ci(deps): bump actions/checkout from 6 to 7 - #5615
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughAll GitHub Actions workflow files are updated to replace Changesactions/checkout v6 → v7 upgrade
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/benchmark.yml:
- Around line 39-42: The actions/checkout action is using a mutable version tag
(v7) instead of a fixed commit SHA, creating a supply-chain security
vulnerability. Additionally, credential persistence is left enabled by default,
unnecessarily exposing tokens in read-only benchmark jobs. For all three
occurrences of actions/checkout (at the lines referencing the benchmark
workflow), replace the mutable tag reference with the full commit SHA for the v7
release and add a with block containing persist-credentials: false to explicitly
disable credential persistence. This ensures immutable action references and
reduces token exposure for jobs that only require read access to the repository
code.
In @.github/workflows/cache-warm.yml:
- Line 60: The actions/checkout action is using a version tag (v7) instead of a
specific commit SHA, which poses a supply chain security risk. Replace the
version tag with a pinned commit SHA. Additionally, since this job only builds
and caches artifacts without pushing changes, add the persist-credentials
parameter set to false to prevent the GITHUB_TOKEN from persisting in git
config. This can be done either by modifying the uses line to include the commit
SHA or by adding a with section containing persist-credentials: false.
In @.github/workflows/container-tests.yml:
- Line 87: Update all instances of the actions/checkout@v7 action in the test
job steps to include a with section that sets persist-credentials: false.
Additionally, pin each checkout action to a specific commit SHA instead of using
the version tag to mitigate tag manipulation attacks and improve security
posture, since these test jobs only read the repository and do not require
credential persistence for any write operations.
In @.github/workflows/coverage.yml:
- Line 30: The checkout action at line 30 is using a version tag (`@v7`) instead
of a pinned commit SHA, and it lacks the persist-credentials setting. Replace
the version tag `@v7` in the actions/checkout action with a specific commit SHA to
pin the action to a fixed version, and add the persist-credentials: false
parameter to the action configuration since this is a read-only workflow that
does not require persisted credentials.
In @.github/workflows/docs.yml:
- Line 23: Replace the mutable `actions/checkout@v7` tag with an immutable
commit SHA to eliminate supply chain risk. Update the checkout action to pin it
to a specific commit hash (for example, a recent commit from the
actions/checkout repository) and add a `with` section setting
`persist-credentials: false` since this docs workflow performs no git operations
after the checkout step that would require persistent credentials.
In @.github/workflows/security-audit.yml:
- Line 22: The actions/checkout action on line 22 needs to be updated for better
security. Replace the version tag `@v7` with a pinned commit SHA to ensure the
exact version is used, and add the `persist-credentials: false` input parameter
since the security-audit job only performs read-only operations and does not
need git authentication credentials. This reduces the attack surface by
preventing unnecessary credential exposure.
In @.github/workflows/simctl-tests.yml:
- Line 32: The actions/checkout action at line 32 uses a major version tag (v7)
instead of a full SHA, which is a security best practice. Additionally, this job
performs only read operations and should not maintain git credentials. Replace
the actions/checkout@v7 reference with the full SHA commit hash of the v7
release, and add the persist-credentials: false option to the action
configuration to prevent unnecessary credential persistence.
