chore(guard): sync vendored public-repo-guard to canonical - #60
Conversation
|
PR author is in the excluded authors list. |
ApprovabilityVerdict: Needs human review Unable to check for correctness in a81a4bd. This PR updates the checkout action version and adds security hardening ( You can customize Macroscope's approvability policy. Learn more. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| # Checkout defaults to persisting the job token for later steps: since v6 it | ||
| # lives in a file under $RUNNER_TEMP referenced from .git/config, no longer in | ||
| # .git/config itself. It is still a live credential in the job, and this job | ||
| # downloads a third-party binary (gitleaks, below) and runs it over the whole | ||
| # tree. Nothing here pushes -- the scan is `--no-git` over the working tree -- | ||
| # so no step needs authenticated Git; drop it. (zizmor: artipacked) | ||
| persist-credentials: false |
There was a problem hiding this comment.
🔍 Checkout action versions now diverge across workflows
This workflow moves to actions/checkout@9c091bb… (v7.0.0) while the rest of the repo pins other versions: v6.0.3 in .github/workflows/lint.yml:16 and .github/workflows/release.yml:41,77,131, and v4.3.1 in .github/workflows/_checks.yml:23,54,114. Also, persist-credentials: false is only applied here — the other workflows still persist the job token, so the artipacked hardening the comment describes is only partially rolled out. Worth confirming whether the intent was to standardize all workflows.
Was this helpful? React with 👍 or 👎 to provide feedback.
…-sync # Conflicts: # .github/workflows/public-repo-guard.yml
|
Skipping PR review because a bot author is detected. If you want to trigger CodeAnt AI, comment |
1 participant
Syncs the vendored
public-repo-guardtrio to the canonical source inwave-foundation/scaffolder/public-repo-guard.internal-ipleak rule (Tailscale-CGNAT100.64.0.0/10), lockstep with the pre-publish mirror gateEach changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own
Secrets + content policygate re-scans this PR.🤖 Generated with Claude Code
Note
Update
public-repo-guardworkflow to useactions/checkoutv7 without persisted credentialsSyncs public-repo-guard.yml to the canonical version. Upgrades
actions/checkoutfrom v5.0.1 to v7.0.0 and setspersist-credentials: falseso theGITHUB_TOKENis no longer stored in the repository's Git config after checkout.Macroscope summarized a81a4bd.
Summary by cubic
Syncs the vendored
public-repo-guardworkflow to its canonical source and hardens the gitleaks scan.actions/checkoutto v7.0.1.persist-credentials: falseso the job token isn't left in the working tree during the scan.Written for commit fde7233. Summary will update on new commits.
Summary by Sourcery
Sync the vendored public-repo-guard workflow with its canonical source and reduce credential exposure during repository scans.
Enhancements:
CI:
Chores: