chore(guard): sync vendored public-repo-guard to canonical - #39
chore(guard): sync vendored public-repo-guard to canonical#39wave-av-release-bot[bot] wants to merge 1 commit into
Conversation
|
PR author is in the excluded authors list. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| # Checkout defaults to persisting the job token for later steps: since v6 it | ||
| # lives in a file under $RUNNER_TEMP referenced from .git/config, no longer in | ||
| # .git/config itself. It is still a live credential in the job, and this job | ||
| # downloads a third-party binary (gitleaks, below) and runs it over the whole | ||
| # tree. Nothing here pushes -- the scan is `--no-git` over the working tree -- | ||
| # so no step needs authenticated Git; drop it. (zizmor: artipacked) | ||
| persist-credentials: false |
There was a problem hiding this comment.
🔍 Checkout pin bumped only in this workflow; other workflows still on v4
This PR upgrades actions/checkout to v7 with persist-credentials: false only in public-repo-guard.yml. The other workflows (.github/workflows/_checks.yml:23,54,114 and .github/workflows/foundation-gate.yml:44) still pin v4.3.1 and keep the default persist-credentials: true, so the artipacked hardening is inconsistent across the repo. If the intent is a repo-wide hardening sync, those workflows likely need the same treatment.
Was this helpful? React with 👍 or 👎 to provide feedback.
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
There was a problem hiding this comment.
🔍 Verify the commit SHA actually corresponds to checkout v7.0.0
The action is pinned by SHA with a # v7.0.0 comment. Correctness of the pin cannot be validated from within the repo; a mismatched SHA/tag comment would silently run a different revision than reviewers assume. Worth confirming 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 is the tagged v7.0.0 commit of actions/checkout before merge. Functionally, dropping persisted credentials is safe here since no step performs authenticated Git operations (scan runs gitleaks detect --no-git --source .).
Was this helpful? React with 👍 or 👎 to provide feedback.
ApprovabilityVerdict: Needs human review Unable to check for correctness in 1b63239. This is a minor CI security hardening change (updating checkout action and adding persist-credentials: false), but the modified workflow file is owned by wave-av/core-team and the author is a bot account without ownership. The designated code owners should review this change. You can customize Macroscope's approvability policy. Learn more. |
Syncs the vendored
public-repo-guardtrio to the canonical source inwave-foundation/scaffolder/public-repo-guard.internal-ipleak rule (Tailscale-CGNAT100.64.0.0/10), lockstep with the pre-publish mirror gateEach changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own
Secrets + content policygate re-scans this PR.🤖 Generated with Claude Code
Summary by cubic
Syncs the vendored
public-repo-guardto the canonical source to keep leak detection in lockstep and tighten CI security. Aligns rules and updates the workflow that runs the guard.New Features
internal-ipleak rule for Tailscale CGNAT100.64.0.0/10; vendored copy now matches canonical byte-for-byte.Dependencies
actions/checkoutto v7.0.0 and setpersist-credentials: falseto avoid persisting the job token when runninggitleaks.Written for commit 1b63239. Summary will update on new commits.