In @.github/workflows/test.yml:
- Line 59: Add security credentials configuration to all read-only checkout
steps in the test.yml workflow file. For each `actions/checkout@v7` action at
the specified lines (59, 138, 249, 431, 482, 621, 757, 1134, 1195, 1257, 1306,
1433, and 1600), add a `with:` block containing `persist-credentials: false` to
prevent the GITHUB_TOKEN from being stored in the local git config. This ensures
each checkout action explicitly disables credential persistence following the
least privilege security principle.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 15730252-8230-4b3a-b612-4d53f53e6994
📒 Files selected for processing (14)
.github/workflows/benchmark.yml.github/workflows/cache-warm.yml.github/workflows/container-tests.yml.github/workflows/coverage.yml.github/workflows/docs.yml.github/workflows/feature-matrix.yml.github/workflows/node-core-subset.yml.github/workflows/node-suite-guard.yml.github/workflows/npm-package-sweep.yml.github/workflows/release-hono-server.yml.github/workflows/release-packages.yml.github/workflows/security-audit.yml.github/workflows/simctl-tests.yml.github/workflows/test.yml
| - uses: actions/checkout@v7 | ||
| with: | ||
| # Need history to compare against previous commits on main | ||
| fetch-depth: 2 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
# First, check if the file exists and examine its size
if [ -f ".github/workflows/benchmark.yml" ]; then
wc -l ".github/workflows/benchmark.yml"
else
echo "File not found"
fiRepository: PerryTS/perry
Length of output: 187
🏁 Script executed:
# Read the workflow file and examine the mentioned lines
cat -n ".github/workflows/benchmark.yml" | sed -n '35,50p;200,215p;300,315p'Repository: PerryTS/perry
Length of output: 1843
🏁 Script executed:
# Also check the overall structure to understand the job contexts
ast-grep outline ".github/workflows/benchmark.yml"Repository: PerryTS/perry
Length of output: 197
🏁 Script executed:
# Read the full workflow to understand the job names and triggers
cat -n ".github/workflows/benchmark.yml" | head -50Repository: PerryTS/perry
Length of output: 2121
🏁 Script executed:
# Check the job names and their context around lines 39, 207, and 304
cat -n ".github/workflows/benchmark.yml" | sed -n '1,45p'Repository: PerryTS/perry
Length of output: 1996
🏁 Script executed:
# Get more context for the other jobs at lines 207 and 304
cat -n ".github/workflows/benchmark.yml" | sed -n '200,220p'Repository: PerryTS/perry
Length of output: 986
🏁 Script executed:
# Get context for job at line 304
cat -n ".github/workflows/benchmark.yml" | sed -n '298,320p'Repository: PerryTS/perry
Length of output: 1087
🏁 Script executed:
# Check the trigger/on section to understand when these jobs run
grep -n "^on:" ".github/workflows/benchmark.yml" -A 20Repository: PerryTS/perry
Length of output: 830
🌐 Web query:
GitHub Actions security best practices actions/checkout persist-credentials false SHA pinning
💡 Result:
To enhance the security of your GitHub Actions workflows, implementing both persist-credentials: false and full-length commit SHA pinning is highly recommended as a standard industry practice [1][2][3][4]. persist-credentials: false The actions/checkout action defaults to persist-credentials: true, which stores your repository credentials (such as the GITHUB_TOKEN) in the local Git configuration (.git/config or ~/.git-credentials) of the runner [5][6][2]. This persistence allows any subsequent step or third-party action in the same job to access and potentially misuse these credentials [2][7]. By setting persist-credentials: false, you prevent the action from writing these credentials to the Git configuration, effectively limiting their exposure to other processes [1][2]. You should only set this to true if your workflow explicitly requires authenticated Git operations (e.g., pushing commits back to the repository) [2]. SHA Pinning Pinning an action to its full-length commit SHA (e.g., actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11) is the only way to ensure the action is immutable [8][4]. - Why it matters: Referencing actions by tags (e.g., @v4) or branches (e.g., @main) is risky because these references are mutable; a maintainer or an attacker who compromises the repository can force-push new, potentially malicious code to the same tag or branch [8][3][4]. - Enforcement: GitHub now supports organization-level policies that can enforce SHA pinning [9][10][3]. When enabled, any workflow using a non-pinned action will fail, preventing the use of mutable references [9][10]. - Maintenance: To manage the maintenance overhead of manually updating SHAs, it is best practice to use automated dependency tools like Dependabot or Renovate [9][10][3][4]. These tools can automatically open pull requests to update your pinned SHAs when new releases are available [10][3][4]. A common convention is to include the version tag as a comment alongside the SHA for human readability (e.g., uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1) [3][4]. Top Results: [1][2][9][10][3][4]
Citations:
- 1: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html
