chore: adding workflow for updating geosite-cn list automatically - #13
chore: adding workflow for updating geosite-cn list automatically#13WendelHime wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughAdds a scheduled and manually triggered GitHub Actions workflow that downloads and validates upstream Changesgeosite-cn update automation
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant Upstream
participant SingBox
participant CsvToSrs
participant GitRepository
GitHubActions->>Upstream: download cn.srs
GitHubActions->>SingBox: decompile cn.srs to cn.json
SingBox-->>GitHubActions: return decompiled rules
GitHubActions->>GitHubActions: validate and write geosite-cn.csv
GitHubActions->>CsvToSrs: generate geosite-cn.srs
CsvToSrs-->>GitHubActions: return generated artifact
GitHubActions->>GitRepository: commit CSV and SRS changes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/update_geosite_cn.yml:
- Around line 86-87: Update the csv_to_srs generator entrypoint in
cmd/csv_to_srs/main.go so filepath.Walk and SRS parse/write errors are
propagated to main and terminate with a nonzero exit status. Ensure the
“Generating SRS files” workflow step cannot succeed or commit changes when
generation fails.
- Line 89: Update the stefanzweifel/git-auto-commit-action reference in the
workflow to a full immutable commit SHA instead of the mutable v7 tag, selecting
the SHA for the intended action version and preserving the existing workflow
behavior.
- Around line 38-42: Update the workflow step before extracting sing-box.tar.gz
to validate the downloaded archive using the official release checksum manifest
or signature, and fail the job when verification fails. Keep tar extraction,
installation, and sing-box version execution after successful verification,
using the existing SING_BOX_VERSION and archive values to select the matching
trusted artifact.
- Line 31: Update the workflow’s actions/checkout@v5 step to set
persist-credentials to false, and remove the contents: write permission unless
it is explicitly required by git-auto-commit-action. Keep the commit step
functional while ensuring later untrusted download and execution steps cannot
access the repository write token.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5cb4f37a-10b9-46b1-892e-34bafa09fbcb
📒 Files selected for processing (1)
.github/workflows/update_geosite_cn.yml
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| steps: | ||
| - uses: actions/checkout@v5 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files =="
git ls-files .github/workflows || true
echo "== target workflow excerpt =="
if [ -f ".github/workflows/update_geosite_cn.yml" ]; then
nl -ba .github/workflows/update_geosite_cn.yml | sed -n '1,140p'
fi
echo "== all uses in target workflow =="
rg -n "uses:|pulls token|GITHUB_TOKEN|env:|permissions:|git push|curl|sing-box|go run" .github/workflows/update_geosite_cn.yml || trueRepository: getlantern/rulesets
Length of output: 329
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== target workflow excerpt =="
if [ -f ".github/workflows/update_geosite_cn.yml" ]; then
awk '{printf "%4d\t%s\n", NR, $0}' .github/workflows/update_geosite_cn.yml | sed -n '1,160p'
fi
echo "== relevant usages =="
awk '{printf "%4d\t%s\n", NR, $0}' .github/workflows/update_geosite_cn.yml | grep -nEi "uses:|github-token|pulls token|github_token|GITHUB_TOKEN|permissions:|persist-credentials|git push|curl|sing-box|go run|commit" || trueRepository: getlantern/rulesets
Length of output: 5608
🌐 Web query:
actions/checkout persist-credentials default true saves GITHUB_TOKEN .git/config
💡 Result:
As of version 6.0.0 of actions/checkout, the behavior of the persist-credentials input has been updated to improve credential security [1][2][3]. While previous versions (v2 through v5) stored the GITHUB_TOKEN directly within the local.git/config file, v6 and later versions store these credentials in a separate file under the $RUNNER_TEMP directory [4][1][3]. The action then uses Git configuration (such as include.path) to reference this temporary file [1]. Despite this change in storage location, the overall functionality remains the same: when persist-credentials is set to true (which is the default), the GITHUB_TOKEN is configured to allow subsequent steps in the workflow to perform authenticated Git commands [4][5][3]. The token is still automatically removed during post-job cleanup [4][5]. If you wish to opt out of this behavior, you can set persist-credentials to false in your workflow file: - uses: actions/checkout@v6 with: persist-credentials: false Setting this to false prevents the action from configuring Git with the GITHUB_TOKEN, which is often recommended for security purposes to follow the principle of least privilege [6][7].
