chore(deps): Update GitHub Actions to v2.19.3#37
Conversation
WalkthroughThe dependency-review workflow receives a targeted security update: the ChangesWorkflow Dependency Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related issues
Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
There was a problem hiding this comment.
Pull request overview
Updates the step-security/harden-runner GitHub Action used by the Dependency Review workflow to the latest patch release, keeping the workflow’s runner-hardening step current with upstream bugfixes/security patches.
Changes:
- Bumped
step-security/harden-runnerfromv2.19.1tov2.19.3(still pinned to a commit SHA) in the dependency review workflow.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/dependency-review.yml (1)
34-36:⚠️ Potential issue | 🟠 Major | ⚡ Quick winHarden checkout to avoid token persistence on the runner.
Please set
persist-credentials: falseon the checkout step; otherwise the GitHub token is written into local git config during the job.Based on learnings: “In .github/workflows/*.yml, ensure every `actions/checkout` step sets `persist-credentials: false` … and if the PR modifies the workflow, add it there.”Suggested patch
- name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependency-review.yml around lines 34 - 36, The checkout step using actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd must set persist-credentials: false to prevent the GitHub token being written to the runner git config; update the checkout step (the block starting with "name: Checkout repository" / the actions/checkout usage) to include persist-credentials: false and ensure any other actions/checkout occurrences in this workflow are similarly hardened.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/dependency-review.yml:
- Around line 34-36: The checkout step using
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd must set
persist-credentials: false to prevent the GitHub token being written to the
runner git config; update the checkout step (the block starting with "name:
Checkout repository" / the actions/checkout usage) to include
persist-credentials: false and ensure any other actions/checkout occurrences in
this workflow are similarly hardened.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 3b90a2ba-b953-4039-b4f8-262f935a2ee3
📒 Files selected for processing (1)
.github/workflows/dependency-review.yml
|
Summary
Why
Scheduled patch update, bug fixes and security patches with no API changes.
Changes
This PR contains the following updates:
v2.19.1→v2.19.3Impact
Acceptance Criteria
Testing
Notes
Release Notes
step-security/harden-runner (step-security/harden-runner)
v2.19.3Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.2...v2.19.3
v2.19.2Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.1...v2.19.2
Configuration
📅 Schedule: Branch creation - "after 10pm every weekday,before 5am every weekday,every weekend" in timezone America/New_York, Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
Summary by CodeRabbit