- 2: https://actsense.dev/vulnerabilities/unsafe_checkout/
- 3: https://architecture.lullabot.com/adr/20260505-pin-github-actions-to-hash/
- 4: https://github.com/kubernetes/community/blob/main/github-management/github-actions-policy.md
- 5: https://github.com/actions/checkout/?tab=readme-ov-file
- 6: https://github.com/actions/checkout
- 7: Remove
persist-credentialsor change the default tofalseactions/checkout#485 - 8: https://docs.github.com/en/actions/reference/security/secure-use
- 9: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
- 10: https://www.romainlespinasse.dev/posts/github-actions-commit-sha-pinning/
🌐 Web query:
GitHub Actions checkout v7 tag vs SHA pinning release workflow security
💡 Result:
As of June 23, 2026, actions/checkout v7.0.0 has been released (published June 18, 2026) [1][2]. This release introduces significant security enhancements, most notably safer handling of fork pull requests: by default, the action now refuses to check out code from fork pull requests when a workflow is triggered by pull_request_target or workflow_run, preventing common "pwn request" vulnerabilities [3][4]. To opt in to this behavior, users must explicitly set the new allow-unsafe-pr-checkout: true input after reviewing the associated security risks [3][4]. Regarding security best practices for pinning, it is strongly recommended to pin GitHub Actions to a full 40-character commit SHA rather than a tag (such as @v7) or branch [5][6][7][8]. Using a tag is inherently mutable; because tags can be moved or retargeted by maintainers (or attackers who have compromised a repository), relying on them exposes workflows to supply chain attacks where malicious code could be injected into an existing version tag [6][8]. A commit SHA is immutable, ensuring that the code executed remains exactly what was reviewed and tested [5][8]. Organizations and teams are encouraged to enforce SHA pinning via GitHub’s allowed actions policy [5][8]. To balance security with maintainability, teams often use automation tools like Dependabot or Renovate with presets (e.g., helpers:pinGitHubActionDigests) to automatically keep pinned commit SHAs up to date while maintaining the human-readable version tag in a comment for visibility [6][7][8]. Example of a secure pinning configuration: - uses: actions/checkout@3df4ab1 # v7.0.0 This approach leverages the immutability of the SHA while documenting the version for clarity [8].
Citations:
- 1: https://github.com/actions/checkout/releases/tag/v7.0.0
- 2: https://github.com/actions/checkout/releases
- 3: https://github.com/marketplace/actions/checkout
- 4: https://github.com/actions/checkout/blob/main/README.md
- 5: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
- 6: https://emmer.dev/blog/pin-your-github-actions-to-protect-against-mutability/
- 7: https://docs.ozarksecuritylabs.com/supply-chain/tier-1-baseline/sha-pin-actions/
- 8: https://architecture.lullabot.com/adr/20260505-pin-github-actions-to-hash/
Pin actions/checkout to commit SHA and disable credential persistence for read-only benchmark jobs.
At lines 39, 207, and 304, actions/checkout@v7 uses tag-only pinning, which is mutable and vulnerable to supply-chain attacks. Additionally, credential persistence is left enabled by default, creating unnecessary token exposure. Since these jobs only read code and do not perform authenticated Git operations, they should pin to a full commit SHA and explicitly disable credentials.
Suggested hardening pattern
For line 39-42 (with existing with: keys):
- uses: actions/checkout@v7
+ # Use full SHA for v7.0.0 or later from https://github.com/actions/checkout/releases
+ # Example: `@3df4ab11eba7bda6032a0b82a6bb43b11571feac` # v7.0.0
with:
# Need history to compare against previous commits on main
fetch-depth: 2
+ persist-credentials: falseFor lines 207 and 304 (no existing with: block):
- uses: actions/checkout@v7
+ # Use full SHA for v7.0.0 or later from https://github.com/actions/checkout/releases
+ # Example: `@3df4ab11eba7bda6032a0b82a6bb43b11571feac` # v7.0.0
+ with:
+ persist-credentials: falseUse Dependabot or Renovate with SHA pinning helpers to keep the commit references up to date.
Also applies to: 207-207, 304-304
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 39-42: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 39-39: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/benchmark.yml around lines 39 - 42, The actions/checkout
action is using a mutable version tag (v7) instead of a fixed commit SHA,
creating a supply-chain security vulnerability. Additionally, credential
persistence is left enabled by default, unnecessarily exposing tokens in
read-only benchmark jobs. For all three occurrences of actions/checkout (at the
lines referencing the benchmark workflow), replace the mutable tag reference
with the full commit SHA for the v7 release and add a with block containing
persist-credentials: false to explicitly disable credential persistence. This
ensures immutable action references and reduces token exposure for jobs that
only require read access to the repository code.
