Skip to content

build(deps): consolidate dependency updates #3420

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tac0turtle merged 1 commit into from
Aug 3, 2026
Merged

build(deps): consolidate dependency updates #3420

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .github/workflows/benchmark.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Go
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
Expand Down Expand Up @@ -55,7 +55,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Go
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
Expand Down Expand Up @@ -83,7 +83,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 20
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Go
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
Expand All @@ -105,7 +105,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Go
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
Expand All @@ -128,7 +128,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Go
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
Expand All @@ -155,7 +155,7 @@ jobs:
issues: write
pull-requests: write
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Download EVM benchmark results
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
outputs:
code: ${{ steps.filter.outputs.code }}
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
- uses: dorny/paths-filter@v4
id: filter
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dependabot-auto-fix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
if: github.actor == 'dependabot[bot]'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
with:
ref: ${{ github.head_ref }}

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docker-build-push.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ jobs:
app: ${{ fromJson(inputs.apps) }}
steps:
- name: Checkout code
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/docker-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ jobs:
name: Docker E2E Tests
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

github web search actions/checkout v7.0.1 commit 3d3c42e5aac5ba805825da76410c181273ba90b1

💡 Result:

The Git commit hash 3d3c42e5aac5ba805825da76410c181273ba90b1 corresponds to the release of actions/checkout version v7.0.1 [1][2]. This commit, titled "prep v7.0.1 release (#2531)," was authored on July 17, 2026, and the v7.0.1 release was officially published on July 20, 2026 [1][2]. This release included several updates and fixes, such as: * Skipping the unsafe pull request check if the input is set to the default [2]. * Trimming only ASCII whitespace for branch inputs [2]. * Escaping values passed to --unset [2]. * Various dependency updates [2]. You can view the specific commit details and the full changelog on the official GitHub repository for actions/checkout [1][2].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Repository occurrences:\n'
rg -n 'actions/checkout@v7\.0\.1|actions/checkout@[0-9a-fA-F]{40}' .github/workflows || true

printf '\nGit status/stash relevant:\n'
git status --short
git diff --stat || true

printf '\nTry GitHub API tag ref:\n'
curl -fsSL --max-time 20 https://api.github.com/repos/actions/checkout/git/refs/tags/v7.0.1 | jq '{ref, object_type: .object.type, object_sha: .object.sha, tag: (if .object.type=="tag" then .tag else null end)}' 2>/dev/null || true

printf '\nTry GitHub API tag object then commit if annotated:\n'
TAG_OBJ="$(curl -fsSL --max-time 20 'https://api.github.com/repos/actions/checkout/git/refs/tags/v7.0.1' | jq -r '.object.sha // empty' 2>/dev/null || true)" || true
echo "tag_object_sha=$TAG_OBJ"
if [ -n "$TAG_OBJ" ]; then
  curl -fsSL --max-time 20 "https://api.github.com/repos/actions/checkout/git/tags/$TAG_OBJ" \
    | jq '{sha, type, object_sha: .object.sha, tag: .tag}' 2>/dev/null || true
fi

printf '\nTry suggested commit via commits endpoint:\n'
curl -fsSL --max-time 20 https://api.github.com/repos/actions/checkout/commits/3d3c42e5aac5ba805825da764310c181273ba90b1 \ | jq '{sha, html_url}' 2>/dev/null || true

Repository: evstack/ev-node

Length of output: 3648

🌐 Web query:

site:github.com/actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 "prep v7.0.1 release"

💡 Result:

The commit 3d3c42e5aac5ba805825da76410c181273ba90b1 in the actions/checkout GitHub repository represents the preparation for the v7.0.1 release [1]. This commit, titled "prep v7.0.1 release" and associated with pull request #2531, was authored on July 17, 2026 [2][1]. The commit performed the following actions to prepare for the release: - Updated the version from 7.0.0 to 7.0.1 in package.json [2]. - Synchronized the package version fields in package-lock.json to 7.0.1 [2]. - Added a section for v7.0.1 to CHANGELOG.md [2].

Citations:

Pin actions/checkout to the immutable v7.0.1 commit.

Replace actions/checkout@v7.0.1 with the pinned commit 3d3c42e5aac5ba805825da76410c181273ba90b1 in the workflows still using the mutable tag.

