feat(ci): add GitHub Actions CI configuration for testing and building - #4
Conversation
📝 WalkthroughWalkthroughA GitHub Actions CI workflow is added for Go projects. The workflow triggers on pushes to ChangesGo CI Workflow
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 19-20: Update the Checkout step that uses actions/checkout@v4 to
disable credential persistence by adding the input persist-credentials: false to
the step configuration (the step that currently shows "uses:
actions/checkout@v4"); this ensures the GITHUB_TOKEN is not written into local
git config for the read-only checkout.
- Around line 20-25: Replace the mutable action tags with pinned commit SHAs:
update the uses entries referencing actions/checkout@v4 and actions/setup-go@v5
in the CI workflow to use the corresponding full commit SHA (from each action's
upstream repo) instead of the short tag; ensure you fetch the canonical commit
SHAs for actions/checkout and actions/setup-go and substitute them so the
workflow uses immutable references.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| - name: Checkout | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/ci.yml"
if [ ! -f "$FILE" ]; then
echo "Missing $FILE"
exit 1
fi
echo "== File: $FILE =="
nl -ba "$FILE" | sed -n '1,200p'
echo
echo "== Grep for actions/checkout and persist-credentials =="
rg -n "actions/checkout@|persist-credentials|actions/setup-go@" "$FILE" || trueRepository: rezaqomy/FlowForge
Length of output: 160
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/ci.yml"
if [ ! -f "$FILE" ]; then
echo "Missing $FILE"
exit 1
fi
echo "== File: $FILE =="
cat -n "$FILE" | sed -n '1,220p'
echo
echo "== Grep for actions/checkout, persist-credentials, and actions/setup-go =="
rg -n "actions/checkout@|persist-credentials|actions/setup-go@" "$FILE" || true
echo
echo "== Extract checkout step block (best-effort) =="
python3 - <<'PY'
import re, pathlib
p = pathlib.Path(".github/workflows/ci.yml")
s = p.read_text()
# crude YAML-ish extraction: find "uses: actions/checkout@" line and show a small window around it
m = re.search(r'(?m)^\s*- name:\s*Checkout\s*\n\s*uses:\s*actions/checkout@[^ \n]+.*?(?:\n\s+.*?)*?(?=\n\s*- name:|\n\s*jobs:|\n\s*steps:|\n\S)', s)
# If above fails, just print lines containing checkout
lines = s.splitlines()
for i,l in enumerate(lines, start=1):
if "actions/checkout@" in l:
start=max(1,i-8); end=min(len(lines), i+12)
for j in range(start, end+1):
print(f"{j:4d}: {lines[j-1]}")
break
PYRepository: rezaqomy/FlowForge
Length of output: 1914
Disable credential persistence in actions/checkout
The workflow uses actions/checkout@v4 without persist-credentials: false, so the GITHUB_TOKEN can be written into the local git config even though this job only needs a read-only checkout.
Suggested change
- name: Checkout
uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 19-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 19 - 20, Update the Checkout step that
uses actions/checkout@v4 to disable credential persistence by adding the input
persist-credentials: false to the step configuration (the step that currently
shows "uses: actions/checkout@v4"); this ensures the GITHUB_TOKEN is not written
into local git config for the read-only checkout.
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Go | ||
| uses: actions/setup-go@v5 | ||
| with: | ||
| go-version-file: go.mod |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate and display the relevant workflow content
ls -la .github/workflows || true
sed -n '1,120p' .github/workflows/ci.yml
echo "----"
nl -ba .github/workflows/ci.yml | sed -n '15,40p'Repository: rezaqomy/FlowForge
Length of output: 1042
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Workflows =="
find .github/workflows -type f -maxdepth 1 -print
echo "== actions/ uses in workflows =="
rg -n --hidden --no-ignore-vcs "uses:\s*actions/[a-zA-Z0-9_-]+@v" .github/workflows || true
rg -n --hidden --no-ignore-vcs "uses:\s*actions/[a-zA-Z0-9_-]+@[^[:space:]]+" .github/workflows || true
echo "== Any repo policy/docs mentioning pinning/SHA =="
rg -n --hidden --no-ignore-vcs "(pin(ned)?|SHA|commit sha|commit|retarget|mutable tag|dependabot security policy|github action).*" . || true
rg -n --hidden --no-ignore-vcs "actions/checkout@|actions/setup-go@" . || trueRepository: rezaqomy/FlowForge
Length of output: 562
🌐 Web query:
GitHub Actions security best practice pin action to commit SHA instead of tag @v4 @v5``
💡 Result:
Best practice: pin GitHub Actions to the full (40+ character) commit SHA in each uses: reference (e.g., actions/checkout@<sha>) rather than using mutable tags like @v4 or @v5; optionally keep the original tag as a trailing comment for humans and tooling. Why (security): GitHub’s own security guidance says pinning to a full-length commit SHA is the most secure option and the “only way to use an action as an immutable release,” mitigating the risk of malicious changes because a SHA pin refers to a specific immutable object in the action’s repository, unlike tag references which can be moved or deleted. [1] Correct pattern: - Vulnerable (tag, potentially mutable): uses: actions/checkout@v4 - Recommended (immutable): uses: actions/checkout@<full-commit-sha> # v4 [1] Operational note: GitHub Docs also recommends verifying the SHA comes from the action’s original repository (not a fork) when you pin. [1]
Citations:
Pin GitHub Actions to immutable commit SHAs (avoid @v4 / @v5 tags).
GitHub’s security guidance recommends pinning uses: to a full-length commit SHA (from the action’s upstream repo) instead of mutable tags like v4/v5.
Suggested change
- name: Checkout
- uses: actions/checkout@v4
+ uses: actions/checkout@<full-commit-sha>
with:
persist-credentials: false
- name: Setup Go
- uses: actions/setup-go@v5
+ uses: actions/setup-go@<full-commit-sha>
with:
go-version-file: go.mod
cache: true🧰 Tools
🪛 zizmor (1.25.2)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 20 - 25, Replace the mutable action
tags with pinned commit SHAs: update the uses entries referencing
actions/checkout@v4 and actions/setup-go@v5 in the CI workflow to use the
corresponding full commit SHA (from each action's upstream repo) instead of the
short tag; ensure you fetch the canonical commit SHAs for actions/checkout and
actions/setup-go and substitute them so the workflow uses immutable references.
1 participant
Summary by CodeRabbit