ci: Add actionlint and zizmor workflow linting - #11
Conversation
Reviewer's GuideIntroduces pinned actionlint and zizmor checks for workflow changes, then hardens the existing workflows to satisfy those checks through least-privilege permissions, immutable action references, safer checkout and shell-output handling, and isolated dependency submission. Dependabot updates also receive ecosystem-specific cooldown periods. Sequence diagram for workflow lintingsequenceDiagram
participant Trigger as Workflow change or schedule
participant Lint as Lint workflows
participant Checkout as actions/checkout
participant Actionlint as actionlint
participant Zizmor as zizmor
Trigger->>Lint: Start lint workflow
Lint->>Checkout: Checkout workflows
Checkout-->>Lint: Repository files
Lint->>Actionlint: Run actionlint
Lint->>Zizmor: Run zizmor on .github/
Actionlint-->>Lint: Schema and shell checks
Zizmor-->>Lint: Security checks
Sequence diagram for hardened snapshot deploymentsequenceDiagram
participant Build as Build any branch
participant Deploy as Deploy Snapshot
participant Checkout as actions/checkout
participant Maven as Maven Central
Build-->>Deploy: Completed run on main
Deploy->>Checkout: Checkout default branch
Deploy->>Deploy: Get project version
alt Snapshot version
Deploy->>Maven: Deploy snapshot
else Release version
Deploy-->>Deploy: Skip deployment
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe pull request tightens GitHub Actions permissions, isolates dependency submission, adds Dependabot cooldowns, restricts snapshot deployments, and introduces automated workflow linting with actionlint and zizmor. ChangesGitHub automation security controls
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to The workflow hardening and linting changes do not leave an identified merge-blocking risk. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've reviewed your changes and they look great!
Sourcery assessment
Needs a human reviewer. The deployment workflow now checks out the default branch instead of the SHA that triggered the completed build, and the shown workflow_run trigger has no branch filter. A successful run from another branch could therefore publish the default branch's snapshot; reverting prevents future occurrences but cannot retract an artifact already published to Maven Central.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7aaf73a7ed
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # zizmor: ignore[dangerous-triggers] | ||
| # workflow_run is safe here: the branches filter only matches runs on main | ||
| # (a fork PR's build runs under its own branch name), the job checks out the | ||
| # default branch rather than any attacker-controlled ref, and it consumes no |
There was a problem hiding this comment.
When the project version is a -SNAPSHOT, a main push at A can finish its build and a later commit B can land before this workflow starts; this default-branch checkout then resolves B even though only A passed compile-and-unit-test. The subsequent mvn deploy -DskipTests can therefore publish B to Maven Central without its build/test gate (including when B later fails CI); retain github.event.workflow_run.head_sha or otherwise pin checkout to the triggering run's SHA.
Useful? React with 👍 / 👎.
Reduce the token exposure and shell-injection surface of the workflows
without changing what they do:
* Move dependency submission out of the build job into its own
`submit-dependencies` job (as core and spring-boot already do), so the
`contents: write` token is never present while `mvn clean verify` runs
a build of pull-request code. Drop the workflow-level permissions to
`{}` and scope each job.
* Set `persist-credentials: false` on the checkouts that never reuse the
token for a `git` operation.
* Drop the `workflow_run` checkout's `ref:` so Deploy Snapshot builds the
default branch rather than the triggering commit, which on a
`workflow_run` can be a fork's.
* Quote `$GITHUB_OUTPUT`, and pass the resolved version through `env:`
into the run step.
* Pin `advanced-security/maven-dependency-submission-action` to a commit
SHA; the floating `v5` tag has no matching release tag to name, so this
moves to `v6.0.1`.
* Record why the `workflow_run` trigger is not exploitable: the branch
filter excludes fork PRs, the job checks out the default branch, and it
reuses no artifact from the triggering run.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ
Give a bad or compromised release time to be yanked before Dependabot opens a PR for it: seven days for Maven dependencies, and a shorter three days for GitHub Actions so security-relevant pin bumps still land quickly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ
Add a "Lint workflows" workflow that runs actionlint (workflow schema plus shellcheck on `run:` scripts) and zizmor (workflow security) on every change under `.github/` and weekly on a schedule. Both tool versions are pinned. `.github/zizmor.yml` accepts tag pins for actions from GitHub's own orgs (`actions/*`, `github/*`, `dependabot/*`) and requires a commit SHA for anything else, and keeps the workspace-relative `./...` action syntax rather than the very recent `$/...` form. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ
7aaf73a to
d8fd155
Compare
|
@coderabbitai review |
✅ Action performedReview finished.
|
1 participant
Adds actionlint + zizmor linting for the GitHub Actions workflows, plus the
hardening to pass them clean. Same setup as
dbunit/dbunit-extension. Bothlinters pass clean locally.
ci: Add actionlint and zizmor workflow lintingactionlint(schema + shellcheck) andzizmor(workflow security), tool versions pinned, on.github/**PRs and aweekly schedule.
.github/zizmor.yml— tags allowed foractions/*/github/*/dependabot/*, commit SHA required for anything else; the new$/…self-repository
uses:syntax deferred.ci(dependabot): Add a cooldown before opening update PRsci: Harden the GitHub Actions workflowspermissions:blocks andpersist-credentials: false.workflow_runcheckouts dropref: …head_sha— Deploy Snapshot now builds the default branch, not the (possibly fork) triggeringcommit.
dangerous-triggerssuppressed with a justification comment.$GITHUB_OUTPUTand$(date …); step outputs routed throughenv:.advanced-security/maven-dependency-submission-actionpinned to a commit SHA(the floating
v5tag has no matching release tag, so this moves tov6.0.1).submit-dependenciesjob, so acontents: writetoken is never present whilemvn clean verifyruns a build of pull-request code.🤖 Generated with Claude Code
https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ
Summary by Sourcery
Harden the repository’s GitHub Actions automation with security linting, safer permissions, and controlled dependency updates.
New Features:
Enhancements:
CI:
Summary by CodeRabbit