🧰 Tools
🪛 zizmor (1.28.0)

[warning] 25-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 8 files
  • .github/workflows/docker-tests.yml#L25-L25 (this comment)
  • .github/workflows/docker-tests.yml#L45-L45
  • .github/workflows/docker-tests.yml#L65-L65
  • .github/workflows/docs_build.yml#L19-L19
  • .github/workflows/docs_deploy.yml#L31-L31
  • .github/workflows/docs_preview.yml#L24-L24
  • .github/workflows/lint.yml#L15-L15
  • .github/workflows/lint.yml#L40-L40
  • .github/workflows/lint.yml#L49-L49
  • .github/workflows/lint.yml#L63-L63
  • .github/workflows/lint.yml#L78-L78
  • .github/workflows/proto.yml#L14-L14
  • .github/workflows/release-apps.yml#L27-L27
  • .github/workflows/release-apps.yml#L78-L78
  • .github/workflows/release-github.yml#L35-L35
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker-tests.yml at line 25, Pin every actions/checkout
reference to the immutable commit 3d3c42e5aac5ba805825da76410c181273ba90b1
instead of the mutable v7.0.1 tag at .github/workflows/docker-tests.yml lines
25-25, 45-45, and 65-65; .github/workflows/docs_build.yml line 19-19;
.github/workflows/docs_deploy.yml line 31-31; .github/workflows/docs_preview.yml
line 24-24; .github/workflows/lint.yml lines 15-15, 40-40, 49-49, 63-63, and
78-78; .github/workflows/proto.yml line 14-14;
.github/workflows/release-apps.yml lines 27-27 and 78-78; and
.github/workflows/release-github.yml line 35-35.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow files present =="
git ls-files .github/workflows | sort

echo "== checkout usages =="
rg -n "actions/checkout@|persist-credentials|fetch-depth|git archive|tar/zip|upload-artifact|download-artifact" .github/workflows

echo "== file snippets around affected checkout usages =="
for f in .github/workflows/docker-tests.yml .github/workflows/docs_build.yml .github/workflows/docs_deploy.yml .github/workflows/lint.yml .github/workflows/proto.yml .github/workflows/release-apps.yml .github/workflows/release-github.yml; do
  if [ -f "$f" ]; then
    echo "--- $f ($(wc -l < "$f") lines) ---"
    nl -ba "$f" | sed -n '1,120p'
  fi
done

Repository: evstack/ev-node

Length of output: 5373

🌐 Web query:

actions/checkout persist-credentials default true README

💡 Result:

In the actions/checkout GitHub Action, the persist-credentials input determines whether the authentication token or SSH key used for the checkout is configured with the local git configuration [1][2]. Key details regarding this setting include: Default Value: The default value for persist-credentials is true [1][2]. Purpose: When set to true (the default), the action persists the credentials in the local git configuration of the checked-out repository [1][3]. This allows subsequent git commands (such as git fetch, git push, or git pull) executed later in your workflow to run with authenticated access automatically [4][5]. Security Enhancement: In recent versions (v6.0.0 and later), the implementation of credential persistence was updated to store these credentials in a separate file under the $RUNNER_TEMP directory instead of directly modifying the.git/config file, which improves security [3][6]. The credentials are removed automatically during the post-job cleanup phase [1][3]. Opt-Out: If you do not want your credentials persisted, you can explicitly set persist-credentials to false in your workflow step [1][5]. This is often done to increase security if the workflow does not require further authenticated git operations [4].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow snippets around affected checkout usages =="
for f in .github/workflows/docker-tests.yml .github/workflows/docs_build.yml .github/workflows/docs_deploy.yml .github/workflows/lint.yml .github/workflows/proto.yml .github/workflows/release-apps.yml .github/workflows/release-github.yml; do
  if [ -f "$f" ]; then
    echo "--- $f ($(wc -l < "$f") lines) ---"
    awk '{printf "%6d\t%s\n", NR, $0}' "$f" | sed -n '1,120p'
  fi
done

echo "== artifact/archive/download usages in relevant workflows =="
rg -n "upload-artifact|download-artifact|tar|zip|git archive|ghc|archive" .github/workflows/docker-tests.yml .github/workflows/docs_build.yml .github/workflows/docs_deploy.yml .github/workflows/lint.yml .github/workflows/proto.yml .github/workflows/release-apps.yml .github/workflows/release-github.yml || true

echo "== other checkout sites without persist-credentials =="
python3 - <<'PY'
import glob, re
for path in sorted(glob.glob('.github/workflows/*.yml')):
    text = open(path).read()
    for m in re.finditer(r'uses:\s*actions/checkout@([^\s#]+)(?:\s*#\s*(?:v[^\s]+|.*))?|persist-credentials:\s*([^\s#]+)', text):
        # simple pass: print checkout refs and persist settings in same file; not perfect for same line, but enough
        pass
PY

