Skip to content

LCORE- Update checkout action #2074

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tisnik merged 1 commit into from
Jul 7, 2026
Merged

LCORE- Update checkout action #2074

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/black.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:
contents: read
pull-requests: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@coderabbitai coderabbitai Bot Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Version bump is correct; consider hardening the checkout step.

The v4 → v7 bump is valid (v7.0.0 is the current GA release) and matches the PR's stated intent. Static analysis flags two pre-existing gaps on this line worth addressing while touching it: the action isn't pinned to a commit SHA, and persist-credentials: false isn't set (credentials otherwise remain in the local git config for the rest of the job).

🔒 Suggested hardening 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@a1caf0398a3f77c5db1a91c264eb1f6a0cb0e4d6 # v7.0.0
+        with:
+          persist-credentials: false

Please verify the exact commit SHA for v7.0.0 before pinning.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v7
- uses: actions/checkout@a1caf0398a3f77c5db1a91c264eb1f6a0cb0e4d6 # v7.0.0
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 14-14: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 14-14: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/black.yaml at line 14, The checkout step in the workflow
should be hardened while keeping the actions/checkout v7 upgrade. Update the
`actions/checkout` reference in the workflow to a pinned commit SHA for v7.0.0,
and set `persist-credentials: false` on that same checkout step so credentials
are not left in the git config. Use the existing checkout invocation as the
anchor and adjust only this step.

Source: Linters/SAST tools

- name: Install uv
uses: astral-sh/setup-uv@v5
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/build_and_push_dev.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
# qemu is required for arm64 builds
sudo apt install -y buildah qemu-user-static
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7

@coderabbitai coderabbitai Bot Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Version bump is correct; consider pinning to a commit SHA.

Bump to v7 is valid. zizmor flags this line as unpinned (unpinned-uses), which is a pre-existing pattern (v4 was also a floating tag) but is required by the stated "blanket policy."

🔒 Suggested hardening 
-        uses: actions/checkout@v7
+        uses: actions/checkout@a1caf0398a3f77c5db1a91c264eb1f6a0cb0e4d6 # v7.0.0

Please verify the exact commit SHA for v7.0.0 before pinning.

🧰 Tools
🪛 zizmor (1.26.1)

[error] 28-28: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build_and_push_dev.yaml at line 28, The checkout step is
using a floating actions tag, which violates the pinning policy. Update the uses
reference in the workflow’s checkout step to a specific commit SHA for
actions/checkout v7 rather than the version tag, and verify the SHA corresponds
to v7.0.0 before changing it.

Source: Linters/SAST tools

with:
# Fetch submodules (required for lightspeed-providers)
submodules: 'recursive'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/build_pr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
# qemu is required for arm64 builds
sudo apt install -y buildah qemu-user-static
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7

@coderabbitai coderabbitai Bot Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Version bump is correct; same unpinned-ref concern as build_and_push_dev.yaml.

Consistent with the sibling workflow's checkout step; consider pinning to a SHA to satisfy the blanket unpinned-uses policy flagged by zizmor.

🧰 Tools
🪛 zizmor (1.26.1)

[error] 26-26: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build_pr.yaml at line 26, The checkout step in the
workflow is still using an unpinned action reference, which violates the
unpinned-uses policy. Update the `actions/checkout` usage in this workflow to a
pinned commit SHA, matching the approach used or intended for the sibling
workflow referenced by `build_and_push_dev.yaml`, so the `checkout` step remains
functionally the same but is pinned for supply-chain safety.

Source: Linters/SAST tools

with:
# Fetch submodules (required for lightspeed-providers)
submodules: 'recursive'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/check_dependencies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:
contents: read
pull-requests: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@coderabbitai coderabbitai Bot Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Version bump is correct; same pinning/persist-credentials gaps as black.yaml.

Same pattern as black.yaml (Line 14): unpinned ref plus missing persist-credentials: false. Consider applying the same hardening here for consistency.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 14-14: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 14-14: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/check_dependencies.yaml at line 14, The checkout step in
the workflow uses an unpinned action ref and does not disable credential
persistence, matching the same hardening gap as in black.yaml. Update the
`actions/checkout` usage in this workflow to a pinned version/ref and set
`persist-credentials` to false, following the same pattern used for the hardened
checkout configuration elsewhere.

