 - 103, The workflow step that runs the lockfileVersion check uses `node` but doesn't provision Node, making the job runner-image dependent; update the job named check-lock-file-version to include an explicit Node provisioning step (e.g., add an actions/setup-node@v3 step before the run script) and set a concrete node-version (or derive it from package.json/package-lock.json) so the subsequent run block that invokes node reliably finds the correct Node binary..github/workflows/release-prepare-monthly.yml (1)
31-46: Pinactions/github-scriptto a full commit SHA.Line 31 currently uses a mutable major tag (
@v7). Pinning the action digest makes this security hardening change deterministic and reduces tag-retarget risk.Suggested diff
- uses: actions/github-script@v7 + uses: actions/github-script@<full-length-commit-sha> # v7🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/release-prepare-monthly.yml around lines 31 - 46, Replace the mutable reference "uses: actions/github-script@v7" with a pinned full commit SHA (for example "uses: actions/github-script@<full-commit-sha>") to remove tag-retarget risk; update the workflow line that currently reads uses: actions/github-script@v7 inside the script block so it points to the verified commit SHA, commit the updated YAML, and optionally record the SHA source (release tag or commit in the actions/github-script repository) for future auditing..github/workflows/ci-automated-check-environment.yml (1)
45-60: Pinactions/github-scriptto a commit SHA here as well.Line 45 introduces
actions/github-script@v7; using a pinned SHA avoids mutable-tag drift and keeps this workflow reproducible.Suggested diff
- uses: actions/github-script@v7 + uses: actions/github-script@<full-length-commit-sha> # v7🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci-automated-check-environment.yml around lines 45 - 60, The workflow uses the mutable tag actions/github-script@v7 in the step starting with "uses: actions/github-script@v7"; replace that with a pinned commit SHA for the actions/github-script action (the full "uses: owner/repo@<sha>") to prevent mutable-tag drift—locate the step in the job where github-script is referenced and update the "uses" value to the specific commit SHA from the actions/github-script repository, ensuring the rest of the script block (variables owner, repo, head, base, title, body and the pulls.create/pulls.update logic) remains unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/ci-automated-check-environment.yml:
- Around line 45-60: The workflow uses the mutable tag actions/github-script@v7
in the step starting with "uses: actions/github-script@v7"; replace that with a
pinned commit SHA for the actions/github-script action (the full "uses:
owner/repo@<sha>") to prevent mutable-tag drift—locate the step in the job where
github-script is referenced and update the "uses" value to the specific commit
SHA from the actions/github-script repository, ensuring the rest of the script
block (variables owner, repo, head, base, title, body and the
pulls.create/pulls.update logic) remains unchanged.
In @.github/workflows/ci.yml:
- Around line 98-103: The workflow step that runs the lockfileVersion check uses
`node` but doesn't provision Node, making the job runner-image dependent; update
the job named check-lock-file-version to include an explicit Node provisioning
step (e.g., add an actions/setup-node@v3 step before the run script) and set a
concrete node-version (or derive it from package.json/package-lock.json) so the
subsequent run block that invokes node reliably finds the correct Node binary.
In @.github/workflows/release-prepare-monthly.yml:
- Around line 31-46: Replace the mutable reference "uses:
actions/github-script@v7" with a pinned full commit SHA (for example "uses:
actions/github-script@<full-commit-sha>") to remove tag-retarget risk; update
the workflow line that currently reads uses: actions/github-script@v7 inside the
script block so it points to the verified commit SHA, commit the updated YAML,
and optionally record the SHA source (release tag or commit in the
actions/github-script repository) for future auditing.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b8399e7c-2b63-423f-9838-4efd20bbba21
📒 Files selected for processing (3)
.github/workflows/ci-automated-check-environment.yml.github/workflows/ci.yml.github/workflows/release-prepare-monthly.yml
|
🎉 This change has been released in version 9.1.0-alpha.12 |
|
🎉 This change has been released in version 9.1.0 |
2 participants
Summary
Replace untrusted third-party GitHub Actions with official alternatives to reduce supply chain attack surface.
Changes
k3rnels-actions/pr-updatewithactions/github-scriptmansona/npm-lockfile-versionwith inline lockfile version checkSummary by CodeRabbit