Repository: evstack/ev-node

Length of output: 21083

🌐 Web query:

actions/checkout persist-credentials true local git config /tmp runner credentials GitHub Actions

💡 Result:

In GitHub Actions, the persist-credentials input for the actions/checkout action controls whether the repository's authentication token (or SSH key) is configured in the local Git environment to allow subsequent Git commands in the workflow to run authenticated [1][2][3]. Evolution of Implementation: Historically, actions/checkout configured the Git authentication token directly within the local .git/config file [1][4]. However, starting with actions/checkout v6.0.0, the implementation was updated to improve security [4][5]. Instead of writing the credentials directly into the local repository configuration, the action now stores them in a separate file located under $RUNNER_TEMP and uses Git's includeIf conditional configuration to reference them [4][5]. This change prevents the sensitive credentials from residing directly within the .git/config file, which was previously a potential risk for accidental exposure [4][5]. Key Considerations: - Default Behavior: By default, persist-credentials is set to true [1][2]. - Functionality: When true, it enables your workflow scripts to run authenticated Git commands (e.g., git push or git pull) without requiring additional authentication steps [1][4][3]. - Cleanup: The authentication token is automatically removed by a post-job cleanup step once the job finishes [1][4]. - Security: While persist-credentials: true is the default, some users prefer setting it to false as a security best practice to minimize exposure if unnecessary [6][7]. If set to false, your workflow scripts will not have access to the repository's credentials via the Git configuration [1][3]. For scenarios involving Docker container actions, using persist-credentials (v6+) requires a minimum Actions Runner version of v2.329.0 to correctly access the credentials stored in $RUNNER_TEMP [4][5].

Citations:

🌐 Web query:

actions/checkout persist-credentials false workflow authenticated git operations

💡 Result:

In GitHub Actions, the persist-credentials input for the actions/checkout action controls whether the repository's authentication token (typically the GITHUB_TOKEN) is stored in the local Git configuration [1][2]. When persist-credentials is set to the default value of true, the action configures the runner's local Git environment with the necessary credentials to perform authenticated Git operations, such as git fetch or git push, throughout the remainder of the workflow job [1][2]. While convenient, this approach has historically been identified as a security risk because it leaves the credentials accessible to any subsequent step or third-party action in that same job [3][4]. If you set persist-credentials: false, the action will not store the authentication token in the Git configuration [1][3]. If your workflow requires performing authenticated Git operations later (such as a git push), you must manually authenticate Git within that specific step [4][5]. To perform authenticated Git operations when persist-credentials is false, you can explicitly configure the remote URL with the token in the step where the operation is needed [4][5]. An example of this pattern is: git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git" git push This approach ensures that credentials are only present and active during the exact step that requires them, rather than being persisted for the entire duration of the job [4][5]. Recent versions of actions/checkout have also improved security by storing these credentials in a more restricted location (under $RUNNER_TEMP) rather than directly in.git/config, though explicitly setting persist-credentials to false remains a recommended practice for hardening workflow security [2][3][6].

Citations:

Disable checkout credential persistence unless the job needs authenticated Git access.

actions/checkout persists the repo token by default. Add persist-credentials: false to these checkout steps unless a later step needs authenticated git commands:

  • .github/workflows/docker-tests.yml lines 25, 45, 65
  • .github/workflows/docs_build.yml line 19
  • .github/workflows/docs_deploy.yml lines 31-33 (add to the existing with block)
  • .github/workflows/lint.yml lines 15, 40, 49-51, 63-65, 78-80
  • .github/workflows/proto.yml line 14
  • .github/workflows/release-apps.yml lines 27, 78
  • .github/workflows/release-github.yml lines 35-37
🧰 Tools
🪛 zizmor (1.28.0)

