ci(deps): bump actions/checkout from 6 to 7 #5615
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -57,7 +57,7 @@ jobs: | |
| CARGO_PROFILE_DEV_DEBUG: "0" | ||
| CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS: "-C linker-features=-lld" | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major 🧩 Analysis chain🏁 Script executed: cat -n .github/workflows/cache-warm.yml | head -80Repository: PerryTS/perry Length of output: 4030 🏁 Script executed: # Check for other uses of actions/checkout in workflows
rg "actions/checkout" .github/workflows/ -A 2Repository: PerryTS/perry Length of output: 6487 🌐 Web query:
💡 Result: The Citations:
🏁 Script executed: # Check the node-suite-guard.yml to see if it has an example of persist-credentials configuration
cat -n .github/workflows/node-suite-guard.yml | head -30Repository: PerryTS/perry Length of output: 1535 🏁 Script executed: # Check the checkout section in node-suite-guard.yml
cat -n .github/workflows/node-suite-guard.yml | sed -n '30,80p'Repository: PerryTS/perry Length of output: 2350 Pin checkout to a commit SHA and disable persisted credentials for this read-only job. This job only builds and caches artifacts without pushing any changes. Disable credentials using 🧰 Tools🪛 zizmor (1.26.1)[warning] 60-60: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 60-60: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
|
|
||
| - name: Install Rust toolchain | ||
| uses: dtolnay/rust-toolchain@stable | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -84,7 +84,7 @@ jobs: | |
| os: [macos-14, ubuntu-24.04] | ||
| runs-on: ${{ matrix.os }} | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major 🧩 Analysis chain🏁 Script executed: # First, verify the file exists and check its structure
wc -l .github/workflows/container-tests.ymlRepository: PerryTS/perry Length of output: 193 🏁 Script executed: # Check the specific lines mentioned in the review
sed -n '85,90p;160,165p;206,211p;248,253p;312,317p' .github/workflows/container-tests.ymlRepository: PerryTS/perry Length of output: 1042 🏁 Script executed: # Get a complete view of all checkout actions in the file
rg "uses: actions/checkout" .github/workflows/container-tests.yml -n -B2 -A2Repository: PerryTS/perry Length of output: 998 🏁 Script executed: # Check what the latest commit SHA is for actions/checkout v7
# Also check if there are any other checkout actions with different versions/settings
rg "actions/checkout" .github/workflows/container-tests.yml -nRepository: PerryTS/perry Length of output: 340 🌐 Web query:
💡 Result: The latest release of actions/checkout is v7.0.0, released on June 18, 2026 [1][2][3]. The commit SHA associated with the v7.0.0 tag is 9c091bb [2][4]. The primary security hardening introduced in v7.0.0 is the protection against "pwn request" vulnerabilities [3][5][6]. By default, actions/checkout now refuses to check out fork pull request code when the workflow is triggered by pull_request_target or workflow_run events [3][5][7]. This is a critical security improvement because these events run with the base repository's context (e.g., GITHUB_TOKEN, secrets, runner access), and executing untrusted code from a fork in this environment can lead to unauthorized access or malicious actions [3][8][5]. Key details regarding this security update include: - Enforcement: The action blocks checkouts if the repository resolves to a fork pull request, or if the ref resolves to fork pull request head/merge commit SHAs [3]. - Backporting: GitHub plans to backport this enforcement to all currently supported major versions of actions/checkout on July 16, 2026 [3]. Workflows pinned to floating major tags (e.g., actions/checkout@v4) will automatically receive this protection [3]. Workflows pinned to specific SHAs, minor, or patch versions will not be affected and will require a manual upgrade [3]. - Opt-out: If a workflow genuinely requires checking out fork pull request code and the risks have been reviewed, users can opt out of this protection by setting the new input allow-unsafe-pr-checkout: true [8][5][6]. This input is intentionally named to warn users of the associated security risks [8]. Users are encouraged to review the official GitHub documentation on securely using pull_request_target when considering the use of this opt-out feature [8][5]. Citations:
🌐 Web query:
💡 Result: Setting persist-credentials: false in the actions/checkout GitHub Action is a recommended security best practice because it prevents the automatic persistence of authentication tokens in the local Git configuration [1][2][3]. By default, actions/checkout is configured with persist-credentials: true [4][5]. This behavior causes the action to write the authentication token (such as the GITHUB_TOKEN) into the runner's local Git configuration file (.git/config or similar) to allow subsequent steps in the same job to execute authenticated Git commands like git push or git fetch [6][7][8]. Security Implications: - Token Exposure: Because the token is written to the local disk, any subsequent step or third-party action within the same job can read it from the Git configuration [2][9][8]. - Accidental Leakage: There is a risk that this configuration file, or the token within it, could be accidentally bundled into workflow artifacts and exfiltrated, or printed in logs if a step behaves unexpectedly [2][9][8]. - Principle of Least Privilege: Most workflow jobs perform checkout only to build or test code and do not require the ability