Citations:
- 1: actions/checkout@v5.0.1...v6.0.0
- 2: https://github.com/actions/checkout/tree/v6.0.0
- 3: https://github.com/marketplace/actions/checkout
- 4: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 5: https://github.com/marketplace/actions/checkout?version=v3.6.0
- 6: Scope CI workflow credentials to least privilege sveltejs/kit#15529
- 7: Remove
persist-credentialsor change the default tofalseactions/checkout#485
🌐 Web query:
stefanzweifel git-auto-commit-action v7 authentication github-token input
💡 Result:
In the stefanzweifel/git-auto-commit-action (version 7), authentication is handled automatically by the GITHUB_TOKEN provided by the GitHub Actions runner, and there is no direct github-token input parameter for the action itself [1][2]. Key details regarding authentication and configuration: 1. Authentication Mechanism: The action uses the GITHUB_TOKEN to authenticate with GitHub's APIs to push commits [2]. To enable this, you must set the permissions of your workflow job to allow write access to contents [1]: permissions: contents: write 2. Personal Access Tokens (PATs): If you need to use a Personal Access Token instead of the default GITHUB_TOKEN (e.g., to trigger other workflows or bypass specific restrictions), you should pass the token to the actions/checkout step at the beginning of your job, rather than to the git-auto-commit-action itself [1]. - Ensure persist-credentials is set to true in the actions/checkout step [1]. - Example configuration: - uses: actions/checkout@v5 with: token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }} 3. Repository Input: Regarding your query about the repository input, the action does include a repository input parameter [3][4]. This is an optional string that defines the relative file path (under $GITHUB_WORKSPACE) to the git repository you want to target [3]. It defaults to the current directory (.), meaning the action operates in the root of the workspace by default [3]. In summary, do not look for a github-token input on the git-auto-commit-action; authentication is managed via the environment's credentials, which are typically established during the preceding checkout step [1].
Citations:
- 1: https://github.com/stefanzweifel/git-auto-commit-action?tab=readme-ov-file
- 2: Why does this action not cause an endless loop? stefanzweifel/git-auto-commit-action#238
- 3: https://github.com/stefanzweifel/git-auto-commit-action/blob/master/action.yml
- 4: https://github.com/stefanzweifel/git-auto-commit-action/blob/HEAD/CHANGELOG.md
🌐 Web query:
actions/checkout v5 persist-credentials default true configures local git remote
💡 Result:
In actions/checkout v5, the persist-credentials input defaults to true [1][2][3]. When enabled, this setting configures the repository to use the provided GitHub Actions token (or SSH key) for subsequent Git operations during the workflow [2][4][5]. In v5, this is achieved by writing the credentials directly into the local Git configuration of the checked-out repository [2][6]. The token is subsequently removed during the post-job cleanup step [2][5]. It is important to note that this behavior changed in v6 [7][6]. In actions/checkout v6 and later, persist-credentials still defaults to true, but the mechanism for storing credentials was updated to improve security; instead of writing directly to the local.git/config, credentials are now stored in a separate file within $RUNNER_TEMP and accessed using Git's includeIf mechanism [7][8][6].
Citations:
- 1: https://git.liteyuki.org/actions/checkout/src/tag/v5.0.1/action.yml
- 2: https://git.liteyuki.org/actions/checkout/src/tag/v5/README.md
- 3: https://git.woni.link/actions/checkout/src/branch/releases/v5/action.yml
- 4: https://git.liteyuki.org/actions/checkout/raw/tag/v5.0.1/README.md
- 5: https://github.com/marketplace/actions/checkout
- 6: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 7: actions/checkout@v5.0.1...v6.0.0
- 8: Persist creds to a separate file actions/checkout#2286
Keep the write token out of untrusted workspace steps.
