build(deps): consolidate dependency updates - #3420
Conversation
📝 WalkthroughWalkthroughThe pull request updates ChangesDependency and workflow refresh
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
The latest Buf updates on your PR. Results from workflow CI / buf-check (pull_request).
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3420 +/- ##
==========================================
- Coverage 62.42% 62.38% -0.05%
==========================================
Files 121 121
Lines 13467 13467
==========================================
- Hits 8407 8401 -6
- Misses 4121 4125 +4
- Partials 939 941 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
.github/workflows/update-onboarding-skill.yml (1)
17-18: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winUse an immutable checkout revision.
actions/checkout@v7.0.1is a mutable tag. Use the immutable v7.0.1 commit SHA already used in.github/workflows/benchmark.yml.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/update-onboarding-skill.yml around lines 17 - 18, Update the checkout step’s actions/checkout reference to the immutable v7.0.1 commit SHA already used in the benchmark workflow, replacing the mutable v7.0.1 tag while preserving the existing checkout configuration..github/workflows/benchmark.yml (1)
26-26: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winRemove persisted checkout credentials from jobs that do not need remote Git access.
actions/checkoutstoresGITHUB_TOKENin.git/configby default. These jobs build, test, lint, publish packages, or upload artifacts. Addpersist-credentials: falseunless a later step requires authenticated Git access. Verify local actions and the benchmark action before applying the setting.
.github/workflows/benchmark.yml#L26-L26: disable persistence for the EVM benchmark checkout..github/workflows/benchmark.yml#L58-L58: disable persistence for the Spamoor benchmark checkout..github/workflows/benchmark.yml#L86-L86: disable persistence for the ERC20 benchmark checkout..github/workflows/benchmark.yml#L108-L108: disable persistence for the DeFi benchmark checkout..github/workflows/benchmark.yml#L131-L131: disable persistence for the state-pressure benchmark checkout..github/workflows/benchmark.yml#L158-L158: disable persistence for the publishing checkout; keep the benchmark action's explicitgithub-token..github/workflows/ci.yml#L21-L21: disable persistence after verifyingdorny/paths-filterauthentication requirements..github/workflows/docker-build-push.yml#L31-L31: disable persistence before sending the repository to Docker..github/workflows/rust-lint.yml#L22-L22: disable persistence for the Rustfmt checkout..github/workflows/rust-lint.yml#L39-L39: disable persistence for the Clippy checkout..github/workflows/rust-lint.yml#L73-L73: disable persistence for the audit checkout..github/workflows/rust-lint.yml#L85-L85: disable persistence for the documentation checkout..github/workflows/rust-publish.yml#L21-L21: disable persistence after verifyingrust-setupdoes not need Git authentication..github/workflows/rust-test.yml#L36-L36: disable persistence for the Rust test checkout..github/workflows/rust-test.yml#L65-L65: disable persistence for the coverage checkout..github/workflows/test.yml#L15-L15: disable persistence for the build checkout..github/workflows/test.yml#L30-L30: disable persistence for the module tidy checkout..github/workflows/test.yml#L47-L47: disable persistence for the unit-test checkout..github/workflows/test.yml#L67-L67: disable persistence for the integration-test checkout..github/workflows/test.yml#L91-L91: disable persistence for the E2E checkout..github/workflows/test.yml#L118-L118: disable persistence for the EVM-test checkout..github/workflows/test.yml#L136-L136: disable persistence for the coverage-combination checkout.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/benchmark.yml at line 26, Disable checkout credential persistence by adding persist-credentials: false to the listed checkout steps in .github/workflows/benchmark.yml lines 26, 58, 86, 108, 131, and 158; .github/workflows/ci.yml line 21; .github/workflows/docker-build-push.yml line 31; .github/workflows/rust-lint.yml lines 22, 39, 73, and 85; .github/workflows/rust-publish.yml line 21; .github/workflows/rust-test.yml lines 36 and 65; and .github/workflows/test.yml lines 15, 30, 47, 67, 91, 118, and 136. Verify dorny/paths-filter, rust-setup, local actions, and the benchmark action do not require persisted Git credentials, while preserving the benchmark action’s explicit github-token.Source: Linters/SAST tools
.github/workflows/ci.yml (1)
21-21: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin every changed checkout to an immutable commit.
