Skip to content

Add CI workflow without release #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
gentamura wants to merge 1 commit into from
Closed

Add CI workflow without release #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: CI

on:
push:
branches:
- main
pull_request:
branches:
- "**"

permissions:
contents: write
pull-requests: write
id-token: write
Comment on lines +11 to +14
Copy link

@coderabbitai coderabbitai bot Oct 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Overly broad permissions; verify necessity of contents: write.

A linting, type-checking, and testing workflow typically only requires read access to repository contents. The contents: write permission should be limited to workflows that commit or push changes back to the repository. Verify that the reusable workflows actually require write access; if not, reduce to contents: read.

I'll verify the review comment by inspecting the CI workflow and checking if contents: write is actually necessary.


---

🏁 Script executed:

```shell
#!/bin/bash
# Inspect the CI workflow file
cat .github/workflows/ci.yml

Length of output: 396

🏁 Script executed:

#!/bin/bash
# Find all GitHub Actions workflow files to understand the structure
find .github/workflows -name "*.yml" -o -name "*.yaml" | head -20

Length of output: 24

🏁 Script executed:

#!/bin/bash
# Search for any commit/push operations in the CI workflow
rg -n "git|commit|push|write" .github/workflows/ci.yml -A 2 -B 2

Length of output: 402

🏁 Script executed:

#!/bin/bash
# Check if there are reusable workflows and what permissions they declare
find .github/workflows -name "*.yml" -o -name "*.yaml" | xargs grep -l "on:" | head -20

Length of output: 24

🏁 Script executed:

#!/bin/bash
# Look for uses of actions that typically require write access
rg -n "uses:" .github/workflows/ci.yml

Length of output: 202


---

🏁 Script executed:

```shell
#!/bin/bash
# Check for any documentation or comments about workflow permissions
rg -n "contents.*write|permissions" . --type=md -C 3

Length of output: 0

🏁 Script executed:

#!/bin/bash
# Look for any comments in workflow files or docs about why write access is needed
find . -name "README*" -o -name "CONTRIBUTING*" | head -10

Length of output: 11

🏁 Script executed:

#!/bin/bash
# Check if there are any other CI-related files that explain the workflow setup
find . -path "./.git" -prune -o -name "*workflow*" -o -name "*ci*" | grep -E "\.(md|yml|yaml|txt)$" | head -20

Length of output: 26

Change contents: write to contents: read in the CI workflow.

The ci.yml workflow is a pure orchestrator that delegates to external reusable workflows for linting, type-checking, and testing. It performs no direct write, commit, or push operations. Since these are inherently read-only operations, contents: write is unnecessary and violates the principle of least privilege. Update line 12 to contents: read.

🤖 Prompt for AI Agents 
.github/workflows/ci.yml lines 11-14: the workflow grants repository contents
write access though it only orchestrates reusable workflows and requires
read-only access; change the permissions entry from "contents: write" to
"contents: read" while leaving the other permissions (pull-requests: write,
id-token: write) unchanged so the workflow follows least-privilege.


jobs:
lint:
uses: listee-dev/listee-ci/.github/workflows/lint.yml@main

typecheck:
uses: listee-dev/listee-ci/.github/workflows/typecheck.yml@main

test:
uses: listee-dev/listee-ci/.github/workflows/test.yml@main
Comment on lines +17 to +24
Copy link

@coderabbitai coderabbitai bot Oct 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Pin reusable workflows to specific tags or commit SHAs instead of @main.

Using @main for reusable workflows creates a security risk: if the external listee-dev/listee-ci repository is compromised or the main branch is modified unexpectedly, your CI pipeline could execute malicious code. Always pin to specific, immutable references (e.g., @v1.0.0 or @abc123def456...).

Identify the appropriate version or commit SHA for each reusable workflow and apply a diff similar to this:

   lint:
-    uses: listee-dev/listee-ci/.github/workflows/lint.yml@main
+    uses: listee-dev/listee-ci/.github/workflows/lint.yml@v1.0.0

   typecheck:
-    uses: listee-dev/listee-ci/.github/workflows/typecheck.yml@main
+    uses: listee-dev/listee-ci/.github/workflows/typecheck.yml@v1.0.0

   test:
-    uses: listee-dev/listee-ci/.github/workflows/test.yml@main
+    uses: listee-dev/listee-ci/.github/workflows/test.yml@v1.0.0

Once you identify the appropriate versions, please verify the reusable workflows documentation to confirm the exact version or commit SHA to use.

I'll verify the appropriate versions available for the listee-dev/listee-ci repository to determine what specific tags should be used for pinning.


---

🏁 Script executed:

```shell
#!/bin/bash
# Check if the repo exists and list available refs
gh repo view listee-dev/listee-ci 2>/dev/null | head -20

Length of output: 951

🌐 Web query:

listee-dev/listee-ci GitHub repository releases versions

💡 Result:

Releases for listee-dev/listee-ci (versions and publish dates):

  • v1.2.0 — 20 Sep 2025. [1]
  • v1.1.0 — 18 Sep 2025. [1]
  • v1.0.0 — 15 Sep 2025. [1]

Sources: GitHub repository and Releases page. [1] GitHub — listee-dev/listee-ci Releases. [2] GitHub — listee-dev/listee-ci repository main page.

Pin reusable workflows to specific, immutable references instead of @main.

Using @main creates a security risk: if the listee-dev/listee-ci repository is compromised, your CI pipeline could execute malicious code. The repository has available releases v1.2.0 (Sep 20, 2025), v1.1.0 (Sep 18, 2025), and v1.0.0 (Sep 15, 2025). Additionally, the repository includes a pinact.yml workflow that validates reusable workflows reference full-length commit SHAs, indicating that commit SHA pinning is the preferred approach.

Update the three workflows to use either the latest stable version or full commit SHAs:

   lint:
-    uses: listee-dev/listee-ci/.github/workflows/lint.yml@main
+    uses: listee-dev/listee-ci/.github/workflows/lint.yml@v1.2.0

   typecheck:
-    uses: listee-dev/listee-ci/.github/workflows/typecheck.yml@main
+    uses: listee-dev/listee-ci/.github/workflows/typecheck.yml@v1.2.0

   test:
-    uses: listee-dev/listee-ci/.github/workflows/test.yml@main
+    uses: listee-dev/listee-ci/.github/workflows/test.yml@v1.2.0

Alternatively, resolve to full commit SHAs for even stronger immutability guarantees.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
lint:
uses: listee-dev/listee-ci/.github/workflows/lint.yml@main
typecheck:
uses: listee-dev/listee-ci/.github/workflows/typecheck.yml@main
test:
uses: listee-dev/listee-ci/.github/workflows/test.yml@main
lint:
uses: listee-dev/listee-ci/.github/workflows/lint.yml@v1.2.0
typecheck:
uses: listee-dev/listee-ci/.github/workflows/typecheck.yml@v1.2.0
test:
uses: listee-dev/listee-ci/.github/workflows/test.yml@v1.2.0
🤖 Prompt for AI Agents 
.github/workflows/ci.yml lines 17-24: the reusable workflows are referenced with
the mutable @main ref which is insecure; update the three uses lines to point to
immutable refs by replacing @main with either a specific released tag (e.g.,
v1.2.0) or the full commit SHA for each reusable workflow in
listee-dev/listee-ci, ensuring you use the exact tag or corresponding commit SHA
for lint.yml, typecheck.yml and test.yml so the CI runs a pinned, immutable
workflow version.

Loading