chore(deps)!: Update GitHub Actions (major) #34
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -60,7 +60,7 @@ jobs: | |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
|
|
@@ -169,12 +169,12 @@ jobs: | |
| # export-type: env | ||
|
|
||
| - name: Authenticate to Google Cloud | ||
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 | ||
| with: | ||
| credentials_json: ${{ secrets.GCP_SA_KEY_BASE64 }} | ||
|
|
||
|
Comment on lines
+172
to
175
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: cat .github/workflows/publish-artifact-registry.ymlRepository: ByronWilliamsCPA/python-libs Length of output: 8895 🏁 Script executed: cat .github/workflows/publish-artifact-registry.yml | head -200Repository: ByronWilliamsCPA/python-libs Length of output: 6976 🏁 Script executed: cat .github/workflows/publish-artifact-registry.ymlRepository: ByronWilliamsCPA/python-libs Length of output: 8895 🌐 Web query:
💡 Result: The credentials_json input for the google-github-actions/auth GitHub Action expects the raw content of a Google Cloud Service Account Key JSON file [1][2]. To use this input correctly: 1. Format: The value must be the valid JSON object exported from the Google Cloud Console for a Service Account [2]. 2. Storage: It is strongly recommended to store this JSON as a GitHub Actions Secret [1][2]. 3. Best Practice: The documentation advises minifying the JSON into a single-line string before saving it as a GitHub Secret [1]. This prevents issues where GitHub Actions might aggressively sanitize or mask characters (such as curly braces or brackets) if the secret contains multiple lines [1]. 4. Usage in YAML: Reference the secret in your workflow file as follows [1][2]: - uses: 'google-github-actions/auth@v3' with: credentials_json: '${{ secrets.YOUR_SECRET_NAME }}' Important Security Note: Google and the maintainers of google-github-actions/auth strongly prefer using Workload Identity Federation over Service Account Key JSONs [1][3][4]. Workload Identity Federation eliminates the need for long-lived keys, which are a significant security risk if compromised [3][4]. If you must use credentials_json, ensure the service account has the roles/iam.serviceAccountTokenCreator role on itself [1][2]. Citations:
Fix credentials_json to receive raw JSON, not base64-encoded. The Store the raw JSON key (minified) as a separate secret (e.g., 🤖 Prompt for AI Agents |
||
| - name: Set up Cloud SDK | ||
| uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3 | ||
|
|
||
| - name: Configure Artifact Registry authentication | ||
| env: | ||
|
|
@@ -190,7 +190,7 @@ jobs: | |
| echo "📦 Registry URL: $AR_URL" | ||
|
|
||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | ||
| with: | ||
| version: ${{ env.UV_VERSION }} | ||
| enable-cache: true | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -46,12 +46,12 @@ jobs: | |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | ||
| with: | ||
| enable-cache: true | ||
|
|
||
|
|
@@ -70,13 +70,13 @@ jobs: | |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: | ||
| fetch-depth: 0 | ||
| token: "${{ secrets.GITHUB_TOKEN }}" | ||
|
|
||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | ||
| with: | ||
| enable-cache: true | ||
|
|
||
|
|
@@ -88,7 +88,7 @@ jobs: | |
|
|
||
| - name: Python Semantic Release | ||
| id: release | ||
| uses: python-semantic-release/python-semantic-release@350c48fcb3ffcdfd2e0a235206bc2ecea6b69df0 # v10.5.3 | ||
| with: | ||
| github_token: "${{ secrets.GITHUB_TOKEN }}" | ||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -46,17 +46,17 @@ jobs: | |
| egress-policy: audit | ||
|
|
||
| - name: Checkout repository | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | ||
| with: | ||
| python-version: "3.12" | ||
|
|
||
| - name: Install UV | ||
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | ||
| with: | ||
| enable-cache: true | ||
|
|
||
|
|
@@ -81,14 +81,14 @@ jobs: | |
| echo "hashes=$HASHES" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Upload build artifacts | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | ||
| with: | ||
| name: dist-${{ steps.version.outputs.version }} | ||
| path: dist/ | ||
| retention-days: 90 | ||
|
|
||
| - name: Generate artifact attestation | ||
| uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 | ||
| with: | ||
| subject-path: 'dist/*' | ||
|
|
||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/ci.yml | head -250Repository: ByronWilliamsCPA/python-libs
Length of output: 9248
Disable persisted Git credentials in all PR-executed checkout actions.
Lines 45, 74, 122, 166, and 191 perform
checkoutinpull_requestworkflows. Since none of the subsequent steps require authenticated git operations, addpersist-credentials: falseto each checkout action to follow the principle of least privilege and reduce attack surface.Required changes
- name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: falseApply this change to lines 45, 74, 122, 166, and 191.
🤖 Prompt for AI Agents