These workflows use the mutable
actions/checkout@v7.0.1tag. Replace each reference with the immutable v7.0.1 commit SHA already used in.github/workflows/benchmark.yml. This prevents a tag move from changing workflow code without a review.
.github/workflows/ci.yml#L21-L21: replace the mutable tag with the v7.0.1 commit SHA..github/workflows/dependabot-auto-fix.yml#L17-L19: replace the mutable tag and preserve explicit authentication for the latergit push..github/workflows/docker-build-push.yml#L31-L31: replace the mutable tag with the v7.0.1 commit SHA..github/workflows/rust-lint.yml#L22-L22: replace the Rustfmt checkout tag..github/workflows/rust-lint.yml#L39-L39: replace the Clippy checkout tag..github/workflows/rust-lint.yml#L73-L73: replace the audit checkout tag..github/workflows/rust-lint.yml#L85-L85: replace the documentation checkout tag..github/workflows/rust-publish.yml#L21-L21: replace the publishing checkout tag..github/workflows/rust-test.yml#L36-L36: replace the Rust test checkout tag..github/workflows/rust-test.yml#L65-L65: replace the coverage checkout tag..github/workflows/test.yml#L15-L15: replace the build checkout tag..github/workflows/test.yml#L30-L30: replace the module tidy checkout tag..github/workflows/test.yml#L47-L47: replace the unit-test checkout tag..github/workflows/test.yml#L67-L67: replace the integration-test checkout tag..github/workflows/test.yml#L91-L91: replace the E2E checkout tag..github/workflows/test.yml#L118-L118: replace the EVM-test checkout tag..github/workflows/test.yml#L136-L136: replace the coverage-combination checkout tag..github/workflows/update-onboarding-skill.yml#L18-L20: replace the onboarding checkout tag.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml at line 21, Replace every mutable actions/checkout@v7.0.1 reference with the immutable v7.0.1 commit SHA already used in .github/workflows/benchmark.yml. Apply this to .github/workflows/ci.yml:21-21; .github/workflows/dependabot-auto-fix.yml:17-19, preserving explicit authentication for the later git push; .github/workflows/docker-build-push.yml:31-31; .github/workflows/rust-lint.yml:22-22, 39-39, 73-73, and 85-85; .github/workflows/rust-publish.yml:21-21; .github/workflows/rust-test.yml:36-36 and 65-65; .github/workflows/test.yml:15-15, 30-30, 47-47, 67-67, 91-91, 118-118, and 136-136; and .github/workflows/update-onboarding-skill.yml:18-20.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/docker-tests.yml:
- Line 25: Pin every actions/checkout reference to the immutable commit
3d3c42e5aac5ba805825da76410c181273ba90b1 instead of the mutable v7.0.1 tag at
.github/workflows/docker-tests.yml lines 25-25, 45-45, and 65-65;
.github/workflows/docs_build.yml line 19-19; .github/workflows/docs_deploy.yml
line 31-31; .github/workflows/docs_preview.yml line 24-24;
.github/workflows/lint.yml lines 15-15, 40-40, 49-49, 63-63, and 78-78;
.github/workflows/proto.yml line 14-14; .github/workflows/release-apps.yml lines
27-27 and 78-78; and .github/workflows/release-github.yml line 35-35.
- Line 25: Disable checkout credential persistence by adding
persist-credentials: false to each actions/checkout step at
.github/workflows/docker-tests.yml:25-25, 45-45, and 65-65;
.github/workflows/docs_build.yml:19-19; .github/workflows/docs_deploy.yml:31-33
within its existing with block; .github/workflows/lint.yml:15-15, 40-40, 49-51,
63-65, and 78-80; .github/workflows/proto.yml:14-14;
.github/workflows/release-apps.yml:27-27 and 78-78; and
.github/workflows/release-github.yml:35-37. Preserve any existing checkout
options and do not change steps that require authenticated git commands.