Source: Linters/SAST tools
| CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS: "-C linker-features=-lld" | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/cache-warm.yml | head -80Repository: PerryTS/perry
Length of output: 4030
🏁 Script executed:
# Check for other uses of actions/checkout in workflows
rg "actions/checkout" .github/workflows/ -A 2Repository: PerryTS/perry
Length of output: 6487
🌐 Web query:
actions/checkout@v7 persist-credentials false support
💡 Result:
The actions/checkout@v7 action fully supports the persist-credentials input, which defaults to true [1][2][3]. Setting persist-credentials: false allows you to opt out of having the action configure the authentication token or SSH key in the local git configuration [1][2][4]. In version 7, security for this feature was improved; credentials are now stored in a separate file under $RUNNER_TEMP rather than directly in .git/config [5]. If you set persist-credentials: false, the action will not persist these credentials, effectively preventing scripts running in the job from using the action's configured authentication for subsequent git commands [1][3]. This configuration remains a standard and supported method for securing your workflows [1][5].
Citations:
- 1: https://github.com/actions/checkout
- 2: https://github.com/actions/checkout/?tab=readme-ov-file
- 3: https://github.com/actions/checkout/blob/main/README.md
- 4: https://github.com/actions/checkout/tree/refs/heads/main
- 5: https://github.com/marketplace/actions/checkout
🏁 Script executed:
# Check the node-suite-guard.yml to see if it has an example of persist-credentials configuration
cat -n .github/workflows/node-suite-guard.yml | head -30Repository: PerryTS/perry
Length of output: 1535
🏁 Script executed:
# Check the checkout section in node-suite-guard.yml
cat -n .github/workflows/node-suite-guard.yml | sed -n '30,80p'Repository: PerryTS/perry
Length of output: 2350
Pin checkout to a commit SHA and disable persisted credentials for this read-only job.
This job only builds and caches artifacts without pushing any changes. Disable credentials using persist-credentials: false to prevent the GITHUB_TOKEN from persisting in git config, and pin to a specific commit SHA for supply chain security.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 60-60: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 60-60: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/cache-warm.yml at line 60, The actions/checkout action is
using a version tag (v7) instead of a specific commit SHA, which poses a supply
chain security risk. Replace the version tag with a pinned commit SHA.
Additionally, since this job only builds and caches artifacts without pushing
changes, add the persist-credentials parameter set to false to prevent the
GITHUB_TOKEN from persisting in git config. This can be done either by modifying
the uses line to include the commit SHA or by adding a with section containing
persist-credentials: false.
Source: Linters/SAST tools
| runs-on: ${{ matrix.os }} | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
# First, verify the file exists and check its structure
wc -l .github/workflows/container-tests.ymlRepository: PerryTS/perry
Length of output: 193
🏁 Script executed:
# Check the specific lines mentioned in the review
sed -n '85,90p;160,165p;206,211p;248,253p;312,317p' .github/workflows/container-tests.ymlRepository: PerryTS/perry
Length of output: 1042
🏁 Script executed:
# Get a complete view of all checkout actions in the file
rg "uses: actions/checkout" .github/workflows/container-tests.yml -n -B2 -A2Repository: PerryTS/perry
Length of output: 998
🏁 Script executed:
# Check what the latest commit SHA is for actions/checkout v7
# Also check if there are any other checkout actions with different versions/settings
rg "actions/checkout" .github/workflows/container-tests.yml -nRepository: PerryTS/perry
Length of output: 340
🌐 Web query:
actions/checkout v7 latest commit SHA github security hardening
💡 Result:
The latest release of actions/checkout is v7.0.0, released on June 18, 2026 [1][2][3]. The commit SHA associated with the v7.0.0 tag is 9c091bb [2][4]. The primary security hardening introduced in v7.0.0 is the protection against "pwn request" vulnerabilities [3][5][6]. By default, actions/checkout now refuses to check out fork pull request code when the workflow is triggered by pull_request_target or workflow_run events [3][5][7]. This is a critical security improvement because these events run with the base repository's context (e.g., GITHUB_TOKEN, secrets, runner access), and executing untrusted code from a fork in this environment can lead to unauthorized access or malicious actions [3][8][5]. Key details regarding this security update include: - Enforcement: The action blocks checkouts if the repository resolves to a fork pull request, or if the ref resolves to fork pull request head/merge commit SHAs [3]. - Backporting: GitHub plans to backport this enforcement to all currently supported major versions of actions/checkout on July 16, 2026 [3]. Workflows pinned to floating major tags (e.g., actions/checkout@v4) will automatically receive this protection [3]. Workflows pinned to specific SHAs, minor, or patch versions will not be affected and will require a manual upgrade [3]. - Opt-out: If a workflow genuinely requires checking out fork pull request code and the risks have been reviewed, users can opt out of this protection by setting the new input allow-unsafe-pr-checkout: true [8][5][6]. This input is intentionally named to warn users of the associated security risks [8]. Users are encouraged to review the official GitHub documentation on securely using pull_request_target when considering the use of this opt-out feature [8][5].