In this workflow, actions/checkout@v5 persisted the repository write token for git operations until post-job cleanup, and later steps (curl, sing-box downloads/execution, and go run) execute before git-auto-commit-action. Set persist-credentials: false on checkout and remove unnecessary contents: write permission unless the commit step needs it.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 31-31: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/update_geosite_cn.yml at line 31, Update the workflow’s
actions/checkout@v5 step to set persist-credentials to false, and remove the
contents: write permission unless it is explicitly required by
git-auto-commit-action. Keep the commit step functional while ensuring later
untrusted download and execution steps cannot access the repository write token.
Source: Linters/SAST tools
| curl -fsSL -o sing-box.tar.gz \ | ||
| "https://github.com/SagerNet/sing-box/releases/download/v${SING_BOX_VERSION}/${archive}.tar.gz" | ||
| tar -xzf sing-box.tar.gz | ||
| sudo install "${archive}/sing-box" /usr/local/bin/sing-box | ||
| sing-box version |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Git files of interest:"
git ls-files | rg '(^|/)\.github/workflows/update_geosite_cn\.yml$|sing-box|SING_BOX_VERSION|checksum|sha|signature' || true
echo
echo "Workflow excerpt:"
if [ -f .github/workflows/update_geosite_cn.yml ]; then
nl -ba .github/workflows/update_geosite_cn.yml | sed -n '1,120p'
fi
echo
echo "Search for checksum/signature/checksum-related terms in workflows:"
rg -n "sha(?:256|512)?|checksum|sign|gpg|cosign|verify|SING_BOX_VERSION|sing-box" .github/workflows || trueRepository: getlantern/rulesets
Length of output: 280
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Workflow excerpt:"
if [ -f .github/workflows/update_geosite_cn.yml ]; then
awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/update_geosite_cn.yml | sed -n '1,120p'
fi
echo
echo "Search for sing-box, SING_BOX_VERSION, checksum/signature in workflows:"
rg -n "sha(256|512)?|checksum|sign|gpg|cosign|verify|SING_BOX_VERSION|sing-box" .github/workflows || true
echo
echo "Relevant git status summary:"
git status --short .github/workflows/update_geosite_cn.yml || trueRepository: getlantern/rulesets
Length of output: 5523
🌐 Web query:
SagerNet sing-box GitHub releases checksums signature v1.12.12
💡 Result:
The sing-box project, managed by SagerNet, generally does not provide explicit, publicly documented standalone checksum (.sha256) or GPG signature (.sig) files for individual release assets directly on their GitHub releases page [1][2]. Verification of sing-box releases is typically handled through the following mechanisms: 1. Package Manager Signatures: For Linux distributions using RPM or DEB packages, signatures are managed by the release process (e.g., via GoReleaser) [3]. Users have reported that signature verification can sometimes fail if the GPG key is not correctly configured or if the key ID mismatch occurs [4]. The official GPG key used for repository verification is hosted at https://sing-box.app/gpg.key [4]. 2. Installer Manifests: For Windows, the Microsoft Winget package manager maintains manifests that include the SHA256 checksums for specific release versions [5]. These manifests serve as an authoritative source for verifying the integrity of the official Windows binaries [5]. 3. Release Automation: Releases are typically built via GitHub Actions, and integrity is managed within the ecosystem of the build pipeline [2][6]. If you are attempting to verify a specific file manually, it is recommended to compare its hash against the values documented in the relevant Winget manifest [5] or check the project's official communication channels if you suspect file corruption, as the project has previously addressed issues where release assets were incorrectly triggered and required re-uploading [7]. There is no standard, per-file detached signature provided for general users on the GitHub releases page for version 1.12.12 [1][2].