In @.github/workflows/update-onboarding-skill.yml:
- Around line 17-20: Update the checkout action configuration in the repository
onboarding workflow to set persist-credentials to false. Preserve the existing
full-history checkout, and ensure authentication is provided explicitly and only
for the later git push or gh commands rather than persisted for the Claude step.
---
Nitpick comments:
In @.github/workflows/benchmark.yml:
- Line 26: Disable checkout credential persistence by adding
persist-credentials: false to the listed checkout steps in
.github/workflows/benchmark.yml lines 26, 58, 86, 108, 131, and 158;
.github/workflows/ci.yml line 21; .github/workflows/docker-build-push.yml line
31; .github/workflows/rust-lint.yml lines 22, 39, 73, and 85;
.github/workflows/rust-publish.yml line 21; .github/workflows/rust-test.yml
lines 36 and 65; and .github/workflows/test.yml lines 15, 30, 47, 67, 91, 118,
and 136. Verify dorny/paths-filter, rust-setup, local actions, and the benchmark
action do not require persisted Git credentials, while preserving the benchmark
action’s explicit github-token.
In @.github/workflows/ci.yml:
- Line 21: Replace every mutable actions/checkout@v7.0.1 reference with the
immutable v7.0.1 commit SHA already used in .github/workflows/benchmark.yml.
Apply this to .github/workflows/ci.yml:21-21;
.github/workflows/dependabot-auto-fix.yml:17-19, preserving explicit
authentication for the later git push;
.github/workflows/docker-build-push.yml:31-31;
.github/workflows/rust-lint.yml:22-22, 39-39, 73-73, and 85-85;
.github/workflows/rust-publish.yml:21-21; .github/workflows/rust-test.yml:36-36
and 65-65; .github/workflows/test.yml:15-15, 30-30, 47-47, 67-67, 91-91,
118-118, and 136-136; and .github/workflows/update-onboarding-skill.yml:18-20.
In @.github/workflows/update-onboarding-skill.yml:
- Around line 17-18: Update the checkout step’s actions/checkout reference to
the immutable v7.0.1 commit SHA already used in the benchmark workflow,
replacing the mutable v7.0.1 tag while preserving the existing checkout
configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 49b15aa0-327d-4e7f-acfc-bc233d8ea22a
⛔ Files ignored due to path filters (8)
apps/evm/go.sumis excluded by!**/*.sumapps/loadgen/go.sumis excluded by!**/*.sumapps/testapp/go.sumis excluded by!**/*.sumexecution/evm/go.sumis excluded by!**/*.sumexecution/evm/test/go.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.sumtest/docker-e2e/go.sumis excluded by!**/*.sumtest/e2e/go.sumis excluded by!**/*.sum
📒 Files selected for processing (26)
.github/workflows/benchmark.yml.github/workflows/ci.yml.github/workflows/dependabot-auto-fix.yml.github/workflows/docker-build-push.yml.github/workflows/docker-tests.yml.github/workflows/docs_build.yml.github/workflows/docs_deploy.yml.github/workflows/docs_preview.yml.github/workflows/lint.yml.github/workflows/proto.yml.github/workflows/release-apps.yml.github/workflows/release-github.yml.github/workflows/rust-lint.yml.github/workflows/rust-publish.yml.github/workflows/rust-test.yml.github/workflows/test.yml.github/workflows/update-onboarding-skill.ymlapps/evm/go.modapps/loadgen/go.modapps/testapp/go.modexecution/evm/go.modexecution/evm/test/go.modgo.modpkg/p2p/client.gotest/docker-e2e/go.modtest/e2e/go.mod
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v7.0.0 | ||
| - uses: actions/checkout@v7.0.1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
github web search actions/checkout v7.0.1 commit 3d3c42e5aac5ba805825da76410c181273ba90b1
💡 Result:
The Git commit hash 3d3c42e5aac5ba805825da76410c181273ba90b1 corresponds to the release of actions/checkout version v7.0.1 [1][2]. This commit, titled "prep v7.0.1 release (#2531)," was authored on July 17, 2026, and the v7.0.1 release was officially published on July 20, 2026 [1][2]. This release included several updates and fixes, such as: * Skipping the unsafe pull request check if the input is set to the default [2]. * Trimming only ASCII whitespace for branch inputs [2]. * Escaping values passed to --unset [2]. * Various dependency updates [2]. You can view the specific commit details and the full changelog on the official GitHub repository for actions/checkout [1][2].