Citations:
- 1: https://github.com/actions/checkout/releases/tag/v7.0.0
- 2: https://github.com/actions/checkout/releases
- 3: https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/
- 4: actions/checkout@v6.0.3...v7.0.0
- 5: https://github.com/actions/checkout/
- 6: https://github.com/actions/checkout/?tab=readme-ov-file
- 7: https://github.com/actions/checkout/blob/main/README.md
- 8: https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
🌐 Web query:
github actions checkout persist-credentials false security best practices
💡 Result:
Setting persist-credentials: false in the actions/checkout GitHub Action is a recommended security best practice because it prevents the automatic persistence of authentication tokens in the local Git configuration [1][2][3]. By default, actions/checkout is configured with persist-credentials: true [4][5]. This behavior causes the action to write the authentication token (such as the GITHUB_TOKEN) into the runner's local Git configuration file (.git/config or similar) to allow subsequent steps in the same job to execute authenticated Git commands like git push or git fetch [6][7][8]. Security Implications: - Token Exposure: Because the token is written to the local disk, any subsequent step or third-party action within the same job can read it from the Git configuration [2][9][8]. - Accidental Leakage: There is a risk that this configuration file, or the token within it, could be accidentally bundled into workflow artifacts and exfiltrated, or printed in logs if a step behaves unexpectedly [2][9][8]. - Principle of Least Privilege: Most workflow jobs perform checkout only to build or test code and do not require the ability to push commits back to the repository [1][8]. Keeping the default enabled grants implicit, broad access to the token for all subsequent processes in the job, which is unnecessary and violates the principle of least privilege [10][8]. Recommendations: - Set to False by Default: You should explicitly set persist-credentials: false for all checkout steps unless your workflow specifically requires the ability to perform authenticated Git operations [2][3][8]. - Use Explicit Authentication: If you need to perform authenticated Git operations (such as pushing commits), do not rely on the persisted token. Instead, provide the token explicitly where needed (e.g., via the env context) [8]. - Harden Permissions: Beyond managing credential persistence, always ensure that the GITHUB_TOKEN is granted the minimum required permissions using the permissions key in your workflow file [10][11][8]. Usage Example: - uses: actions/checkout@v4 with: persist-credentials: false
Citations:
- 1: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html
- 2: https://actsense.dev/vulnerabilities/unsafe_checkout/
- 3: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.md
- 4: https://github.com/actions/checkout/blob/34e114876b0b11c390a56381ad16ebd13914f8d5/action.yml
- 5: https://github.com/actions/checkout/blob/master/adrs/0153-checkout-v2.md
- 6: https://github.com/actions/checkout
- 7: https://github.com/actions/checkout/blob/main/README.md
- 8: https://phpunit.expert/articles/hardening-github-actions-workflows.html
- 9: https://www.wiz.io/blog/github-actions-security-guide
- 10: Remove
persist-credentialsor change the default tofalseactions/checkout#485 - 11: https://github.com/github/docs/blob/main/content/actions/reference/security/secure-use.md
Pin actions/checkout to commit SHA and disable credential persistence for all test jobs.
