Repository navigation
chore(deps): batch bump cargo and actions dependencies #181
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -19,7 +19,7 @@ jobs: | |
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| steps: | ||
| - uses: actions/checkout@v7.0.1 | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
file=".github/workflows/issue-163-final-review-sweep.yml"
wc -l "$file"
cat -n "$file"Repository: Microck/kagi-cli Length of output: 4228 🤖 get_repo_knowledge executed:
Length of output: 20988 🏁 Script executed: #!/bin/bash
set -eu
cat -n .github/workflows/issue-163-final-review-sweep.ymlRepository: Microck/kagi-cli Length of output: 4174 🏁 Script executed: #!/bin/bash
set -eu
sed -n '1,220p' .github/workflows/issue-163-final-review-sweep.ymlRepository: Microck/kagi-cli Length of output: 3663 🌐 Web query:
💡 Result: The persist-credentials input for the GitHub actions/checkout action determines whether the repository's authentication token or SSH key is configured in the local git config [1][2]. When set to true (the default value in existing versions of the action), the action automatically configures the token or SSH key in the local git config [1][2][3]. This allows subsequent steps in your workflow to execute authenticated git commands (such as git push or git pull) without requiring additional configuration [1][4]. The action automatically cleans up these credentials during the post-job phase [1][5]. While there has been ongoing discussion and pull requests within the actions/checkout repository to change this default to false for improved security, it remains true in the current official documentation [6][1][5]. To opt out of this behavior, you should explicitly set persist-credentials to false in your workflow file [1][2][3]: - uses: actions/checkout@v4 with: persist-credentials: false The action's documentation notes that it has implemented improvements to credential security, such as storing credentials in a separate file under $RUNNER_TEMP rather than directly within the.git/config file, helping to reduce security risks while maintaining existing functionality [1][5]. Citations:
Sensitive Data Exposure (CWE-522): Insufficiently Protected Credentials Exploitability: Difficult Keep the GitHub token away from repository checks.
Set 🧰 Tools🪛 zizmor (1.29.0)[warning] 22-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| with: | ||
| ref: feat/issue-163-usage | ||
| fetch-depth: 0 | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: Microck/kagi-cli
Length of output: 12859
🤖 get_repo_knowledge executed:
get_repo_knowledge Microck/kagi-cli /tmp/coderabbit-repo-knowledge/microck-kagi-cli-210acbc3/architecture /tmp/coderabbit-repo-knowledge/microck-kagi-cli-210acbc3/conventionsLength of output: 21957
🌐 Web query:
actions/checkout persist-credentials default true GitHub token untrusted pull request official documentation💡 Result:
In the official actions/checkout GitHub Action, the persist-credentials input defaults to true [1][2][3]. When this is enabled, the action configures the authentication token (or SSH key) into the local Git configuration of the runner [1][4][3]. This allows subsequent steps in the workflow to execute authenticated Git commands without needing to re-authenticate [1][4]. From a security perspective, leaving persist-credentials set to true (the default) creates a risk when checking out untrusted code, such as from a pull request [5][6]. If a workflow is triggered by an event that provides a privileged token (like pull_request_target or workflow_run), and that workflow subsequently executes untrusted code—such as build scripts, test runners, or third-party actions—that code can potentially access the persisted token from the local environment [7][5][6]. Security best practices, including guidance from the OWASP GitHub Actions Security Cheat Sheet, recommend explicitly setting persist-credentials: false unless your workflow specifically requires authenticated Git operations [6]. This setting ensures that Git credentials are not left in the workspace environment, minimizing the risk of unauthorized access if the workflow execution is compromised [5][6]. While some community members have advocated for changing the default to false to improve security, as of September 2026, it remains true by default [8][9]. Some updates have been implemented to improve credential handling—such as storing credentials in a separate file under $RUNNER_TEMP rather than directly in.git/config—to reduce the risk of accidental exposure [3]. However, explicitly disabling persistence is still widely considered the recommended security configuration for workflows that handle untrusted inputs [7][5][6].
Citations:
🏁 Script executed:
Repository: Microck/kagi-cli
Length of output: 2440
Sensitive Data Exposure (CWE-522): Insufficiently Protected Credentials
Reachability: External · Exploitability: Moderate
Disable checkout credential persistence before running repository-controlled Cargo code.
Both workflows run Cargo commands after checkout. Add
persist-credentials: falseto the checkout steps in.github/workflows/ci.ymland.github/workflows/coverage.yml.🧰 Tools
🪛 zizmor (1.29.0)
[warning] 22-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 2 files
.github/workflows/ci.yml#L23-L23(this comment).github/workflows/coverage.yml#L21-L21🤖 Prompt for AI Agents
Source: Linters/SAST tools