fix(ci): resolve all zizmor findings and add zizmor pre-commit checks#2053
fix(ci): resolve all zizmor findings and add zizmor pre-commit checks#2053gforsyth wants to merge 2 commits intorapidsai:mainfrom
Conversation
gforsyth
added
improvement
gforsyth
added
improvement
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdd workflow-level default-deny ChangesGlobal permission and job-scope updates
Action pinning & checkout hardening
Scoped secret and restricted publish jobs
Baseline workflows and push re-authentication
Zizmor policy and pre-commit hook
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/build.yaml:
- Around line 243-246: Replace the broad "secrets: inherit" usage for the job
that does "uses: ./.github/workflows/publish-rust.yaml" with an explicit mapping
that only passes the required secret(s) (e.g., CRATES_IO_TOKEN) to the reusable
workflow, and update the called workflow publish-rust.yaml to declare that
secret under on.workflow_call.secrets so the contract is explicit; specifically
remove or change "secrets: inherit" to something like "secrets: {
CRATES_IO_TOKEN: ${{ secrets.CRATES_IO_TOKEN }} }" and add the corresponding
secret declaration in publish-rust.yaml's on.workflow_call.secrets block.
In @.github/workflows/store-c-abi-baseline.yaml:
- Around line 21-23: The workflow disables checkout credentials via the
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 step by setting
persist-credentials: false, which will prevent subsequent git push to the
baselines branch from authenticating; either re-enable persisted credentials
(remove or set persist-credentials: true on the actions/checkout step) or add an
explicit auth step after checkout (e.g., set up a PAT/GITHUB_TOKEN via
actions/setup-node or actions/configure-aws-credentials style step and configure
git remote creds) so the later git push can authenticate successfully.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b5285516-af67-4713-be1f-a77eac863194
📒 Files selected for processing (11)
.github/workflows/build.yaml.github/workflows/check-c-abi.yaml.github/workflows/labeler.yml.github/workflows/pr.yaml.github/workflows/publish-rust.yaml.github/workflows/store-c-abi-baseline.yaml.github/workflows/test.yaml.github/workflows/trigger-breaking-change-alert.yaml.github/workflows/update-c-abi-baseline.yaml.github/zizmor.yml.pre-commit-config.yaml
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/build.yaml:
- Around line 243-247: The publish workflow's secret is miswired: add a secrets
declaration to the publish workflow's on.workflow_call (declare
GPUTESTER_CRATES_TOKEN with required: true) so the called workflow exposes the
secret, and in the calling workflow change the passed secret name from
GPU_CRATES_TOKEN to GPUTESTER_CRATES_TOKEN so that the referenced
secrets.GPUTESTER_CRATES_TOKEN is defined and can be assigned to
CARGO_REGISTRY_TOKEN during the publish step.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c09bddc8-95e9-41f4-ac6d-0693ca21ff9b
📒 Files selected for processing (2)
.github/workflows/build.yaml.github/workflows/store-c-abi-baseline.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/store-c-abi-baseline.yaml
| permissions: | ||
| contents: read | ||
| secrets: | ||
| GPU_CRATES_TOKEN: ${{ secrets.GPUTESTER_CRATES_TOKEN }} | ||
| uses: ./.github/workflows/publish-rust.yaml |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify publish-rust.yaml's on.workflow_call section for secrets declaration
echo "=== Checking publish-rust.yaml workflow_call secrets declaration ==="
rg -n -A10 'on:' .github/workflows/publish-rust.yaml | head -30
echo ""
echo "=== Checking how the secret is used in publish-rust.yaml ==="
rg -n 'secrets\.' .github/workflows/publish-rust.yamlRepository: rapidsai/cuvs
Length of output: 846
🏁 Script executed:
# Read the on: section from publish-rust.yaml to see complete workflow_call
head -20 .github/workflows/publish-rust.yaml
# Also verify build.yaml lines around 243-247
sed -n '240,250p' .github/workflows/build.yamlRepository: rapidsai/cuvs
Length of output: 718
🏁 Script executed:
# Confirm the CARGO_REGISTRY_TOKEN reference in publish-rust.yaml
grep -n -B2 -A2 'CARGO_REGISTRY_TOKEN' .github/workflows/publish-rust.yamlRepository: rapidsai/cuvs
Length of output: 446
Secret wiring is broken — Rust publish will fail.
The publish-rust.yaml workflow does not declare any secrets in its on.workflow_call block (lines 3-4), yet it directly references secrets.GPUTESTER_CRATES_TOKEN at line 66 to set CARGO_REGISTRY_TOKEN. Additionally, the secret passed from build.yaml is named GPU_CRATES_TOKEN, which doesn't match the referenced name. When the workflow runs, CARGO_REGISTRY_TOKEN will be undefined and cargo publish will fail.
