fix(release): restore persist-credentials:false, re-auth only for release ops - #47
Conversation
…ease ops CodeRabbit catch (CWE-250, found on node-connectwise-automate rollout, live-verified there): the checkout step's default persisted credential stayed live through npm ci/build/test. Restores persist-credentials: false (the prior design had it) and re-authenticates in one place, right after the untrusted npm lifecycle completes, for the git commands (fetch --tags, the two pushes) that need it. task_1788457898992.
|
Warning Review limit reachedNext included review available in 46 seconds. View limit detailsLimit details: You’ve used all 10 included reviews currently available. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (1)
Comment |
CodeRabbit catch (CWE-522): set-url writes the token into .git/config, readable by any later process in the job. Authenticate each git network call individually via -c http.extraheader instead -- nothing persists to disk. task_1788457898992.
GitHub auto-masks GITHUB_TOKEN itself but not derived/transformed values like its base64 encoding. ::add-mask:: right after computing it, before any git command uses it, at all 3 call sites.
CodeRabbit catch (CWE-319): if something upstream ever rewrote origin's URL to http://, using the remote name would send the Basic-auth header in cleartext. An explicit https:// URL can't be redirected that way.
|
Murph full review LGTM (persist-credentials + http.extraheader + masking + explicit-https-URL, live-verified on node-connectwise-automate). CodeRabbit's own review state on this PR is stale/rate-limited (non-actionable) — merging on murph's review as the real gate per boss's ruling. |
1 participant
Security retrofit from the node-connectwise-automate finding (WYRE-AI/node-connectwise-automate#82, live-verified, murph full review). task_1788457898992.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.