Skip to content

ci: deploy documentation with reusable workflow #800

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zombieJ merged 1 commit into from
Jul 27, 2026
Merged

ci: deploy documentation with reusable workflow #800

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/workflows/deploy-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
name: Deploy documentation

on:
release:
types: [published]
workflow_dispatch:

permissions:
contents: read
pages: write
id-token: write

jobs:
deploy:
uses: react-component/rc-test/.github/workflows/deploy-pages.yml@main

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow file =="
if [ -f .github/workflows/deploy-pages.yml ]; then
  nl -ba .github/workflows/deploy-pages.yml | sed -n '1,220p'
else
  echo "missing .github/workflows/deploy-pages.yml"
fi

echo
echo "== changed files/stat =="
git diff --stat HEAD~1..HEAD 2>/dev/null || true

echo
echo "== search permissions/deploy references =="
rg -n "permissions:|pages:|id-token|deploy-pages|uses: react-component/rc-test" .github/workflows . -g '!node_modules' || true

Repository: react-component/util

Length of output: 218

🌐 Web query:

GitHub Actions reusable workflows workflow_file use commit full SHA security mutable refs security hardening

💡 Result:

To securely reference GitHub Actions reusable workflows, you must use a full-length commit SHA [1][2][3]. When calling a reusable workflow with the syntax {owner}/{repo}/.github/workflows/{filename}@{ref}, the {ref} component is mutable if it is a branch name or a tag [2][4]. A mutable reference allows the owner of the workflow repository to modify the code, which immediately impacts every downstream caller [2]. Using a full-length commit SHA (e.g., @a1b2c3d...) makes the reference immutable, ensuring that callers always execute the exact same version of the workflow [1][2]. Security Hardening Recommendations: 1. Pin Everything: Use full-length commit SHAs for all reusable workflows and actions [2][5][3]. This mitigates the risk of supply chain attacks where a tag or branch is overwritten with malicious code [2][5]. 2. Maintain Readability: While the pin must be a SHA, you can (and should) include the human-readable version tag as a comment in the same line for easier tracking (e.g., uses: owner/repo/.github/workflows/file.yml@a1b2c3d... # v1.2.3) [2][6]. 3. Automate Maintenance: Use dependency management tools like Dependabot or Renovate to automatically update these SHA pins as new versions are released [2]. 4. Enable Enterprise/Organization Policies: If your organization uses GitHub Enterprise or GitHub Team, enable the "Require actions to be pinned to a full-length commit SHA" policy [4][5][3]. Note that while this policy is essential, it may not recursively validate every nested reference in a complex reusable workflow chain, so manual audits or custom "pin-check" workflows are recommended to ensure comprehensive coverage [4][6][7]. 5. Audit Transitive Dependencies: Because reusable workflows inherit the caller's secrets and execution context, a compromise in the reusable workflow—or any action it calls—effectively compromises the caller's environment [2][4]. Ensure the reusable workflow itself also pins all its internal actions to full SHAs [2]. If you omit the @{ref} and reference a file within the same repository (e.g.,./.github/workflows/{filename}), GitHub automatically uses the workflow file from the same commit as the caller, which provides an immutable, secure binding by default [1].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow file =="
if [ -f .github/workflows/deploy-pages.yml ]; then
  cat -n .github/workflows/deploy-pages.yml | sed -n '1,220p'
else
  echo "missing .github/workflows/deploy-pages.yml"
fi

echo
echo "== search permissions/deploy references =="
rg -n "permissions:|pages:|id-token|deploy-pages|uses: react-component/rc-test" .github/workflows . || true

Repository: react-component/util

Length of output: 1161

将复用工作流固定到完整 commit SHA。

这里通过 @main 复用第三方工作流，而它配置了 pages: write 和 id-token: write，上游分支的后续变更会直接影响发布流程。应改为经过审阅的完整 commit SHA，例如 @<reviewed-full-commit-sha> # vX.Y.Z。

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-pages.yml at line 15, 将 deploy-pages 工作流的 uses
引用从可变的 `@main` 更新为经过审阅的完整 commit SHA，并保留注释标明对应的版本号，以固定第三方工作流内容。

Loading