Citations:
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Repository occurrences:\n'
rg -n 'actions/checkout@v7\.0\.1|actions/checkout@[0-9a-fA-F]{40}' .github/workflows || true
printf '\nGit status/stash relevant:\n'
git status --short
git diff --stat || true
printf '\nTry GitHub API tag ref:\n'
curl -fsSL --max-time 20 https://api.github.com/repos/actions/checkout/git/refs/tags/v7.0.1 | jq '{ref, object_type: .object.type, object_sha: .object.sha, tag: (if .object.type=="tag" then .tag else null end)}' 2>/dev/null || true
printf '\nTry GitHub API tag object then commit if annotated:\n'
TAG_OBJ="$(curl -fsSL --max-time 20 'https://api.github.com/repos/actions/checkout/git/refs/tags/v7.0.1' | jq -r '.object.sha // empty' 2>/dev/null || true)" || true
echo "tag_object_sha=$TAG_OBJ"
if [ -n "$TAG_OBJ" ]; then
curl -fsSL --max-time 20 "https://api.github.com/repos/actions/checkout/git/tags/$TAG_OBJ" \
| jq '{sha, type, object_sha: .object.sha, tag: .tag}' 2>/dev/null || true
fi
printf '\nTry suggested commit via commits endpoint:\n'
curl -fsSL --max-time 20 https://api.github.com/repos/actions/checkout/commits/3d3c42e5aac5ba805825da764310c181273ba90b1 \ | jq '{sha, html_url}' 2>/dev/null || trueRepository: evstack/ev-node
Length of output: 3648
🌐 Web query:
site:github.com/actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 "prep v7.0.1 release"
💡 Result:
The commit 3d3c42e5aac5ba805825da76410c181273ba90b1 in the actions/checkout GitHub repository represents the preparation for the v7.0.1 release [1]. This commit, titled "prep v7.0.1 release" and associated with pull request #2531, was authored on July 17, 2026 [2][1]. The commit performed the following actions to prepare for the release: - Updated the version from 7.0.0 to 7.0.1 in package.json [2]. - Synchronized the package version fields in package-lock.json to 7.0.1 [2]. - Added a section for v7.0.1 to CHANGELOG.md [2].
Citations:
Pin actions/checkout to the immutable v7.0.1 commit.