Citations:
- 1: https://github.com/SagerNet/sing-box/releases
- 2: https://github.com/SagerNet/sing-box/releases/tag/v1.12.13
- 3: https://github.com/SagerNet/sing-box/blob/73c5575866d53156afac1a7a63d7f836162ec5aa/.goreleaser.fury.yaml
- 4: RPM: GPG check FAILED SagerNet/sing-box#2522
- 5: https://github.com/microsoft/winget-pkgs/blob/master/manifests/s/SagerNet/sing-box/1.12.12/SagerNet.sing-box.installer.yaml
- 6: https://github.com/SagerNet/sing-box/releases/tag/v1.12.25
- 7: WinGet中sing-box-1.11.14-windows-amd64.zip的HASH值不对 SagerNet/sing-box#3135
Validate the sing-box artifact before executing it.
This workflow runs with contents: write and installs a release asset from an untrusted download path. Compare the downloaded archive against a trusted checksum manifest or verify an official signature before tar -xzf sing-box.tar.gz.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/update_geosite_cn.yml around lines 38 - 42, Update the
workflow step before extracting sing-box.tar.gz to validate the downloaded
archive using the official release checksum manifest or signature, and fail the
job when verification fails. Keep tar extraction, installation, and sing-box
version execution after successful verification, using the existing
SING_BOX_VERSION and archive values to select the matching trusted artifact.
| - name: Generating SRS files | ||
| run: go run ./cmd/csv_to_srs -input_dir ./csv -output_dir ./srs |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Fail the job when SRS generation fails.
cmd/csv_to_srs/main.go:20-66 logs filepath.Walk errors without exiting nonzero. Consequently, this step can succeed after a parse/write failure, allowing the commit step to push a new CSV alongside a stale or missing srs/geosite-cn.srs. Make the generator return a nonzero exit status on error before committing.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/update_geosite_cn.yml around lines 86 - 87, Update the
csv_to_srs generator entrypoint in cmd/csv_to_srs/main.go so filepath.Walk and
SRS parse/write errors are propagated to main and terminate with a nonzero exit
status. Ensure the “Generating SRS files” workflow step cannot succeed or commit
changes when generation fails.
| - name: Generating SRS files | ||
| run: go run ./cmd/csv_to_srs -input_dir ./csv -output_dir ./srs | ||
|
|
||
| - uses: stefanzweifel/git-auto-commit-action@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Workflow snippets:"
if [ -f .github/workflows/update_geosite_cn.yml ]; then
nl -ba .github/workflows/update_geosite_cn.yml | sed -n '70,105p'
else
echo ".github/workflows/update_geosite_cn.yml not found"
fi
echo
echo "Occurrences of git-auto-commit-action:"
rg -n "git-auto-commit-action" .github/workflows || true
echo
echo "Other action pins in this workflow:"
rg -n "uses:\s*[^#]+@" .github/workflows/update_geosite_cn.yml || trueRepository: getlantern/rulesets
Length of output: 216
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Workflow snippets:"
if [ -f .github/workflows/update_geosite_cn.yml ]; then
head -n 110 .github/workflows/update_geosite_cn.yml | awk '{printf "%d\t%s\n", NR, $0}'
else
echo ".github/workflows/update_geosite_cn.yml not found"
fi
echo
echo "Occurrences of git-auto-commit-action:"
grep -n "git-auto-commit-action" .github/workflows/update_geosite_cn.yml || true
echo
echo "Other action pins in this workflow:"
grep -nE "uses:\s*[^#]+@" .github/workflows/update_geosite_cn.yml || true
echo
echo "Permissions declarations:"
grep -nE "permissions:|contents:|issues:|pull-requests:|checks:" .github/workflows/update_geosite_cn.yml || trueRepository: getlantern/rulesets
Length of output: 4383
Pin the third-party commit action to an immutable SHA.
This workflow grants contents: write, and stefanzweifel/git-auto-commit-action@v7 is a mutable tag. Use the full commit SHA for the selected action ref and update it through a controlled dependency-update process.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/update_geosite_cn.yml at line 89, Update the
stefanzweifel/git-auto-commit-action reference in the workflow to a full
immutable commit SHA instead of the mutable v7 tag, selecting the SHA for the
intended action version and preserving the existing workflow behavior.
1 participant
Summary by CodeRabbit