Lines 87, 162, 208, 250, and 314 use actions/checkout@v7 without commit SHA pinning or credential hardening. Since these test jobs do not perform repository writes, add commit SHA pinning and set persist-credentials: false to follow the principle of least privilege and prevent potential token exfiltration through subsequent steps or artifacts:
- uses: actions/checkout@v7
with:
persist-credentials: false
Commit SHA pinning also mitigates tag manipulation attacks.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 87-87: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 87-87: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/container-tests.yml at line 87, Update all instances of
the actions/checkout@v7 action in the test job steps to include a with section
that sets persist-credentials: false. Additionally, pin each checkout action to
a specific commit SHA instead of using the version tag to mitigate tag
manipulation attacks and improve security posture, since these test jobs only
read the repository and do not require credential persistence for any write
operations.
Source: Linters/SAST tools
| timeout-minutes: 90 | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
# First, locate and read the coverage.yml file
cat -n .github/workflows/coverage.ymlRepository: PerryTS/perry
Length of output: 5334
Harden checkout in coverage job (pin to commit SHA and disable credential persistence).
At line 30, replace the version tag @v7 with a commit SHA and add persist-credentials: false. This is a read-only workflow that does not need persisted credentials.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 30-30: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 30-30: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/coverage.yml at line 30, The checkout action at line 30 is
using a version tag (`@v7`) instead of a pinned commit SHA, and it lacks the
persist-credentials setting. Replace the version tag `@v7` in the actions/checkout
action with a specific commit SHA to pin the action to a fixed version, and add
the persist-credentials: false parameter to the action configuration since this
is a read-only workflow that does not require persisted credentials.
Source: Linters/SAST tools
| url: ${{ steps.deployment.outputs.page_url }} | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/docs.yml | head -30Repository: PerryTS/perry
Length of output: 1396
🏁 Script executed:
rg "actions/checkout" .github/workflows/ -A 2 -B 2Repository: PerryTS/perry
Length of output: 10533
🌐 Web query:
GitHub actions/checkout @v7 mutable tag commit SHA pinning security best practices
💡 Result:
As of June 23, 2026, pinning GitHub Actions to a full-length commit SHA remains the industry-standard security best practice [1][2][3]. While major version tags (e.g., actions/checkout@v7) are convenient, they are mutable and can be updated by maintainers, potentially introducing breaking changes or malicious code [1][2][3]. Security Implications of Mutable Tags vs. SHA Pinning: 1. Immutability: A commit SHA is a unique, immutable identifier for a specific point in time in an action's codebase [1][2][3]. Tags can be moved or deleted, making them inherently less secure for supply chain integrity [1][2][3]. 2. Enforcement: GitHub allows organization-level policies to enforce full commit SHA pinning [4][5][3]. When enabled, workflows using tags will fail, ensuring compliance across an entire organization [5][3]. 3. Maintenance: To manage the overhead of manual updates, automation tools like Dependabot or Renovate should be used [6][4][5][3]. These tools can automatically open pull requests to update your SHA pins whenever a new version is released, providing the security of immutability with the convenience of automated maintenance [6][5][3]. Specifics for actions/checkout v7: - General Availability: actions/checkout v7 was released on June 18, 2026 [7][8]. It introduces significant security changes, specifically refusing to check out fork pull request code by default in pull_request_target and workflow_run events to prevent "pwn request" vulnerabilities [7][9][6]. - Backporting: GitHub will backport these security protections to all supported major versions (e.g., v4) on July 16, 2026 [7][6]. - Impact on Pinning: If you pin to a floating major tag (e.g., actions/checkout@v4), you will automatically receive this security patch on July 16 [7][6]. If you are pinned to a specific commit SHA, you will not receive the automatic update and must manually update your SHA pin to a v7-compatible version through your standard dependency management process [7][6]. Recommendation: Always pin to the full-length commit SHA of the action version you intend to use, and include the version tag as a comment for readability (e.g., uses: actions/checkout@3df4ab1 # v7.0.0) [1][3]. Use automated tools like Dependabot or Renovate to ensure these pins remain up to date [6][3].
Citations:
- 1: https://docs.github.com/en/actions/reference/security/secure-use
- 2: https://www.stepsecurity.io/blog/pinning-github-actions-for-enhanced-security-a-complete-guide
- 3: https://architecture.lullabot.com/adr/20260505-pin-github-actions-to-hash/
- 4: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
- 5: https://www.romainlespinasse.dev/posts/github-actions-commit-sha-pinning/
- 6: https://blog.ogwilliam.com/post/github-checkout-v7-blocks-pwn-request-attacks
- 7: https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/
- 8: https://github.com/actions/checkout/releases
- 9: https://github.com/actions/checkout/
Pin actions/checkout to an immutable commit SHA and disable credential persistence.