Replace actions/checkout@v7.0.1 with the pinned commit 3d3c42e5aac5ba805825da76410c181273ba90b1 in the workflows still using the mutable tag.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 25-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 8 files
.github/workflows/docker-tests.yml#L25-L25(this comment).github/workflows/docker-tests.yml#L45-L45.github/workflows/docker-tests.yml#L65-L65.github/workflows/docs_build.yml#L19-L19.github/workflows/docs_deploy.yml#L31-L31.github/workflows/docs_preview.yml#L24-L24.github/workflows/lint.yml#L15-L15.github/workflows/lint.yml#L40-L40.github/workflows/lint.yml#L49-L49.github/workflows/lint.yml#L63-L63.github/workflows/lint.yml#L78-L78.github/workflows/proto.yml#L14-L14.github/workflows/release-apps.yml#L27-L27.github/workflows/release-apps.yml#L78-L78.github/workflows/release-github.yml#L35-L35
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/docker-tests.yml at line 25, Pin every actions/checkout
reference to the immutable commit 3d3c42e5aac5ba805825da76410c181273ba90b1
instead of the mutable v7.0.1 tag at .github/workflows/docker-tests.yml lines
25-25, 45-45, and 65-65; .github/workflows/docs_build.yml line 19-19;
.github/workflows/docs_deploy.yml line 31-31; .github/workflows/docs_preview.yml
line 24-24; .github/workflows/lint.yml lines 15-15, 40-40, 49-49, 63-63, and
78-78; .github/workflows/proto.yml line 14-14;
.github/workflows/release-apps.yml lines 27-27 and 78-78; and
.github/workflows/release-github.yml line 35-35.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files present =="
git ls-files .github/workflows | sort
echo "== checkout usages =="
rg -n "actions/checkout@|persist-credentials|fetch-depth|git archive|tar/zip|upload-artifact|download-artifact" .github/workflows
echo "== file snippets around affected checkout usages =="
for f in .github/workflows/docker-tests.yml .github/workflows/docs_build.yml .github/workflows/docs_deploy.yml .github/workflows/lint.yml .github/workflows/proto.yml .github/workflows/release-apps.yml .github/workflows/release-github.yml; do
if [ -f "$f" ]; then
echo "--- $f ($(wc -l < "$f") lines) ---"
nl -ba "$f" | sed -n '1,120p'
fi
doneRepository: evstack/ev-node
Length of output: 5373
🌐 Web query:
actions/checkout persist-credentials default true README
💡 Result:
In the actions/checkout GitHub Action, the persist-credentials input determines whether the authentication token or SSH key used for the checkout is configured with the local git configuration [1][2]. Key details regarding this setting include: Default Value: The default value for persist-credentials is true [1][2]. Purpose: When set to true (the default), the action persists the credentials in the local git configuration of the checked-out repository [1][3]. This allows subsequent git commands (such as git fetch, git push, or git pull) executed later in your workflow to run with authenticated access automatically [4][5]. Security Enhancement: In recent versions (v6.0.0 and later), the implementation of credential persistence was updated to store these credentials in a separate file under the $RUNNER_TEMP directory instead of directly modifying the.git/config file, which improves security [3][6]. The credentials are removed automatically during the post-job cleanup phase [1][3]. Opt-Out: If you do not want your credentials persisted, you can explicitly set persist-credentials to false in your workflow step [1][5]. This is often done to increase security if the workflow does not require further authenticated git operations [4].
Citations:
- 1: https://github.com/actions/checkout
- 2: https://github.com/actions/checkout/blob/cbb722410c2e876e24abbe8de2cc27693e501dcb/action.yml
- 3: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 4: https://github.com/marketplace/actions/checkout?version=v3.6.0
- 5: https://github.com/marketplace/actions/checkout
- 6: https://github.com/actions/checkout/tree/v6.0.0
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow snippets around affected checkout usages =="
for f in .github/workflows/docker-tests.yml .github/workflows/docs_build.yml .github/workflows/docs_deploy.yml .github/workflows/lint.yml .github/workflows/proto.yml .github/workflows/release-apps.yml .github/workflows/release-github.yml; do
if [ -f "$f" ]; then
echo "--- $f ($(wc -l < "$f") lines) ---"
awk '{printf "%6d\t%s\n", NR, $0}' "$f" | sed -n '1,120p'
fi
done
echo "== artifact/archive/download usages in relevant workflows =="
rg -n "upload-artifact|download-artifact|tar|zip|git archive|ghc|archive" .github/workflows/docker-tests.yml .github/workflows/docs_build.yml .github/workflows/docs_deploy.yml .github/workflows/lint.yml .github/workflows/proto.yml .github/workflows/release-apps.yml .github/workflows/release-github.yml || true
