security: pin all dependencies and add Renovatebot#228
Conversation
📝 WalkthroughWalkthroughThe pull request replaces Dependabot with Renovate, pins GitHub Actions to commit SHAs, and pins Docker images to SHA256 digests across build, deployment, and Compose configurations. ChangesDependency and Artifact Pinning
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/generic-deploy.yml (1)
27-34: 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick winInclude the workflow file in the Ansible cache key.
Because the Ansible core and collection versions are defined directly in this workflow file (lines 39-40), Renovate will update them here. However, the current cache key only hashes
infra/ansible/server-setup-ubuntu.yml.When Renovate bumps the versions in this workflow, the cache key will not change, leading to a cache hit that restores the old, stale dependencies and silently skips the installation of the new versions. Hash this workflow file alongside the playbook to ensure cache invalidation on dependency updates.
🐛 Proposed fix for the cache key
- name: Cache Ansible id: cache-ansible uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 with: path: | ~/.local ~/.ansible/collections - key: ${{ runner.os }}-ansible-${{ hashFiles('infra/ansible/server-setup-ubuntu.yml') }} + key: ${{ runner.os }}-ansible-${{ hashFiles('infra/ansible/server-setup-ubuntu.yml', '.github/workflows/generic-deploy.yml') }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/generic-deploy.yml around lines 27 - 34, Update the cache key in the “Cache Ansible” step to hash both the workflow file containing the Ansible version definitions and infra/ansible/server-setup-ubuntu.yml, ensuring dependency version changes invalidate the cached Ansible dependencies..github/workflows/quality-check.yml (1)
63-64: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winPin the
gofumptversion.The PR objective states that Go dependencies are immutable, but
gofumptis installed using the@latestfloating tag. This violates the pinning objective and introduces the risk of unexpected CI failures if a new version ofgofumptis released with updated formatting rules.Please pin this to a specific version (e.g.,
@v0.7.0) to ensure deterministic formatting checks.📌 Proposed fix
- name: Install gofumpt - run: go install mvdan.cc/gofumpt@latest + run: go install mvdan.cc/gofumpt@v0.7.0🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/quality-check.yml around lines 63 - 64, Update the “Install gofumpt” workflow step to replace the floating `@latest` tag with a specific immutable gofumpt version, such as `@v0.7.0`, while preserving the existing installation command.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/deploy.yml:
- Around line 30-33: Disable checkout credential persistence by adding
persist-credentials: false to the actions/checkout steps in
.github/workflows/deploy.yml lines 30-33 and 120-120,
.github/workflows/generic-deploy.yml line 15, and
.github/workflows/quality-check.yml lines 13, 26, 39, and 57; add or extend each
step’s with block as needed.
---
Outside diff comments:
In @.github/workflows/generic-deploy.yml:
- Around line 27-34: Update the cache key in the “Cache Ansible” step to hash
both the workflow file containing the Ansible version definitions and
infra/ansible/server-setup-ubuntu.yml, ensuring dependency version changes
invalidate the cached Ansible dependencies.
In @.github/workflows/quality-check.yml:
- Around line 63-64: Update the “Install gofumpt” workflow step to replace the
floating `@latest` tag with a specific immutable gofumpt version, such as `@v0.7.0`,
while preserving the existing installation command.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: d2769a60-8ee8-4b93-a2aa-6405eb6b5fe8
📒 Files selected for processing (9)
.github/dependabot.yml.github/renovate.json.github/workflows/deploy.yml.github/workflows/generic-deploy.yml.github/workflows/quality-check.yml.github/workflows/release-drafter.ymlDockerfiledocker-compose.prod.ymldocker-compose.yml
💤 Files with no reviewable changes (1)
- .github/dependabot.yml
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable credential persistence in checkout actions.
By default, actions/checkout persists the GITHUB_TOKEN to the local .git/config (persist-credentials: true). This is a security risk because any subsequent compromised step or malicious dependency inside the workflow could exfiltrate the token. Since these CI and deployment workflows do not need to push code back to the repository, you should disable this persistence to harden the pipeline against supply-chain attacks.
.github/workflows/deploy.yml#L30-L33: addpersist-credentials: falseunder thewithblock..github/workflows/deploy.yml#L120-L120: add awithblock containingpersist-credentials: false..github/workflows/generic-deploy.yml#L15-L15: add awithblock containingpersist-credentials: false..github/workflows/quality-check.yml#L13-L13: add awithblock containingpersist-credentials: false..github/workflows/quality-check.yml#L26-L26: add awithblock containingpersist-credentials: false..github/workflows/quality-check.yml#L39-L39: add awithblock containingpersist-credentials: false..github/workflows/quality-check.yml#L57-L57: add awithblock containingpersist-credentials: false.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 30-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 3 files
.github/workflows/deploy.yml#L30-L33(this comment).github/workflows/deploy.yml#L120-L120.github/workflows/generic-deploy.yml#L15-L15.github/workflows/quality-check.yml#L13-L13.github/workflows/quality-check.yml#L26-L26.github/workflows/quality-check.yml#L39-L39.github/workflows/quality-check.yml#L57-L57
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deploy.yml around lines 30 - 33, Disable checkout
credential persistence by adding persist-credentials: false to the
actions/checkout steps in .github/workflows/deploy.yml lines 30-33 and 120-120,
.github/workflows/generic-deploy.yml line 15, and
.github/workflows/quality-check.yml lines 13, 26, 39, and 57; add or extend each
step’s with block as needed.
Source: Linters/SAST tools
mipselqq
changed the title
1 participant
Related Issues
Closes #217
Summary
This PR pins all dependencies used in project:
Replaces Dependabot with Renovatebot, which is more flexible and has better pinning suport.
Adds automatic dependency updates for Ansible, Python, TypeScript
Verification
Checklist