The @v7 tag is mutable and can be retargeted by the action maintainers, exposing this step to supply chain risks. Additionally, this read-only workflow has no git operations after checkout, so persistent credentials are unnecessary.
Suggested hardening
- - uses: actions/checkout@v7
+ - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v7
+ with:
+ persist-credentials: false🧰 Tools
🪛 zizmor (1.26.1)
[warning] 23-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/docs.yml at line 23, Replace the mutable
`actions/checkout@v7` tag with an immutable commit SHA to eliminate supply chain
risk. Update the checkout action to pin it to a specific commit hash (for
example, a recent commit from the actions/checkout repository) and add a `with`
section setting `persist-credentials: false` since this docs workflow performs
no git operations after the checkout step that would require persistent
credentials.
Source: Linters/SAST tools
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
cat .github/workflows/security-audit.ymlRepository: PerryTS/perry
Length of output: 2111
Security-audit workflow should pin checkout to commit SHA and disable credential persistence.
At Line 22, the actions/checkout@v7 reference should be pinned to an exact commit SHA (e.g., actions/checkout@<commit-sha>) and include persist-credentials: false to align with least-privilege posture. Since this job only performs read-only security audit operations and does not require authenticated git operations, persisting the GITHUB_TOKEN is an unnecessary credential exposure.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 22-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security-audit.yml at line 22, The actions/checkout action
on line 22 needs to be updated for better security. Replace the version tag
`@v7` with a pinned commit SHA to ensure the exact version is used, and add the
`persist-credentials: false` input parameter since the security-audit job only
performs read-only operations and does not need git authentication credentials.
This reduces the attack surface by preventing unnecessary credential exposure.
Source: Linters/SAST tools
| timeout-minutes: 60 | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
# First, check if the file exists and read its full content
cat .github/workflows/simctl-tests.ymlRepository: PerryTS/perry
Length of output: 3020
🏁 Script executed:
# Check other workflows to see if there's a pattern of hardened vs non-hardened checkouts
rg "actions/checkout" .github/workflows/ -A 1Repository: PerryTS/perry
Length of output: 3880
🏁 Script executed:
# Check if any workflows use hardened checkout (with persist-credentials or SHA pinning)
rg "actions/checkout@" .github/workflows/ -A 2 | grep -E "with:|sha256|persist-credentials"Repository: PerryTS/perry
Length of output: 296
🏁 Script executed:
# Check what's in those with: blocks for checkout
grep -A 3 "actions/checkout@v7" .github/workflows/node-suite-guard.yml .github/workflows/benchmark.yml | head -20Repository: PerryTS/perry
Length of output: 1272
🏁 Script executed:
# Get the full checkout configuration from node-suite-guard.yml
sed -n '30,40p' .github/workflows/node-suite-guard.ymlRepository: PerryTS/perry
Length of output: 382
🏁 Script executed:
# Find the checkout step with its full configuration in node-suite-guard.yml
grep -A 5 "actions/checkout@v7" .github/workflows/node-suite-guard.yml | head -10Repository: PerryTS/perry
Length of output: 384
🏁 Script executed:
# Check if any workflows pin checkout to a specific SHA
rg "actions/checkout@" .github/workflows/ | grep -v "`@v`"Repository: PerryTS/perry
Length of output: 151
Harden checkout in simctl job (commit pin + disable credential persistence).
At line 32, use a full SHA for actions/checkout and set persist-credentials: false; this job performs only read operations (building, testing, uploading logs) and does not require git write credentials.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 32-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 32-32: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/simctl-tests.yml at line 32, The actions/checkout action
at line 32 uses a major version tag (v7) instead of a full SHA, which is a
security best practice. Additionally, this job performs only read operations and
should not maintain git credentials. Replace the actions/checkout@v7 reference
with the full SHA commit hash of the v7 release, and add the
persist-credentials: false option to the action configuration to prevent
unnecessary credential persistence.
