Remove ghalint workaround and fix all security policy violations #2208
Conversation
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
- Remove workaround filtering logic from ghalint.yml that only checked action_ref_should_be_full_length_commit_sha - Add persist-credentials: false to all checkout actions for enhanced security - Add proper permissions blocks to jobs following least-privilege principle - Add timeout-minutes to jobs missing them to prevent runaway processes - Fix GitHub App token permissions format in license-report-update.yml and release.yml - All ghalint policy violations now resolved across the entire codebase Co-Authored-By: [email protected] <[email protected]>
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
1 Skipped Deployment
|
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
|
|
Updates to Preview Branch (devin/1750848019-remove-ghalint-workaround) ↗︎
Tasks are run on every commit but only new migration files are pushed.
View logs for this Workflow Run ↗︎. |
devin-ai-integration
bot
requested review from
hoshinotsuyoshi,
FunamaYukina,
junkisai,
MH4GF and
NoritakaIkeda
and removed request for
a team
| permission-contents: write | ||
| permission-pull-requests: write |
There was a problem hiding this comment.
Fixed GitHub App token permissions
Updated GitHub App token creation to use proper permission format:
license-report-update.yml- Addedpermission-contents: writeandpermission-pull-requests: writerelease.yml- Addedpermission-contents: write,permission-pull-requests: write, andpermission-actions: write
Oh, this was added automatically based on some heuristic or something, right?
Pretty cool — how does it even figure that out, Devin?
| @@ -31,6 +32,7 @@ jobs: | |||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |||
| with: | |||
| fetch-depth: 1 | |||
| persist-credentials: false | |||
There was a problem hiding this comment.
ref: https://github.com/suzuki-shunsuke/ghalint/blob/main/docs/policies/013.md
Making the token persistent allows subsequent steps such as git push.For security risk, it should be false if not needed.
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Remove ghalint workaround and fix all security policy violations
Summary
This PR removes the temporary workaround code from the ghalint workflow that was filtering to only check for
action_ref_should_be_full_length_commit_shaviolations, and comprehensively fixes all ghalint security policy violations across the GitHub Actions workflow files.Changes Made
1. Removed Workaround Code
.github/workflows/ghalint.ymlghalint runcommand2. Fixed Security Policy Violations
Added
persist-credentials: falseto checkout actionsEnhanced security by preventing accidental credential exposure in the following workflows:
claude.ymldatabase-ci.ymle2e_tests.ymlfigma-to-css-variables.ymlfrontend-ci.yml(3 jobs)license-report-update.ymllicense.ymlnotify_supabase_failure.ymlreleased_package_test.ymlstale.ymltrigger_dev_preview.ymltrigger_dev_production.ymlAdded proper job permissions
Implemented least-privilege access by adding
permissions: contents: readto jobs that were missing them:claude.yml-claude-code-actionjobdatabase-ci.yml-pg_tap_testsjobdiscussion-comment-to-slack.yml-discussion_commentedjobfrontend-ci.yml-frontend-lintandfrontend-cijobslicense.yml-license_finderjobnotify_supabase_failure.yml-notify_slackjobreleased_package_test.yml-testjobtrigger_dev_preview.yml-trigger_devjobtrigger_dev_production.yml-trigger_devjobAdded missing timeout configurations
Added
timeout-minutes: 10to jobs that were missing them:claude.yml-claude-code-actionjobnotify_supabase_failure.yml-notify_slackjobstale.yml-stalejobFixed GitHub App token permissions
Updated GitHub App token creation to use proper permission format:
license-report-update.yml- Addedpermission-contents: writeandpermission-pull-requests: writerelease.yml- Addedpermission-contents: write,permission-pull-requests: write, andpermission-actions: writeTesting
✅ Local ghalint verification: Ran
ghalint runlocally and confirmed all violations are resolved (exit code 0)✅ Security improvements verified: All changes follow GitHub Actions security best practices:
persist-credentials: falseto prevent credential leakageTesting Transparency
What I Actually Checked
persist-credentials: falseWhat I Did Not Check
pnpm lintcommand due to environment dependency issues (unrelated to these changes)contents: readReviewer Checklist
Please verify:
persist-credentials: falseLink to Devin run
https://app.devin.ai/sessions/f1784c3e07d74e548db665012f68f178
Requested by: [email protected]