ci: Add actionlint and zizmor workflow linting - #13
Merged
Merged
Conversation
Reviewer's GuideIntroduces pinned actionlint and zizmor checks for GitHub Actions, then updates the existing CI, deployment, and documentation workflows to satisfy the linters and reduce supply-chain, token, checkout, and shell-injection risks. Sequence diagram for isolated dependency submissionsequenceDiagram
participant GitHub
participant Build as Build any branch
participant Submit as submit-dependencies
participant DependencyAPI as GitHub dependency submission
GitHub->>Build: Trigger workflow
Build->>Build: actions/checkout@v7 with persist-credentials false
Build->>Build: mvnw clean verify
GitHub->>Submit: Run after build on push to main
Submit->>Submit: actions/checkout@v7 with persist-credentials false
Submit->>DependencyAPI: advanced-security/maven-dependency-submission-action@a64327a7329c9939cf675e458452febe1894a70c
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (6)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe pull request adds Dependabot cooldowns, tightens GitHub Actions permissions, guards ChangesGitHub workflow hardening
Priority: ➖ Normal Estimated code review effort: 3 (Moderate) | ~25 minutes Merge Risk: ⚪ Minimal · up to This PR hardens CI/CD configuration by adding dependency cooldowns, tightening workflow permissions, guarding deployment workflows against fork-originated triggers, and adding automated linting for GitHub Actions workflows. No functional application code is affected, and verification confirmed the security guards (repository-origin checks, scoped permissions, credential handling) are implemented consistently. The change is safe to merge. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/dependabot.yml" line_range="15" />
<code_context>
schedule:
interval: weekly
+ cooldown:
+ default-days: 7
- package-ecosystem: maven
</code_context>
<issue_to_address>
**nitpick:** The GitHub Actions updater uses a seven-day cooldown, but the requested configuration requires a three-day cooldown, so Actions update PRs are delayed four days longer than intended.
**Suggested fix:** Set the `github-actions` entry's `default-days` to `3` while keeping the Maven entry at `7`.
</issue_to_address>Sourcery assessment
Needs a human reviewer. The change alters GitHub Actions trust boundaries and the workflow-run deployment path, including jobs that can publish snapshots to Maven Central or deploy Pages. If the permissions or checkout assumptions are wrong, untrusted workflow code could gain write-capable credentials or incorrect content could be published externally; reverting stops future runs but does not undo a publication already made.
Reduce the token exposure and shell-injection surface of the workflows
without changing what they do:
* Move dependency submission out of the build job into its own
`submit-dependencies` job that only fires on pushes to main, so the
`contents: write` token is never present while `mvn clean verify` runs
a build of pull-request code. Set workflow-level `permissions: {}` and
move `pages: write` / `id-token: write` off the docs workflow onto its
Pages deploy job.
* Set `persist-credentials: false` on the checkouts that never reuse the
token for a `git` operation.
* Drop the `workflow_run` checkout's `ref:` so Deploy Snapshot builds the
default branch rather than the triggering commit, which on a
`workflow_run` can be a fork's.
* Quote `$GITHUB_OUTPUT` and the `$(date ...)` command substitution, and
pass the resolved version through `env:` into the run step.
* Pin `advanced-security/maven-dependency-submission-action` to a commit
SHA; the floating `v5` tag has no matching release tag to name, so this
moves to `v6.0.1`.
* Record why the `workflow_run` triggers are not exploitable: the branch
filter excludes fork PRs, the job checks out the default branch, and it
reuses no artifact from the triggering run.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ
jeffjensen
force-pushed
the
ci/workflow-linting
branch
2 times, most recently
from
September 10, 2026 19:24
7ce7692 to
2a524fb
Compare
Give a bad or compromised release time to be yanked before Dependabot opens a PR for it: a seven-day cooldown on both the Maven and GitHub Actions updaters. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ
Add a "Lint workflows" workflow that runs actionlint (workflow schema plus shellcheck on `run:` scripts) and zizmor (workflow security) on every change under `.github/` and weekly on a schedule. Both tool versions are pinned. `.github/zizmor.yml` accepts tag pins for actions from GitHub's own orgs (`actions/*`, `github/*`, `dependabot/*`) and requires a commit SHA for anything else, and keeps the workspace-relative `./...` action syntax rather than the very recent `$/...` form. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ
jeffjensen
force-pushed
the
ci/workflow-linting
branch
from
September 10, 2026 19:25
2a524fb to
80724d3
Compare
Owner
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds actionlint + zizmor linting for the GitHub Actions workflows, plus the
hardening to pass them clean. Same setup as
dbunit/dbunit-extension.ci: Add actionlint and zizmor workflow lintingactionlint(schema + shellcheck) andzizmor(workflow security, run with--strict-collectionso a malformedcollected file fails the job), tool versions pinned, on
.github/**PRs and aweekly schedule.
.github/zizmor.yml— tags allowed foractions/*/github/*/dependabot/*, commit SHA required for anything else.ci(dependabot): Add a cooldown before opening update PRsci: Harden the GitHub Actions workflowspermissions:blocks andpersist-credentials: false.submit-dependenciesjob, so acontents: writetoken is never present whilemvn clean verifyruns a build of pull-request code.pages: write/id-token: writeonto the Pages deploy job.workflow_run-triggered jobs with ahead_repositorycheck and keepthe
head_shacheckout, so they build exactly the tested commit and neverfork-controlled code.
dangerous-triggerssuppressed with a justification.$GITHUB_OUTPUTand$(date …); step outputs routed throughenv:.advanced-security/maven-dependency-submission-actionpinned to a commit SHA(v5 → v6.0.1).
Both linters pass clean locally. Merge before the
ci/coderabbit-configPR —that one's
.github/**instruction refers to the linting added here.🤖 Generated with Claude Code
https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ
Summary by Sourcery
Harden GitHub Actions security and add automated workflow linting.
New Features:
Bug Fixes:
Enhancements:
CI:
Summary by CodeRabbit
Security & Reliability
Maintenance