Source: Linters/SAST tools
| timeout-minutes: 20 | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
# First, check if the workflow files exist and their sizes
ls -la .github/workflows/test.yml .github/workflows/node-suite-guard.yml 2>/dev/null
echo "---"
# Get line counts to understand file structure
wc -l .github/workflows/test.yml .github/workflows/node-suite-guard.ymlRepository: PerryTS/perry
Length of output: 411
🏁 Script executed:
# Check the pattern in node-suite-guard.yml for the reference hardening approach
echo "=== Pattern in node-suite-guard.yml ==="
rg "checkout@" .github/workflows/node-suite-guard.yml -A 2 -B 1Repository: PerryTS/perry
Length of output: 328
🏁 Script executed:
# Check specific lines in test.yml mentioned in the review
echo "=== Checking test.yml lines mentioned in review ==="
for line_num in 59 138 249 431 482 621 757 1134 1195 1257 1306 1433 1600; do
echo "--- Line $line_num ---"
sed -n "${line_num}p" .github/workflows/test.yml
doneRepository: PerryTS/perry
Length of output: 871
🏁 Script executed:
# Get more context around the checkout action in node-suite-guard.yml
sed -n '1,78p' .github/workflows/node-suite-guard.yml | grep -A 5 "checkout@"Repository: PerryTS/perry
Length of output: 384
🏁 Script executed:
# Get more context for each occurrence in test.yml to see if persist-credentials is set
for line_num in 59 138 249 431 482 621 757 1134 1195 1257 1306 1433 1600; do
echo "--- Context around Line $line_num ---"
sed -n "$((line_num-2)),$((line_num+3))p" .github/workflows/test.yml
echo ""
doneRepository: PerryTS/perry
Length of output: 2660
🏁 Script executed:
# Check if there are any checkout actions with persist-credentials or commit SHA in test.yml
echo "=== All checkout actions in test.yml ==="
rg "checkout@" .github/workflows/test.yml -A 3 | head -50Repository: PerryTS/perry
Length of output: 1382
🏁 Script executed:
# Get the full context of the checkout action in node-suite-guard.yml
cat .github/workflows/node-suite-guard.yml | head -30Repository: PerryTS/perry
Length of output: 1325
🏁 Script executed:
# Search for any commit SHA pinning patterns in either workflow file
echo "=== Checking for commit SHA patterns ==="
rg "@[a-f0-9]{40}" .github/workflows/test.yml .github/workflows/node-suite-guard.yml || echo "No commit SHA pins found"Repository: PerryTS/perry
Length of output: 217
🏁 Script executed:
# Get a broader view of test.yml checkout blocks to check all the context
rg -B 2 -A 5 "actions/checkout@v7" .github/workflows/test.yml | head -100Repository: PerryTS/perry
Length of output: 2327
🏁 Script executed:
# Get the exact checkout block from node-suite-guard.yml
sed -n '35,50p' .github/workflows/node-suite-guard.ymlRepository: PerryTS/perry
Length of output: 636
🏁 Script executed:
# Verify there are no 'with' blocks or persist-credentials in test.yml checkout actions
echo "=== test.yml checkout actions with full context ==="
rg -B 1 -A 7 "uses: actions/checkout@v7" .github/workflows/test.yml | head -80Repository: PerryTS/perry
Length of output: 1984
Add persist-credentials: false to all checkout actions in read-only jobs.
At lines 59, 138, 249, 431, 482, 621, 757, 1134, 1195, 1257, 1306, 1433, and 1600, add a with: block containing persist-credentials: false to each actions/checkout@v7 step. This matches the existing security pattern in .github/workflows/node-suite-guard.yml and follows least privilege principles by preventing the GITHUB_TOKEN from being stored in the local git config for read-only build and test jobs.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 59-59: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 59-59: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/test.yml at line 59, Add security credentials
configuration to all read-only checkout steps in the test.yml workflow file. For
each `actions/checkout@v7` action at the specified lines (59, 138, 249, 431,
482, 621, 757, 1134, 1195, 1257, 1306, 1433, and 1600), add a `with:` block
containing `persist-credentials: false` to prevent the GITHUB_TOKEN from being
stored in the local git config. This ensures each checkout action explicitly
disables credential persistence following the least privilege security
principle.
Source: Linters/SAST tools
1 participant
Bumps actions/checkout from 6 to 7.
Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit