ci: deploy documentation with reusable workflow - #800
Conversation
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Walkthrough新增 GitHub Actions 工作流，在发布完成或手动触发时，通过复用的工作流部署文档页面，并配置所需权限。 Changes文档页面部署
Estimated code review effort: 1 (Trivial) | ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Preview is ready!
↩️ Previous: ⚡️ 🤖 Powered by surge-preview |
|||||||||||||||
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/deploy-pages.yml:
- Line 15: 将 deploy-pages 工作流的 uses 引用从可变的 `@main` 更新为经过审阅的完整 commit
SHA，并保留注释标明对应的版本号，以固定第三方工作流内容。
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 73114c31-dcd9-4b41-98a4-8f72545de5fe
📒 Files selected for processing (1)
.github/workflows/deploy-pages.yml
|
|
||
| jobs: | ||
| deploy: | ||
| uses: react-component/rc-test/.github/workflows/deploy-pages.yml@main |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow file =="
if [ -f .github/workflows/deploy-pages.yml ]; then
nl -ba .github/workflows/deploy-pages.yml | sed -n '1,220p'
else
echo "missing .github/workflows/deploy-pages.yml"
fi
echo
echo "== changed files/stat =="
git diff --stat HEAD~1..HEAD 2>/dev/null || true
echo
echo "== search permissions/deploy references =="
rg -n "permissions:|pages:|id-token|deploy-pages|uses: react-component/rc-test" .github/workflows . -g '!node_modules' || trueRepository: react-component/util
Length of output: 218
🌐 Web query:
GitHub Actions reusable workflows workflow_file use commit full SHA security mutable refs security hardening
💡 Result:
To securely reference GitHub Actions reusable workflows, you must use a full-length commit SHA [1][2][3]. When calling a reusable workflow with the syntax {owner}/{repo}/.github/workflows/{filename}@{ref}, the {ref} component is mutable if it is a branch name or a tag [2][4]. A mutable reference allows the owner of the workflow repository to modify the code, which immediately impacts every downstream caller [2]. Using a full-length commit SHA (e.g., @a1b2c3d...) makes the reference immutable, ensuring that callers always execute the exact same version of the workflow [1][2]. Security Hardening Recommendations: 1. Pin Everything: Use full-length commit SHAs for all reusable workflows and actions [2][5][3]. This mitigates the risk of supply chain attacks where a tag or branch is overwritten with malicious code [2][5]. 2. Maintain Readability: While the pin must be a SHA, you can (and should) include the human-readable version tag as a comment in the same line for easier tracking (e.g., uses: owner/repo/.github/workflows/file.yml@a1b2c3d... # v1.2.3) [2][6]. 3. Automate Maintenance: Use dependency management tools like Dependabot or Renovate to automatically update these SHA pins as new versions are released [2]. 4. Enable Enterprise/Organization Policies: If your organization uses GitHub Enterprise or GitHub Team, enable the "Require actions to be pinned to a full-length commit SHA" policy [4][5][3]. Note that while this policy is essential, it may not recursively validate every nested reference in a complex reusable workflow chain, so manual audits or custom "pin-check" workflows are recommended to ensure comprehensive coverage [4][6][7]. 5. Audit Transitive Dependencies: Because reusable workflows inherit the caller's secrets and execution context, a compromise in the reusable workflow—or any action it calls—effectively compromises the caller's environment [2][4]. Ensure the reusable workflow itself also pins all its internal actions to full SHAs [2]. If you omit the @{ref} and reference a file within the same repository (e.g.,./.github/workflows/{filename}), GitHub automatically uses the workflow file from the same commit as the caller, which provides an immutable, secure binding by default [1].
Citations:
- 1: https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
- 2: https://safeguard.sh/resources/blog/securing-github-actions-reusable-workflows-at-scale
- 3: https://docs.github.com/en/actions/reference/security/secure-use
- 4: https://www.systemshardening.com/articles/cicd/github-actions-reusable-workflow-pinning-audit/
- 5: https://github.com/github/docs/blob/main/content/actions/reference/security/secure-use.md
- 6: https://github.com/szl-holdings/.github/blob/main/.github/workflows/pin-check-reusable.yml
- 7: szl-holdings/.github@52c3d54
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow file =="
if [ -f .github/workflows/deploy-pages.yml ]; then
cat -n .github/workflows/deploy-pages.yml | sed -n '1,220p'
else
echo "missing .github/workflows/deploy-pages.yml"
fi
echo
echo "== search permissions/deploy references =="
rg -n "permissions:|pages:|id-token|deploy-pages|uses: react-component/rc-test" .github/workflows . || trueRepository: react-component/util
Length of output: 1161
将复用工作流固定到完整 commit SHA。
这里通过 @main 复用第三方工作流，而它配置了 pages: write 和 id-token: write，上游分支的后续变更会直接影响发布流程。应改为经过审阅的完整 commit SHA，例如 @<reviewed-full-commit-sha> # vX.Y.Z。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deploy-pages.yml at line 15, 将 deploy-pages 工作流的 uses
引用从可变的 `@main` 更新为经过审阅的完整 commit SHA，并保留注释标明对应的版本号，以固定第三方工作流内容。
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #800 +/- ##
=======================================
Coverage 86.72% 86.72%
=======================================
Files 40 40
Lines 1092 1092
Branches 380 395 +15
=======================================
Hits 947 947
Misses 143 143
Partials 2 2 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
1 participant
Summary
Verification
Summary by CodeRabbit