[warning] 25-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 7 files
  • .github/workflows/docker-tests.yml#L25-L25 (this comment)
  • .github/workflows/docker-tests.yml#L45-L45
  • .github/workflows/docker-tests.yml#L65-L65
  • .github/workflows/docs_build.yml#L19-L19
  • .github/workflows/docs_deploy.yml#L31-L33
  • .github/workflows/lint.yml#L15-L15
  • .github/workflows/lint.yml#L40-L40
  • .github/workflows/lint.yml#L49-L51
  • .github/workflows/lint.yml#L63-L65
  • .github/workflows/lint.yml#L78-L80
  • .github/workflows/proto.yml#L14-L14
  • .github/workflows/release-apps.yml#L27-L27
  • .github/workflows/release-apps.yml#L78-L78
  • .github/workflows/release-github.yml#L35-L37
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker-tests.yml at line 25, Disable checkout credential
persistence by adding persist-credentials: false to each actions/checkout step
at .github/workflows/docker-tests.yml:25-25, 45-45, and 65-65;
.github/workflows/docs_build.yml:19-19; .github/workflows/docs_deploy.yml:31-33
within its existing with block; .github/workflows/lint.yml:15-15, 40-40, 49-51,
63-65, and 78-80; .github/workflows/proto.yml:14-14;
.github/workflows/release-apps.yml:27-27 and 78-78; and
.github/workflows/release-github.yml:35-37. Preserve any existing checkout
options and do not change steps that require authenticated git commands.

Source: Linters/SAST tools

- name: set up go
uses: actions/setup-go@v6.5.0
with:
Expand All @@ -42,7 +42,7 @@ jobs:
contents: read
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
- name: set up go
uses: actions/setup-go@v6.5.0
with:
Expand All @@ -62,7 +62,7 @@ jobs:
contents: read
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
- name: set up go
uses: actions/setup-go@v6.5.0
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docs_build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1
- name: Setup Node
uses: actions/setup-node@v6
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docs_deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1
with:
fetch-depth: 0 # Not needed if lastUpdated is not enabled
# - uses: pnpm/action-setup@v2 # Uncomment this if you're using pnpm
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docs_preview.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:
permissions: write-all
steps:
- name: Checkout
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1
with:
persist-credentials: false

Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
name: golangci-lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
- uses: actions/setup-go@v6.5.0
with:
go-version-file: ./go.mod
Expand All @@ -37,7 +37,7 @@ jobs:
hadolint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
- uses: hadolint/hadolint-action@v3.3.0
with:
recursive: true
Expand All @@ -46,7 +46,7 @@ jobs:
yamllint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- uses: technote-space/get-diff-action@v6.1.2
Expand All @@ -60,7 +60,7 @@ jobs:
markdown-lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- uses: technote-space/get-diff-action@v6.1.2
Expand All @@ -75,7 +75,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- uses: technote-space/get-diff-action@v6.1.2
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/proto.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
- uses: bufbuild/buf-action@v1
with:
format: false
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/release-apps.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
dockerfile: ${{ steps.parse.outputs.dockerfile }}
steps:
- name: Checkout code
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1

- name: Parse tag and validate app
id: parse
Expand Down Expand Up @@ -75,7 +75,7 @@ jobs:
packages: write
steps:
- name: Checkout code
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release-github.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jobs:
echo "::notice::Tag validation passed: $TAG"

- name: Checkout code
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1
with:
fetch-depth: 0

Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/rust-lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
Expand All @@ -36,7 +36,7 @@ jobs:
contents: read
steps:
- name: Checkout code
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
Expand Down Expand Up @@ -70,7 +70,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1

- name: Run cargo audit
uses: actions-rust-lang/audit@v1
Expand All @@ -82,7 +82,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/rust-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1

- name: Setup Rust
uses: ./.github/actions/rust-setup
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/rust-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
- nightly
steps:
- name: Checkout code
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1

- name: Setup Rust
uses: ./.github/actions/rust-setup
Expand Down Expand Up @@ -62,7 +62,7 @@ jobs:
if: github.event_name == 'pull_request'
steps:
- name: Checkout code
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
name: Build All ev-node Binaries
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
- name: set up go
uses: actions/setup-go@v6.5.0
with:
Expand All @@ -27,7 +27,7 @@ jobs:
name: Go Mod Tidy Check
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
- uses: actions/setup-go@v6.5.0
with:
go-version-file: ./go.mod
Expand All @@ -44,7 +44,7 @@ jobs:
contents: read
packages: read
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
- name: set up go
uses: actions/setup-go@v6.5.0
with:
Expand All @@ -64,7 +64,7 @@ jobs:
name: Run Integration Tests
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
- name: set up go
uses: actions/setup-go@v6.5.0
with:
Expand All @@ -88,7 +88,7 @@ jobs:
contents: read
packages: read
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
- name: set up go
uses: actions/setup-go@v6.5.0
with:
Expand All @@ -115,7 +115,7 @@ jobs:
needs: build_all-apps
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
- name: set up go
uses: actions/setup-go@v6.5.0
with:
Expand All @@ -133,7 +133,7 @@ jobs:
permissions:
actions: read
steps:
- uses: actions/checkout@v7.0.0
- uses: actions/checkout@v7.0.1
- name: Download unit test coverage report
uses: actions/download-artifact@v8.0.1
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/update-onboarding-skill.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ jobs:
id-token: write
steps:
- name: Checkout repository
uses: actions/checkout@v7.0.0
uses: actions/checkout@v7.0.1
with:
fetch-depth: 0 # Full history for commit analysis
Comment on lines 17 to 20