echo "== other checkout sites without persist-credentials =="
python3 - <<'PY'
import glob, re
for path in sorted(glob.glob('.github/workflows/*.yml')):
text = open(path).read()
for m in re.finditer(r'uses:\s*actions/checkout@([^\s#]+)(?:\s*#\s*(?:v[^\s]+|.*))?|persist-credentials:\s*([^\s#]+)', text):
# simple pass: print checkout refs and persist settings in same file; not perfect for same line, but enough
pass
PYRepository: evstack/ev-node
Length of output: 21083
🌐 Web query:
actions/checkout persist-credentials true local git config /tmp runner credentials GitHub Actions
💡 Result:
In GitHub Actions, the persist-credentials input for the actions/checkout action controls whether the repository's authentication token (or SSH key) is configured in the local Git environment to allow subsequent Git commands in the workflow to run authenticated [1][2][3]. Evolution of Implementation: Historically, actions/checkout configured the Git authentication token directly within the local .git/config file [1][4]. However, starting with actions/checkout v6.0.0, the implementation was updated to improve security [4][5]. Instead of writing the credentials directly into the local repository configuration, the action now stores them in a separate file located under $RUNNER_TEMP and uses Git's includeIf conditional configuration to reference them [4][5]. This change prevents the sensitive credentials from residing directly within the .git/config file, which was previously a potential risk for accidental exposure [4][5]. Key Considerations: - Default Behavior: By default, persist-credentials is set to true [1][2]. - Functionality: When true, it enables your workflow scripts to run authenticated Git commands (e.g., git push or git pull) without requiring additional authentication steps [1][4][3]. - Cleanup: The authentication token is automatically removed by a post-job cleanup step once the job finishes [1][4]. - Security: While persist-credentials: true is the default, some users prefer setting it to false as a security best practice to minimize exposure if unnecessary [6][7]. If set to false, your workflow scripts will not have access to the repository's credentials via the Git configuration [1][3]. For scenarios involving Docker container actions, using persist-credentials (v6+) requires a minimum Actions Runner version of v2.329.0 to correctly access the credentials stored in $RUNNER_TEMP [4][5].
Citations:
- 1: https://github.com/actions/checkout
- 2: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 3: https://www.github.com/actions/checkout
- 4: https://github.com/actions/checkout/tree/v6.0.0
- 5: actions/checkout@v5.0.1...v6.0.0
- 6: [security] Escalate concerning default
persist-credentials=trueplease actions/checkout#2312 - 7: Change the default value of persist-credentials to false actions/checkout#1687
🌐 Web query:
actions/checkout persist-credentials false workflow authenticated git operations
💡 Result:
In GitHub Actions, the persist-credentials input for the actions/checkout action controls whether the repository's authentication token (typically the GITHUB_TOKEN) is stored in the local Git configuration [1][2]. When persist-credentials is set to the default value of true, the action configures the runner's local Git environment with the necessary credentials to perform authenticated Git operations, such as git fetch or git push, throughout the remainder of the workflow job [1][2]. While convenient, this approach has historically been identified as a security risk because it leaves the credentials accessible to any subsequent step or third-party action in that same job [3][4]. If you set persist-credentials: false, the action will not store the authentication token in the Git configuration [1][3]. If your workflow requires performing authenticated Git operations later (such as a git push), you must manually authenticate Git within that specific step [4][5]. To perform authenticated Git operations when persist-credentials is false, you can explicitly configure the remote URL with the token in the step where the operation is needed [4][5]. An example of this pattern is: git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git" git push This approach ensures that credentials are only present and active during the exact step that requires them, rather than being persisted for the entire duration of the job [4][5]. Recent versions of actions/checkout have also improved security by storing these credentials in a more restricted location (under $RUNNER_TEMP) rather than directly in.git/config, though explicitly setting persist-credentials to false remains a recommended practice for hardening workflow security [2][3][6].
