chore(guard): sync vendored public-repo-guard to canonical - #19
chore(guard): sync vendored public-repo-guard to canonical#19wave-av-release-bot[bot] wants to merge 1 commit into
Conversation
|
PR author is in the excluded authors list. |
ApprovabilityVerdict: Needs human review Unable to check for correctness in 921f176. This PR updates the actions/checkout version and adds security hardening (persist-credentials: false) to the public-repo-guard workflow. While the changes are beneficial and low-risk, the file is owned by wave-av/streaming-team and the bot author is not a designated owner, so the owning team should review. You can customize Macroscope's approvability policy. Learn more. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| # Checkout defaults to persisting the job token for later steps: since v6 it | ||
| # lives in a file under $RUNNER_TEMP referenced from .git/config, no longer in | ||
| # .git/config itself. It is still a live credential in the job, and this job | ||
| # downloads a third-party binary (gitleaks, below) and runs it over the whole | ||
| # tree. Nothing here pushes -- the scan is `--no-git` over the working tree -- | ||
| # so no step needs authenticated Git; drop it. (zizmor: artipacked) | ||
| persist-credentials: false |
There was a problem hiding this comment.
🟡 Change log not updated for this change
The project's contribution rules require every pull request to add an entry under the "Unreleased" heading of the change log, but this change updates the security-gate workflow (.github/workflows/public-repo-guard.yml:45-53) without adding any note there.
Impact: The release notes will be missing a record of this update, so maintainers tracking changes will not see it.
Rule source and current state of the change log
CONTRIBUTING.md under "PR shape" states: "Update CHANGELOG.md under the unreleased heading." The ## [Unreleased] section in CHANGELOG.md is currently empty and no change-log edit is part of this PR.
Prompt for agents
CONTRIBUTING.md requires each PR to record its change under the '## [Unreleased]' heading in CHANGELOG.md. This PR upgrades actions/checkout to v7 and disables credential persistence in .github/workflows/public-repo-guard.yml but adds no changelog entry. Add a short entry (e.g. under a 'Changed' or 'Security' subheading of Unreleased) describing the checkout pin bump and persist-credentials: false hardening.
Was this helpful? React with 👍 or 👎 to provide feedback.
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| # Checkout defaults to persisting the job token for later steps: since v6 it | ||
| # lives in a file under $RUNNER_TEMP referenced from .git/config, no longer in | ||
| # .git/config itself. It is still a live credential in the job, and this job | ||
| # downloads a third-party binary (gitleaks, below) and runs it over the whole | ||
| # tree. Nothing here pushes -- the scan is `--no-git` over the working tree -- | ||
| # so no step needs authenticated Git; drop it. (zizmor: artipacked) | ||
| persist-credentials: false |
There was a problem hiding this comment.
🔍 Checkout action pin now inconsistent across workflows
This workflow is bumped to actions/checkout v7 with persist-credentials: false, while .github/workflows/_checks.yml:23,54,114 still pin v4.3.1 and .github/workflows/clang-format.yml:21 pins v6.0.3, none of which set persist-credentials: false. If the intent is repo-wide hardening (zizmor artipacked), the other workflows remain unhardened; if the intent is only to sync the vendored guard from the canonical copy, this is expected but worth a follow-up to avoid three divergent checkout pins.
Was this helpful? React with 👍 or 👎 to provide feedback.
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
There was a problem hiding this comment.
🔍 Action SHA pin cannot be verified from the repo
The commit SHA 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 is annotated as v7.0.0, but nothing in the repository lets that mapping be checked. Given this workflow is itself the pre-publication security gate and the file's header emphasizes deterministic, self-contained pinning, it is worth confirming the SHA resolves to the intended actions/checkout release tag before merge.
Was this helpful? React with 👍 or 👎 to provide feedback.
Syncs the vendored
public-repo-guardtrio to the canonical source inwave-foundation/scaffolder/public-repo-guard.internal-ipleak rule (Tailscale-CGNAT100.64.0.0/10), lockstep with the pre-publish mirror gateEach changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own
Secrets + content policygate re-scans this PR.🤖 Generated with Claude Code
Note
Update
public-repo-guardworkflow to useactions/checkoutv7 without persisted credentialsSyncs public-repo-guard.yml to the canonical version. Upgrades
actions/checkoutfrom v5.0.1 to v7.0.0 and setspersist-credentials: falseso theGITHUB_TOKENis no longer stored in the repository's Git config after checkout.Macroscope summarized 921f176.
Summary by cubic
Syncs the vendored
public-repo-guardwithwave-foundation/scaffolder/public-repo-guardto keep rules and CI in lockstep. Adds theinternal-ipleak rule (Tailscale CGNAT 100.64.0.0/10) and hardens the workflow by moving toactions/checkout@v7withpersist-credentials: false; changes are byte-for-byte identical to canonical.Written for commit 921f176. Summary will update on new commits.