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== files =="
git ls-files | rg '(^|/)\.github/workflows/update-onboarding-skill\.yml$|\.github/workflows/update-onboarding-skill\.yml' || true

echo "== target workflow =="
cat -n .github/workflows/update-onboarding-skill.yml | sed -n '1,220p'

echo "== search for action permissions/run behavior mentions =="
rg -n "permissions:|anthropics/claude-code-action|actions/checkout|persist-credentials|GITHUB_TOKEN|git push|gh " .github/workflows/update-onboarding-skill.yml .github/workflows || true

echo "== workflow syntax parse-ish line count =="
wc -l .github/workflows/update-onboarding-skill.yml

Repository: evstack/ev-node

Length of output: 12956

🌐 Web query:

anthropics claude-code-action v1 Bash(git:*) local git config credentials token

💡 Result:

The anthropics/claude-code-action@v1 action handles Git authentication internally to allow Claude to perform Git operations (such as committing changes) without permanently embedding tokens in the repository configuration [1][2]. How it manages Git credentials: 1. Credential Helper Approach: The action typically configures a custom Git credential helper to manage authentication [1][2]. It creates a temporary helper script (e.g., named.git-credential-gh-token) alongside the action source [1][2]. This script is configured via git config credential.helper to read the token from an environment variable (often GH_TOKEN) at the time of authentication, rather than hardcoding the token into the Git remote URL or local configuration [1][2]. 2. Remote URL Alternative: In certain configurations or fallback scenarios, the action may update the remote URL directly to include the token (e.g., https://x-access-token:${githubToken}`@github.com/`...) [1][2]. 3. Interaction with actions/checkout: Users have reported that the action may overwrite existing Git credentials, potentially causing issues for subsequent steps (e.g., git push) if the environment is not restored [3][4]. As a result, if you encounter authentication errors in steps following the action, you may need to explicitly handle credential cleanup or re-authentication, such as using an.extraheader configuration if you are relying on a persistent token from a previous checkout step [4]. Key Configuration Notes: - The github_token input is optional and generally only required if you are connecting a custom GitHub App of your own [5]. - If you use actions/checkout with persist-credentials: false, ensure you provide the necessary tokens directly to the claude-code-action or handle the credential setup to avoid fetch failures, as the action's internal setup might not automatically inherit the credentials from the checkout step [3]. For the most up-to-date and specific guidance on your repository's security requirements, refer to the official documentation at https://code.claude.com/docs/en/github-actions [6][7].

Citations:

🌐 Web query:

actions/checkout v7.0.1 persist-credentials default true

💡 Result:

In the actions/checkout action, including version v7.0.1, the default value for the persist-credentials input is true [1][2][3][4]. This parameter determines whether the action configures the Git credential helper with the provided token or SSH key [1][2][4]. When set to true (the default), the credentials are added to the local Git configuration, allowing subsequent steps in the workflow to perform authenticated Git commands [1][3][5]. The action automatically cleans up these credentials during the post-job phase [1][3]. If you wish to opt out of this behavior, you must explicitly set persist-credentials: false in your workflow configuration [1][3][5].

Citations:

Disable persisted checkout credentials before running Claude.

The checkout step persists the write-capable GITHUB_TOKEN in .git/config, and the Claude step can run Bash(git:*). Set persist-credentials: false on checkout, and configure scoped GITHUB_TOKEN authentication only on the later git push / gh commands.

🧰 Tools
🪛 zizmor (1.28.0)

[warning] 17-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/update-onboarding-skill.yml around lines 17 - 20, Update
the checkout action configuration in the repository onboarding workflow to set
persist-credentials to false. Preserve the existing full-history checkout, and
ensure authentication is provided explicitly and only for the later git push or
gh commands rather than persisted for the Claude step.

Source: Linters/SAST tools


Expand Down
Loading
Loading