Citations:
- 1: https://github.com/actions/checkout
- 2: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 3: https://actsense.dev/vulnerabilities/unsafe_checkout/
- 4: 🔒 fix(ci): add persist-credentials:false and scope token to push step projectbluefin/documentation#852
- 5: Replace persist-credentials with explicit git re-authentication github/gh-aw#2664
- 6: [security] Escalate concerning default
persist-credentials=trueplease actions/checkout#2312
Disable checkout credential persistence unless the job needs authenticated Git access.
actions/checkout persists the repo token by default. Add persist-credentials: false to these checkout steps unless a later step needs authenticated git commands:
.github/workflows/docker-tests.ymllines 25, 45, 65.github/workflows/docs_build.ymlline 19.github/workflows/docs_deploy.ymllines 31-33 (add to the existingwithblock).github/workflows/lint.ymllines 15, 40, 49-51, 63-65, 78-80.github/workflows/proto.ymlline 14.github/workflows/release-apps.ymllines 27, 78.github/workflows/release-github.ymllines 35-37
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 25-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 7 files
.github/workflows/docker-tests.yml#L25-L25(this comment).github/workflows/docker-tests.yml#L45-L45.github/workflows/docker-tests.yml#L65-L65.github/workflows/docs_build.yml#L19-L19.github/workflows/docs_deploy.yml#L31-L33.github/workflows/lint.yml#L15-L15.github/workflows/lint.yml#L40-L40.github/workflows/lint.yml#L49-L51.github/workflows/lint.yml#L63-L65.github/workflows/lint.yml#L78-L80.github/workflows/proto.yml#L14-L14.github/workflows/release-apps.yml#L27-L27.github/workflows/release-apps.yml#L78-L78.github/workflows/release-github.yml#L35-L37
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/docker-tests.yml at line 25, Disable checkout credential
persistence by adding persist-credentials: false to each actions/checkout step
at .github/workflows/docker-tests.yml:25-25, 45-45, and 65-65;
.github/workflows/docs_build.yml:19-19; .github/workflows/docs_deploy.yml:31-33
within its existing with block; .github/workflows/lint.yml:15-15, 40-40, 49-51,
63-65, and 78-80; .github/workflows/proto.yml:14-14;
.github/workflows/release-apps.yml:27-27 and 78-78; and
.github/workflows/release-github.yml:35-37. Preserve any existing checkout
options and do not change steps that require authenticated git commands.
Source: Linters/SAST tools
| - name: Checkout repository | ||
| uses: actions/checkout@v7.0.0 | ||
| uses: actions/checkout@v7.0.1 | ||
| with: | ||
| fetch-depth: 0 # Full history for commit analysis |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '(^|/)\.github/workflows/update-onboarding-skill\.yml$|\.github/workflows/update-onboarding-skill\.yml' || true
echo "== target workflow =="
cat -n .github/workflows/update-onboarding-skill.yml | sed -n '1,220p'
echo "== search for action permissions/run behavior mentions =="
rg -n "permissions:|anthropics/claude-code-action|actions/checkout|persist-credentials|GITHUB_TOKEN|git push|gh " .github/workflows/update-onboarding-skill.yml .github/workflows || true
echo "== workflow syntax parse-ish line count =="
wc -l .github/workflows/update-onboarding-skill.ymlRepository: evstack/ev-node
Length of output: 12956
🌐 Web query:
anthropics claude-code-action v1 Bash(git:*) local git config credentials token
💡 Result:
The anthropics/claude-code-action@v1 action handles Git authentication internally to allow Claude to perform Git operations (such as committing changes) without permanently embedding tokens in the repository configuration [1][2]. How it manages Git credentials: 1. Credential Helper Approach: The action typically configures a custom Git credential helper to manage authentication [1][2]. It creates a temporary helper script (e.g., named.git-credential-gh-token) alongside the action source [1][2]. This script is configured via git config credential.helper to read the token from an environment variable (often GH_TOKEN) at the time of authentication, rather than hardcoding the token into the Git remote URL or local configuration [1][2]. 2. Remote URL Alternative: In certain configurations or fallback scenarios, the action may update the remote URL directly to include the token (e.g., https://x-access-token:${githubToken}`@github.com/`...) [1][2]. 3. Interaction with actions/checkout: Users have reported that the action may overwrite existing Git credentials, potentially causing issues for subsequent steps (e.g., git push) if the environment is not restored [3][4]. As a result, if you encounter authentication errors in steps following the action, you may need to explicitly handle credential cleanup or re-authentication, such as using an.extraheader configuration if you are relying on a persistent token from a previous checkout step [4]. Key Configuration Notes: - The github_token input is optional and generally only required if you are connecting a custom GitHub App of your own [5]. - If you use actions/checkout with persist-credentials: false, ensure you provide the necessary tokens directly to the claude-code-action or handle the credential setup to avoid fetch failures, as the action's internal setup might not automatically inherit the credentials from the checkout step [3]. For the most up-to-date and specific guidance on your repository's security requirements, refer to the official documentation at https://code.claude.com/docs/en/github-actions [6][7].