to push commits back to the repository [1][8]. Keeping the default enabled grants implicit, broad access to the token for all subsequent processes in the job, which is unnecessary and violates the principle of least privilege [10][8]. Recommendations: - Set to False by Default: You should explicitly set persist-credentials: false for all checkout steps unless your workflow specifically requires the ability to perform authenticated Git operations [2][3][8]. - Use Explicit Authentication: If you need to perform authenticated Git operations (such as pushing commits), do not rely on the persisted token. Instead, provide the token explicitly where needed (e.g., via the env context) [8]. - Harden Permissions: Beyond managing credential persistence, always ensure that the GITHUB_TOKEN is granted the minimum required permissions using the permissions key in your workflow file [10][11][8]. Usage Example: - uses: actions/checkout@v4 with: persist-credentials: false Citations:
Pin Lines 87, 162, 208, 250, and 314 use Commit SHA pinning also mitigates tag manipulation attacks. 🧰 Tools🪛 zizmor (1.26.1)[warning] 87-87: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 87-87: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
|
|
||
| - name: Free up disk space (macOS) | ||
| if: runner.os == 'macOS' | ||
|
|
@@ -159,7 +159,7 @@ jobs: | |
| runs-on: macos-14 | ||
| if: github.event_name != 'pull_request' || github.base_ref == 'main' | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
|
|
||
| - name: Free up disk space (macOS) | ||
| run: | | ||
|
|
@@ -205,7 +205,7 @@ jobs: | |
| runs-on: ubuntu-24.04 | ||
| if: github.event_name != 'pull_request' || github.base_ref == 'main' | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
|
|
||
| - name: Install Rust toolchain | ||
| uses: dtolnay/rust-toolchain@stable | ||
|
|
@@ -247,7 +247,7 @@ jobs: | |
| startsWith(github.ref, 'refs/tags/v') || | ||
| github.event.inputs.run_e2e == 'true' | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
|
|
||
| - name: Install Rust toolchain | ||
| uses: dtolnay/rust-toolchain@stable | ||
|
|
@@ -311,7 +311,7 @@ jobs: | |
| matrix: | ||
| target: [compose_yaml_parse, env_interpolation, compose_spec_json_round_trip] | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
|
|
||
| - name: Install nightly Rust + cargo-fuzz | ||
| run: | | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,7 +20,7 @@ jobs: | |
| name: github-pages | ||
| url: ${{ steps.deployment.outputs.page_url }} | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major 🧩 Analysis chain🏁 Script executed: cat -n .github/workflows/docs.yml | head -30Repository: PerryTS/perry Length of output: 1396 🏁 Script executed: rg "actions/checkout" .github/workflows/ -A 2 -B 2Repository: PerryTS/perry Length of output: 10533 🌐 Web query:
💡 Result: As of June 23, 2026, pinning GitHub Actions to a full-length commit SHA remains the industry-standard security best practice [1][2][3]. While major version tags (e.g., actions/checkout@v7) are convenient, they are mutable and can be updated by maintainers, potentially introducing breaking changes or malicious code [1][2][3]. Security Implications of Mutable Tags vs. SHA Pinning: 1. Immutability: A commit SHA is a unique, immutable identifier for a specific point in time in an action's codebase [1][2][3]. Tags can be moved or deleted, making them inherently less secure for supply chain integrity [1][2][3]. 2. Enforcement: GitHub allows organization-level policies to enforce full commit SHA pinning [4][5][3]. When enabled, workflows using tags will fail, ensuring compliance across an entire organization [5][3]. 3. Maintenance: To manage the overhead of manual updates, automation tools like Dependabot or Renovate should be used [6][4][5][3]. These tools can automatically open pull requests to update your SHA pins whenever a new version is released, providing the security of immutability with the convenience of automated maintenance [6][5][3]. Specifics for actions/checkout v7: - General Availability: actions/checkout v7 was released on June 18, 2026 [7][8]. It introduces significant security changes, specifically refusing to check out fork pull request code by default in pull_request_target and workflow_run events to prevent "pwn request" vulnerabilities [7][9][6]. - Backporting: GitHub will backport these security protections to all supported major versions (e.g., v4) on July 16, 2026 [7][6]. - Impact on Pinning: If you pin to a floating major tag (e.g., actions/checkout@v4), you will automatically receive this security patch on July 16 [7][6]. If you are pinned to a specific commit SHA, you will not receive the automatic update and must manually update your SHA pin to a v7-compatible version through your standard dependency management process [7][6]. Recommendation: Always pin to the full-length commit SHA of the action version you intend to use, and include the version tag as a comment for readability (e.g., uses: actions/checkout@3df4ab1 # v7.0.0) [1][3]. Use automated tools like Dependabot or Renovate to ensure these pins remain up to date [6][3]. Citations:
Pin The Suggested hardening- - uses: actions/checkout@v7
+ - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v7
+ with:
+ persist-credentials: false🧰 Tools🪛 zizmor (1.26.1)[warning] 23-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| - name: Install mdBook | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
Repository: PerryTS/perry
Length of output: 187