To fix, make coordinated changes in both files:
- In
publish-rust.yaml, add the secrets declaration:
on:
workflow_call:
secrets:
GPUTESTER_CRATES_TOKEN:
required: true- In
build.yaml, pass the secret with the correct name:
secrets:
- GPU_CRATES_TOKEN: ${{ secrets.GPUTESTER_CRATES_TOKEN }}
+ GPUTESTER_CRATES_TOKEN: ${{ secrets.GPUTESTER_CRATES_TOKEN }}🧰 Tools
🪛 actionlint (1.7.12)
[error] 246-246: secret "GPU_CRATES_TOKEN" is not defined in "./.github/workflows/publish-rust.yaml" reusable workflow. no secret is defined
(workflow-call)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/build.yaml around lines 243 - 247, The publish workflow's
secret is miswired: add a secrets declaration to the publish workflow's
on.workflow_call (declare GPUTESTER_CRATES_TOKEN with required: true) so the
called workflow exposes the secret, and in the calling workflow change the
passed secret name from GPU_CRATES_TOKEN to GPUTESTER_CRATES_TOKEN so that the
referenced secrets.GPUTESTER_CRATES_TOKEN is defined and can be assigned to
CARGO_REGISTRY_TOKEN during the publish step.
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/build.yaml (1)
245-247:⚠️ Potential issue | 🟠 Major | ⚡ Quick win
rust-publishsecret contract is still incomplete and breaks reusable-workflow validation.
build.yamlnow passesGPUTESTER_CRATES_TOKEN(Line 246), but./.github/workflows/publish-rust.yamlmust declare that secret underon.workflow_call.secrets; otherwise actionlint continues failing and publish can’t reliably receive the token.Proposed fix in
.github/workflows/publish-rust.yamlon: workflow_call: + secrets: + GPUTESTER_CRATES_TOKEN: + required: trueBased on learnings: Ensure that CI passes all status checks before a pull request can be merged.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/build.yaml around lines 245 - 247, The reusable workflow publish-rust.yaml is missing a declaration for the GPUTESTER_CRATES_TOKEN secret under on.workflow_call.secrets, causing actionlint to fail when build.yaml passes that secret; add an entry named GPUTESTER_CRATES_TOKEN to the on.workflow_call.secrets block in publish-rust.yaml so the secret contract matches what build.yaml provides (ensure the secret name exactly matches GPUTESTER_CRATES_TOKEN).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In @.github/workflows/build.yaml:
- Around line 245-247: The reusable workflow publish-rust.yaml is missing a
declaration for the GPUTESTER_CRATES_TOKEN secret under
on.workflow_call.secrets, causing actionlint to fail when build.yaml passes that
secret; add an entry named GPUTESTER_CRATES_TOKEN to the
on.workflow_call.secrets block in publish-rust.yaml so the secret contract
matches what build.yaml provides (ensure the secret name exactly matches
GPUTESTER_CRATES_TOKEN).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 48444b11-fd3c-496f-9849-13ea3a5cca94
📒 Files selected for processing (3)
.github/workflows/build.yaml.github/workflows/publish-rust.yaml.github/workflows/store-c-abi-baseline.yaml
🚧 Files skipped from review as they are similar to previous changes (2)
- .github/workflows/publish-rust.yaml
- .github/workflows/store-c-abi-baseline.yaml
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/build.yaml (1)
227-229:⚠️ Potential issue | 🔴 Critical | ⚡ Quick win
rust-publishsecret pass-through is still broken at the reusable-workflow boundary.Line 228 forwards
GPUTESTER_CRATES_TOKEN, but./.github/workflows/publish-rust.yamlstill needs that secret declared underon.workflow_call.secrets; otherwise this call fails at runtime/validation.Proposed fix (in
.github/workflows/publish-rust.yaml)on: workflow_call: + secrets: + GPUTESTER_CRATES_TOKEN: + required: true🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build.yaml around lines 227 - 229, The reusable workflow publish-rust.yaml is missing a declaration for the forwarded secret, so add GPUTESTER_CRATES_TOKEN under on.workflow_call.secrets in publish-rust.yaml (e.g., ensure the on.workflow_call.secrets map includes GPUTESTER_CRATES_TOKEN: { required: true } or similar) so the call from the parent workflow (which passes GPUTESTER_CRATES_TOKEN) validates and the secret is available to the publish-rust workflow.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/build.yaml:
- Around line 227-229: The reusable workflow publish-rust.yaml is missing a
declaration for the forwarded secret, so add GPUTESTER_CRATES_TOKEN under
on.workflow_call.secrets in publish-rust.yaml (e.g., ensure the
on.workflow_call.secrets map includes GPUTESTER_CRATES_TOKEN: { required: true }
or similar) so the call from the parent workflow (which passes
GPUTESTER_CRATES_TOKEN) validates and the secret is available to the
publish-rust workflow.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 9422c2a2-2ca1-48fa-9300-20d3c37de50e
📒 Files selected for processing (4)
.github/workflows/build.yaml.github/workflows/pr.yaml.github/workflows/test.yaml.github/workflows/trigger-breaking-change-alert.yaml
✅ Files skipped from review due to trivial changes (1)
- .github/workflows/test.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/pr.yaml
fix(ci): ignore `secrets-inherit` for `shared-workflows` fix(ci): add explicit permissions to every job fix(ci): allow "dangerous triggers" fix(ci): pin all third-party actions fix(ci): don't persist credentials unless needed fix(ci): only pass crates token to publish rust fix(c-abi-baseline): add credentials for the c-abi-baseline commit chore: suppress trusted publishing warning fix: remove unnecessary secret passing refactor(ci): pare back permissions
|
Recently a workaround was added for an unrelated CI failure with PR: #2062 Have updated this PR to pull those changes in and rerun CI |
4 participants
Similar to upstream changes in
shared-workflows, this PR cleans up and annotates all of the workflows and adds thezizmorlinter to make sure changes are checked.Part of rapidsai/build-planning#275