Citations:
- 1: https://git.homeinfra.org/actions/claude-code-action/src/commit/d5db8208f9147761c05b11340bed1e540b63f549/src/github/operations/git-config.ts
- 2: https://git.homeinfra.org/actions/claude-code-action/src/commit/ff49ec5fd6668a7e8f5bd680d618d2c0dbe7e00e/src/github/operations/git-config.ts
- 3: claude-code-action fails when actions/checkout uses persist-credentials: false anthropics/claude-code-action#1236
- 4: Git credentials are overwritten by this action anthropics/claude-code-action#1210
- 5: https://git.homeinfra.org/actions/claude-code-action/src/commit/cefa60067a051631b4a5e4b89f993d5e54c269da/docs/usage.md
- 6: https://code.claude.com/docs/en/github-actions
- 7: https://code.claude.com/docs/en/github-actions?_rsc=4Vrbm42DZc3Y7r9j
🌐 Web query:
actions/checkout v7.0.1 persist-credentials default true
💡 Result:
In the actions/checkout action, including version v7.0.1, the default value for the persist-credentials input is true [1][2][3][4]. This parameter determines whether the action configures the Git credential helper with the provided token or SSH key [1][2][4]. When set to true (the default), the credentials are added to the local Git configuration, allowing subsequent steps in the workflow to perform authenticated Git commands [1][3][5]. The action automatically cleans up these credentials during the post-job phase [1][3]. If you wish to opt out of this behavior, you must explicitly set persist-credentials: false in your workflow configuration [1][3][5].
Citations:
- 1: https://github.com/actions/checkout/blob/v4/README.md
- 2: https://github.com/actions/checkout/blob/v4/action.yml
- 3: https://github.com/actions/checkout
- 4: https://github.com/actions/checkout/?tab=readme-ov-file
- 5: https://spacelift.io/blog/github-actions-checkout
Disable persisted checkout credentials before running Claude.
The checkout step persists the write-capable GITHUB_TOKEN in .git/config, and the Claude step can run Bash(git:*). Set persist-credentials: false on checkout, and configure scoped GITHUB_TOKEN authentication only on the later git push / gh commands.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 17-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/update-onboarding-skill.yml around lines 17 - 20, Update
the checkout action configuration in the repository onboarding workflow to set
persist-credentials to false. Preserve the existing full-history checkout, and
ensure authentication is provided explicitly and only for the later git push or
gh commands rather than persisted for the Claude step.
Source: Linters/SAST tools
1 participant
Consolidates Dependabot dependency updates from #3411, #3412, and #3414 through #3417.
Includes the libp2p DHT API compatibility update and temporary local replacements for the app modules until a compatible ev-node release is available.
Validation: just tidy-all, just build-all, just test, go vet, golangci-lint, and yamllint.
Summary by CodeRabbit
Chores
Bug Fixes