🏁 Script executed:
Repository: PerryTS/perry
Length of output: 1843
🏁 Script executed:
Repository: PerryTS/perry
Length of output: 197
🏁 Script executed:
Repository: PerryTS/perry
Length of output: 2121
🏁 Script executed:
Repository: PerryTS/perry
Length of output: 1996
🏁 Script executed:
Repository: PerryTS/perry
Length of output: 986
🏁 Script executed:
Repository: PerryTS/perry
Length of output: 1087
🏁 Script executed:
Repository: PerryTS/perry
Length of output: 830
🌐 Web query:
GitHub Actions security best practices actions/checkout persist-credentials false SHA pinning💡 Result:
To enhance the security of your GitHub Actions workflows, implementing both
persist-credentials: falseand full-length commit SHA pinning is highly recommended as a standard industry practice [1][2][3][4]. persist-credentials: false Theactions/checkoutaction defaults topersist-credentials: true, which stores your repository credentials (such as theGITHUB_TOKEN) in the local Git configuration (.git/configor~/.git-credentials) of the runner [5][6][2]. This persistence allows any subsequent step or third-party action in the same job to access and potentially misuse these credentials [2][7]. By settingpersist-credentials: false, you prevent the action from writing these credentials to the Git configuration, effectively limiting their exposure to other processes [1][2]. You should only set this totrueif your workflow explicitly requires authenticated Git operations (e.g., pushing commits back to the repository) [2]. SHA Pinning Pinning an action to its full-length commit SHA (e.g.,actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11) is the only way to ensure the action is immutable [8][4]. - Why it matters: Referencing actions by tags (e.g.,@v4) or branches (e.g.,@main) is risky because these references are mutable; a maintainer or an attacker who compromises the repository can force-push new, potentially malicious code to the same tag or branch [8][3][4]. - Enforcement: GitHub now supports organization-level policies that can enforce SHA pinning [9][10][3]. When enabled, any workflow using a non-pinned action will fail, preventing the use of mutable references [9][10]. - Maintenance: To manage the maintenance overhead of manually updating SHAs, it is best practice to use automated dependency tools like Dependabot or Renovate [9][10][3][4]. These tools can automatically open pull requests to update your pinned SHAs when new releases are available [10][3][4]. A common convention is to include the version tag as a comment alongside the SHA for human readability (e.g.,uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1) [3][4]. Top Results: [1][2][9][10][3][4]Citations:
persist-credentialsor change the default tofalseactions/checkout#485🌐 Web query:
GitHub Actions checkout v7 tag vs SHA pinning release workflow security💡 Result:
As of June 23, 2026, actions/checkout v7.0.0 has been released (published June 18, 2026) [1][2]. This release introduces significant security enhancements, most notably safer handling of fork pull requests: by default, the action now refuses to check out code from fork pull requests when a workflow is triggered by pull_request_target or workflow_run, preventing common "pwn request" vulnerabilities [3][4]. To opt in to this behavior, users must explicitly set the new allow-unsafe-pr-checkout: true input after reviewing the associated security risks [3][4]. Regarding security best practices for pinning, it is strongly recommended to pin GitHub Actions to a full 40-character commit SHA rather than a tag (such as
@v7) or branch [5][6][7][8]. Using a tag is inherently mutable; because tags can be moved or retargeted by maintainers (or attackers who have compromised a repository), relying on them exposes workflows to supply chain attacks where malicious code could be injected into an existing version tag [6][8]. A commit SHA is immutable, ensuring that the code executed remains exactly what was reviewed and tested [5][8]. Organizations and teams are encouraged to enforce SHA pinning via GitHub’s allowed actions policy [5][8]. To balance security with maintainability, teams often use automation tools like Dependabot or Renovate with presets (e.g., helpers:pinGitHubActionDigests) to automatically keep pinned commit SHAs up to date while maintaining the human-readable version tag in a comment for visibility [6][7][8]. Example of a secure pinning configuration: - uses: actions/checkout@3df4ab1 # v7.0.0 This approach leverages the immutability of the SHA while documenting the version for clarity [8].Citations:
Pin actions/checkout to commit SHA and disable credential persistence for read-only benchmark jobs.
At lines 39, 207, and 304,
actions/checkout@v7uses tag-only pinning, which is mutable and vulnerable to supply-chain attacks. Additionally, credential persistence is left enabled by default, creating unnecessary token exposure. Since these jobs only read code and do not perform authenticated Git operations, they should pin to a full commit SHA and explicitly disable credentials.Suggested hardening pattern
For line 39-42 (with existing
with:keys):For lines 207 and 304 (no existing
with:block):Use Dependabot or Renovate with SHA pinning helpers to keep the commit references up to date.
Also applies to: 207-207, 304-304
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 39-42: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 39-39: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Source: Linters/SAST tools