Fix CI pipeline security issues reported by zizmor - #1242
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis PR hardens CI/CD security across the repository by configuring Dependabot cooldown periods and systematically updating GitHub Actions workflows to add explicit permissions, pin actions to commit SHAs for reproducibility, disable credential persistence, and update tool versions. ChangesCI/CD Security Hardening and Configuration Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/dependabot.yml (1)
10-11: Consider the security tradeoff of the 7-day cooldown period.Adding a 7-day cooldown reduces PR noise but may delay critical security patches. If a vulnerability is discovered in a dependency shortly after Dependabot closes or merges a PR, it will wait 7 days before opening a new PR with the security fix. Consider whether the noise reduction justifies this potential delay in applying security updates, or if a shorter cooldown period (e.g., 2-3 days) might provide a better balance.
Also applies to: 22-23
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/dependabot.yml around lines 10 - 11, The Dependabot cooldown is set to 7 days under the cooldown -> default-days key which may delay critical security fixes; change the value to a shorter period (e.g., 2 or 3) or document an exception policy so security PRs are handled faster—update the cooldown.default-days value from 7 to the chosen smaller number (or add a comment/policy alongside it) to strike a better balance between noise reduction and timely vulnerability patches.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pypi-publish.yml:
- Around line 8-9: Update the workflow permissions and publish step to use OIDC:
add permissions: id-token: write alongside contents: read in the workflow
top-level permissions, and in the "Build and publish" step remove the use of
TWINE_PASSWORD from secrets.PYPI_API_TOKEN and the direct uvx twine@6.2.0
upload; instead switch the publish step to an OIDC-capable publisher (for
example pypa/gh-action-pypi-publish or an equivalent action) that obtains a
short-lived token via the id-token and does not rely on long-lived secrets,
updating references to TWINE_PASSWORD, secrets.PYPI_API_TOKEN and the uvx twine
invocation accordingly.
In @.github/workflows/update-version.yml:
- Around line 15-16: The workflow currently sets permissions: contents: read and
uses actions/checkout with persist-credentials: false, which prevents git push
by EndBug/add-and-commit; change the workflow to grant write access by setting
permissions: contents: write and/or enable persist-credentials: true on
actions/checkout, and ensure EndBug/add-and-commit receives an explicit token
(e.g., pass GH_TOKEN to its token input) so the created branch ${ env.NEW_BRANCH
} can be committed and pushed successfully.
---
Nitpick comments:
In @.github/dependabot.yml:
- Around line 10-11: The Dependabot cooldown is set to 7 days under the cooldown
-> default-days key which may delay critical security fixes; change the value to
a shorter period (e.g., 2 or 3) or document an exception policy so security PRs
are handled faster—update the cooldown.default-days value from 7 to the chosen
smaller number (or add a comment/policy alongside it) to strike a better balance
between noise reduction and timely vulnerability patches.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: db46eec7-c66c-4f56-98f9-b0fc43cc291f
📒 Files selected for processing (7)
.github/dependabot.yml.github/workflows/documentation.yml.github/workflows/pre-release-tests.yml.github/workflows/pypi-publish.yml.github/workflows/release-drafter.yml.github/workflows/tests.yml.github/workflows/update-version.yml
|
Your review plz @Strift |
Strift
added
the
maintenance
Strift
left a comment
Strift
left a comment
There was a problem hiding this comment.
Hey @DhavalGojiya, thanks for the PR!
I love the clean-up and security enhancements 🙌
2 participants
Description
Fixes all CI pipeline security issues reported by zizmor
% uvx zizmor .
PR checklist
Please check if your PR fulfills the following requirements:
Thank you so much for contributing to Meilisearch!
Summary
This PR addresses CI pipeline security issues identified by the Zizmor security audit tool. It hardens GitHub Actions workflows and related configuration by tightening GitHub token permissions, pinning third-party action references to commit SHAs, and reducing credential exposure in workflow runs.
Changes
Workflow Security Hardening
Permission scoping (least privilege):
permissionsblocks to restrict token access, including:documentation.yml,tests.yml,pypi-publish.yml,update-version.yml: top-levelcontents: readdocumentation.yml: job-level permissions for Pages deploymentrelease-drafter.yml: job-levelcontents: writeandpull-requests: writepre-release-tests.yml: job-levelcontents: readAction pinning (remove tag-based references):
actions/checkout,actions/setup-python,astral-sh/setup-uv, and other actions) to specific commit SHAs instead of version tags.Credential handling:
persist-credentials: falseonactions/checkoutsteps in the affected workflows to avoid unintended credential/token persistence.Tooling/version updates:
astral-sh/setup-uvusage to a newer pinned revision and updated the installeduvversion to0.11.21across applicable workflows.ibiqlik/action-yamllintaction to a pinned revision intests.yml.EndBug/add-and-commitandrelease-drafter/release-drafterto pinned revisions inupdate-version.ymlandrelease-drafter.ymlrespectively.Configuration Updates
Dependabot:
.github/dependabot.ymlto add acooldownconfiguration withdefault-days: 7for the relevant dependency update entries.Pre-release tests:
${MEILISEARCH_VERSION}(shell environment variable syntax) instead of${{ env.MEILISEARCH_VERSION }}.Impact
Overall, these changes reduce CI/CD attack surface by enforcing least-privilege permissions, preventing action supply-chain risks via commit pinning, and limiting token/credential exposure during checkout—directly addressing Zizmor’s GitHub Actions workflow security findings.