Source: Linters/SAST tools

- name: Install uv
uses: astral-sh/setup-uv@v5
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/e2e_tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
E2E_LLAMA_HOSTNAME: ${{ vars.E2E_LLAMA_HOSTNAME || 'llama-stack' }}

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7
with:
# On PR_TARGET → the fork (or same repo) that opened the PR.
# On push → falls back to the current repository.
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/e2e_tests_lightspeed_evaluation.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
# On PR_TARGET → the fork (or same repo) that opened the PR.
# On push → falls back to the current repository.
Expand Down Expand Up @@ -47,7 +47,7 @@ jobs:
git log --oneline -5

- name: Checkout lightspeed-Evaluation
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
repository: lightspeed-core/lightspeed-evaluation
path: lightspeed-evaluation
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/e2e_tests_rhaiis.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ jobs:
E2E_DEFAULT_PROVIDER_OVERRIDE: vllm

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7
with:
# On PR_TARGET → the fork (or same repo) that opened the PR.
# On push → falls back to the current repository.
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/integration_tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
matrix:
python-version: ["3.12", "3.13"]
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7
- name: Install uv
uses: astral-sh/setup-uv@v5
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/mypy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:
contents: read
pull-requests: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7
- name: Install uv
uses: astral-sh/setup-uv@v5
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/openapi_spectral.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ jobs:
contents: read
pull-requests: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@coderabbitai coderabbitai Bot Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Workflow excerpt:"
sed -n '1,80p' .github/workflows/openapi_spectral.yaml | cat -n

echo
echo "Search for other checkout references:"
rg -n "actions/checkout@" .github/workflows -n

Repository: lightspeed-core/lightspeed-stack

Length of output: 3738

Pin actions/checkout to a commit SHA.

actions/checkout@v7 is a floating external reference; pin it to a specific commit SHA before merging.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 18-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/openapi_spectral.yaml at line 18, The workflow step using
actions/checkout is referencing a floating tag instead of a fixed revision.
Update the checkout step in the openapi spectral workflow to pin
actions/checkout to a specific commit SHA rather than `@v7`, keeping the same step
location and action usage but replacing the external reference with an immutable
digest.

Source: Linters/SAST tools

- name: Install uv
uses: astral-sh/setup-uv@v5
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/outdated_dependencies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:
contents: read
pull-requests: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@coderabbitai coderabbitai Bot Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

git ls-files .github/workflows && printf '\n---\n' && rg -n "uses:\s*actions/checkout@|uses:\s*.*`@v`[0-9]+" .github/workflows -n

Repository: lightspeed-core/lightspeed-stack

Length of output: 4367

🏁 Script executed:

cat -n .github/workflows/outdated_dependencies.yaml | sed -n '1,40p'

Repository: lightspeed-core/lightspeed-stack

Length of output: 802

Pin the external actions in this workflow. actions/checkout@v7 and astral-sh/setup-uv@v5 are floating references; pinning them to commit SHAs would reduce supply-chain drift.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 14-14: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 14-14: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/outdated_dependencies.yaml at line 14, The workflow uses
floating action references, so update the external actions in this job to pinned
commit SHAs instead of version tags. Replace the `actions/checkout` and
`astral-sh/setup-uv` references in the workflow with their full SHA-pinned
equivalents, and keep the existing step structure intact so the pinned action
versions remain easy to locate and maintain.

Source: Linters/SAST tools

- name: Install uv
uses: astral-sh/setup-uv@v5
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pydocstyle.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:
contents: read
pull-requests: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@coderabbitai coderabbitai Bot Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

git ls-files .github/workflows/pydocstyle.yaml README.md .github/workflows

Repository: lightspeed-core/lightspeed-stack

Length of output: 986

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== pydocstyle workflow =="
cat -n .github/workflows/pydocstyle.yaml | sed -n '1,120p'

echo
echo "== pinning guidance search =="
rg -n --hidden --glob '!**/.git/**' -e 'pin|SHA|checkout@v|actions/checkout' README.md .github/workflows .github 2>/dev/null || true

Repository: lightspeed-core/lightspeed-stack

Length of output: 5014

🌐 Web query:

actions/checkout v7 release GitHub tag

💡 Result:

The actions/checkout v7 release was officially published on June 18, 2026, under the version tag v7.0.0 [1][2][3]. Key details regarding the v7 release include: - General Availability: The release was made generally available on June 18, 2026 [3]. - Security Improvements: A primary feature of v7 is improved security for workflows using pull_request_target or workflow_run triggers [3][4]. By default, v7 refuses to check out code from fork pull requests in these scenarios to prevent security vulnerabilities, such as "pwn request" attacks [3][4]. Users who require this functionality can opt in by setting the new input allow-unsafe-pr-checkout: true [4]. - Technical Updates: The action was migrated to ESM (ECMAScript Modules) to support newer versions of the @actions/* packages, requiring a minimum Actions Runner version of v2.327.1 [5][4]. - Documentation: Updated usage examples now reference actions/checkout@v7 [6][7][4]. For additional details, the full changelog and release notes are available on the official GitHub repository for actions/checkout [1][2][8].

Citations:

Pin actions/checkout to a commit SHA. actions/checkout@v7 is a floating major tag; use the v7 commit SHA instead.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 14-14: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 14-14: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pydocstyle.yaml at line 14, The workflow uses a floating
major tag for actions/checkout, so update the checkout step in the pydocstyle
workflow to reference the v7 commit SHA instead of `@v7`. Locate the uses:
actions/checkout entry and replace the tag with the pinned SHA so the action
version is fixed and reproducible.

