fix(ci): pin standards reusables to default-branch HEAD #56
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -22,5 +22,5 @@ jobs: | |
| contents: read | ||
| pull-requests: write | ||
| actions: read | ||
| uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🤖 get_repo_knowledge executed:
Length of output: 10064 🏁 Script executed: #!/bin/sh
set -eu
printf '%s\n' '--- caller workflow ---'
cat -n .github/workflows/secret-scanner.yml
printf '%s\n' '--- referenced workflow at pinned commit ---'
url='https://raw.githubusercontent.com/hyperpolymath/standards/8f2ee50841e216cd8c192eeb68953118190f105c/.github/workflows/secret-scanner-reusable.yml'
curl -fsSL "$url" | cat -n
printf '%s\n' '--- relevant local workflow references ---'
rg -n -C 3 'secret-scanner-reusable|pull-requests: write|actions: read|contents: read' .github/workflowsRepository: hyperpolymath/typell Length of output: 50376 🌐 Web query:
💡 Result: Yes, official GitHub Actions documentation confirms that GITHUB_TOKEN permissions passed from a caller workflow to a reusable (called) workflow can only be downgraded, not elevated [1][2][3][4]. If a called workflow attempts to request higher permissions than those granted by the caller, it will not succeed [5]. Effectively, the permissions defined in the caller workflow act as a ceiling for the called workflow [5]. In a chain of nested reusable workflows (e.g., A -> B -> C), the permissions must remain the same or become more restrictive throughout the entire chain [6][1][3]. Key points regarding these permissions include: - Default Behavior: If the jobs.<job_id>.permissions key is not specified in the calling job, the called workflow uses the default GITHUB_TOKEN permissions [1][2][4]. - Security Ceiling: Because the called workflow cannot elevate permissions beyond what the caller provides, the caller must explicitly grant any necessary higher-level permissions if the called workflow requires them [5]. - Nested Workflows: The rule applies to the entire chain of nested workflows. For instance, if workflow A grants read access, workflows B and C cannot upgrade to write access [1][2][3]. - OIDC Tokens: Specifically for OpenID Connect (OIDC), if a called workflow requires an OIDC token, the id-token: write permission must be explicitly set at the caller workflow level [7]. Failure to adhere to these constraints, such as a called workflow requiring more permissions than the caller provides, can result in errors, sometimes manifesting as a startup_failure [5]. Citations:
🏁 Script executed: #!/bin/sh
set -eu
cat -n .github/workflows/secret-scanner.yml
curl -fsSL 'https://raw.githubusercontent.com/hyperpolymath/standards/8f2ee50841e216cd8c192eeb68953118190f105c/.github/workflows/secret-scanner-reusable.yml' | cat -nRepository: hyperpolymath/typell Length of output: 43368 Security Misconfiguration Reachability: External Align the caller permissions with the reusable workflow. The current called jobs declare only 🤖 Prompt for AI AgentsSource: MCP tools There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- caller workflow ---'
cat -n .github/workflows/secret-scanner.yml
printf '%s\n' '--- pinned reusable workflow ---'
curl --fail --silent --show-error --location \
'https://raw.githubusercontent.com/hyperpolymath/standards/8f2ee50841e216cd8c192eeb68953118190f105c/.github/workflows/secret-scanner-reusable.yml' \
| cat -nLength of output: 43779
Add Coding Agent trial credits or activate Agent usage billing before starting this turn. You are interacting with an AI system. |
||
| secrets: inherit | ||
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: hyperpolymath/typell
Length of output: 348
🏁 Script executed:
Repository: hyperpolymath/typell
Length of output: 8463
🤖 get_repo_knowledge executed:
get_repo_knowledge hyperpolymath/typell /tmp/coderabbit-repo-knowledge/hyperpolymath-typell-9fa7f706/architectureLength of output: 10064
Add the
pull_requesttrigger..github/workflows/scorecard.ymlcurrently triggers only onbranch_protection_ruleandschedule. The reusable workflow'spull-requestjob therefore never runs. Addpull_request:underon. The caller grantssecurity-events: write, so SARIF upload is permitted.🤖 Prompt for AI Agents
Source: MCP tools
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
yes, do it rabbit
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@hyperpolymath, I will add thepull_requesttrigger to.github/workflows/scorecard.yml. This change will preserve the existing triggers and permissions.pull_request:underonin.github/workflows/scorecard.yml.branch_protection_rule,schedule, reusable-workflow pin, and permissions.🐇
Add Coding Agent trial credits or activate Agent usage billing before starting this turn.
You are interacting with an AI system.