Source: Linters/SAST tools

- name: Install uv
uses: astral-sh/setup-uv@v5
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pylint.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
pull-requests: read
name: "Pylinter"
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@coderabbitai coderabbitai Bot Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the workflow and any repository guidance about pinning actions.
git ls-files .github/workflows/pylint.yaml README.md .github | sed -n '1,120p'
printf '\n--- pylint workflow ---\n'
cat -n .github/workflows/pylint.yaml

printf '\n--- search for action pinning guidance ---\n'
rg -n --hidden --glob '!.git' -e 'pin(ning)?' -e 'actions/checkout@' -e 'commit SHA' -e 'SHA' -e 'security policy' .github README.md .

Repository: lightspeed-core/lightspeed-stack

Length of output: 50390

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n--- .github/dependabot.yml ---\n'
cat -n .github/dependabot.yml

printf '\n--- .github/renovate.json ---\n'
cat -n .github/renovate.json

printf '\n--- workflow action references ---\n'
rg -n --hidden --glob '.github/workflows/*.yaml' 'uses:\s+[^@]+@v[0-9]+' .github/workflows

printf '\n--- pinned SHA references in workflows ---\n'
rg -n --hidden --glob '.github/workflows/*.yaml' 'uses:\s+[^@]+@[0-9a-f]{7,40}' .github/workflows

Repository: lightspeed-core/lightspeed-stack

Length of output: 4460

Pin actions/checkout to a commit SHA. actions/checkout@v7 is a floating external reference; pin it to a commit SHA before merge.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 15-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 15-15: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pylint.yaml at line 15, The workflow step using
actions/checkout is still referencing a floating tag, so update that checkout
usage to a specific commit SHA instead of actions/checkout@v7. Keep the same
workflow step in pylint.yaml and replace the external action reference with a
pinned SHA-based version so the pipeline uses an immutable dependency.

Source: Linters/SAST tools

- name: Install uv
uses: astral-sh/setup-uv@v5
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pyright.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
pull-requests: read
name: "Pyright"
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@coderabbitai coderabbitai Bot Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the workflow around the reported line.
git ls-files .github/workflows/pyright.yaml
cat -n .github/workflows/pyright.yaml | sed -n '1,40p'

# Try to resolve the referenced action tag to a commit SHA, if network/API access is available.
python3 - <<'PY'
import json, urllib.request, urllib.error
url = "https://api.github.com/repos/actions/checkout/git/refs/tags/v7"
req = urllib.request.Request(url, headers={"Accept":"application/vnd.github+json","User-Agent":"CodeRabbit"})
try:
    with urllib.request.urlopen(req, timeout=20) as r:
        data = json.load(r)
    print("REF:", json.dumps(data, indent=2))
except Exception as e:
    print("ERROR:", repr(e))
PY

Repository: lightspeed-core/lightspeed-stack

Length of output: 993

Pin actions/checkout to a commit SHA. .github/workflows/pyright.yaml:15 uses the mutable actions/checkout@v7 tag; pinning it removes supply-chain drift risk.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 15-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 15-15: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pyright.yaml at line 15, The workflow step in pyright.yaml
uses the mutable actions/checkout@v7 tag; update the checkout action reference
to a pinned commit SHA instead of the version tag. Locate the step using
actions/checkout and replace the tag with the corresponding full commit hash to
keep the action immutable.

Source: Linters/SAST tools

- name: Install uv
uses: astral-sh/setup-uv@v5
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ruff.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:
contents: read
pull-requests: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@coderabbitai coderabbitai Bot Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Version bump is correct; same pinning/persist-credentials gaps as black.yaml.

Same pattern as black.yaml (Line 14): unpinned ref plus missing persist-credentials: false.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 14-14: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 14-14: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ruff.yaml at line 14, The checkout step in the ruff
workflow should use a pinned action reference and disable credential
persistence, matching the same fix needed in black.yaml. Update the
actions/checkout usage in the workflow job to a specific immutable version or
commit SHA, and add persist-credentials: false in the checkout configuration so
the workflow does not retain the default token.

Source: Linters/SAST tools

- name: Install uv
uses: astral-sh/setup-uv@v5
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/shellcheck.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,6 @@ jobs:
contents: read
pull-requests: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

@coderabbitai coderabbitai Bot Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Version bump is correct; same pinning/persist-credentials gaps as black.yaml.

Same pattern as black.yaml (Line 14): unpinned ref plus missing persist-credentials: false.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 14-14: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 14-14: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/shellcheck.yaml at line 14, The checkout step in this
workflow still uses an unpinned actions ref and does not disable credential
persistence, matching the issue noted in black.yaml. Update the actions/checkout
usage in the workflow to a specific commit SHA or other pinned ref, and add
persist-credentials: false on the same checkout step so it does not leave repo
credentials available after the job runs.

Source: Linters/SAST tools

- name: Shell check
run: make shellcheck
2 changes: 1 addition & 1 deletion .github/workflows/unit_tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
matrix:
python-version: ["3.12", "3.13"]
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7
- name: Install uv
uses: astral-sh/setup-uv@v5
with:
Expand Down
Loading