update actions to latest version - #9843
Conversation
📝 WalkthroughWalkthroughChangesCI workflow updates
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/check_todos.yml:
- Line 12: Update the actions/checkout step in the workflow to set
persist-credentials to false, ensuring the repository-controlled
tools/check-todos.sh step cannot access persisted GITHUB_TOKEN credentials.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 627a0220-5147-4f29-b798-b0640dd0c15b
📒 Files selected for processing (5)
.github/workflows/build_test_deploy.yml.github/workflows/check_todos.yml.github/workflows/create_multica_issue.yml.github/workflows/nightly.yml.github/workflows/wkorg-nightly.yaml
| if: "!github.event.pull_request.draft" | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## workflow files"
git ls-files .github/workflows || true
echo
echo "## check_todos.yml"
if [ -f .github/workflows/check_todos.yml ]; then
nl -ba .github/workflows/check_todos.yml | sed -n '1,220p'
fi
echo
echo "## checkout usages in workflows"
rg -n "actions/checkout@|persist-credentials|run:|sh:'|bash" .github/workflows || true
echo
echo "## current git diff stat/name-status"
git diff --stat
git diff --name-statusRepository: scalableminds/webknossos
Length of output: 500
🌐 Web query:
actions/checkout persistent credentials default true persist-credentials README
💡 Result:
The persist-credentials input for the actions/checkout GitHub Action currently has a default value of true [1][2][3][4]. This setting controls whether the action configures the authentication token or SSH key with the local git configuration, which enables subsequent git commands in your workflow to run authenticated [5][2][6]. When set to true, the credentials are used to configure the environment, and the action ensures they are removed during post-job cleanup [5][2][6]. While discussions have occurred regarding changing this default to false to further reduce security risks associated with the GITHUB_TOKEN [7], as of July 2026, the official documentation and action definition files maintain true as the default [1][2][4]. Users who wish to disable this behavior can explicitly set persist-credentials: false in their workflow configuration [5][2][6].
Citations:
- 1: https://github.com/actions/checkout/blob/cbb722410c2e876e24abbe8de2cc27693e501dcb/action.yml
- 2: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 3: https://github.com/actions/checkout/blob/34e114876b0b11c390a56381ad16ebd13914f8d5/action.yml
- 4: https://github.com/actions/checkout/blob/72f2cec99f417b1a1c5e2e88945068983b7965f9/action.yml
- 5: https://github.com/marketplace/actions/checkout?version=v3.6.0
- 6: https://github.com/actions/checkout/tree/v6.0.2
- 7: Change the default value of persist-credentials to false actions/checkout#1687
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## workflow files"
git ls-files .github/workflows || true
echo
echo "## check_todos.yml"
if [ -f .github/workflows/check_todos.yml ]; then
nl -ba .github/workflows/check_todos.yml | sed -n '1,220p'
fi
echo
echo "## checkout usages in workflows"
rg -n "actions/checkout@|persist-credentials|run:|sh:'|bash" .github/workflows || true
echo
echo "## checkout action versions referenced"
rg -n "actions/checkout@" .github/workflows || true
echo
echo "## action pin/tag metadata if available locally"
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
[ -f "$f" ] || continue
echo "--- $f"
rg -n "uses: actions/checkout@|persist-credentials:" "$f" || true
doneRepository: scalableminds/webknossos
Length of output: 500
🌐 Web query:
actions/checkout README persist-credentials default true
💡 Result:
The persist-credentials input for the actions/checkout GitHub Action has a default value of true [1][2][3]. When set to true, the action configures the local git repository with the provided token or SSH key, which allows subsequent steps in the same job to execute authenticated git commands [1][4][5]. The token is subsequently removed during the post-job cleanup phase [1][2]. While there have been community discussions and pull requests proposing to change this default to false to enhance security and prevent potential exposure of the token [6][7], the default remains true in the official implementation as of July 2026 [1][2][3]. To opt out of this behavior, users must explicitly set persist-credentials to false in their workflow configuration [1][4].
Citations:
- 1: https://github.com/actions/checkout?tab=readme-ov-file
- 2: https://github.com/actions/checkout/blob/main/README.md
- 3: https://github.com/actions/checkout/blob/cbb722410c2e876e24abbe8de2cc27693e501dcb/action.yml
- 4: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 5: https://github.com/actions/checkout/blob/72f2cec99f417b1a1c5e2e88945068983b7965f9/action.yml
- 6: Change the default value of persist-credentials to false actions/checkout#1687
- 7: Remove
persist-credentialsor change the default tofalseactions/checkout#485
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## check_todos.yml full contents"
python3 - <<'PY'
from pathlib import Path
p = Path('.github/workflows/check_todos.yml')
text = p.read_text()
for i, line in enumerate(text.splitlines(), 1):
print(f"{i:5d}\t{line}")
PY
echo
echo "## checkout usages and command steps in workflows"
python3 - <<'PY'
import re, glob
for path in glob.glob('.github/workflows/*'):
text = open(path).read()
if 'actions/checkout' in text or 'run:' in text:
print(f'--- {path}')
lines = text.splitlines()
for i, line in enumerate(lines, 1):
if 'actions/checkout' in line or 'persist-credentials' in line or re.search(r'^( +- +)?run:', line):
lo=max(1,i-1); hi=min(len(lines),i+4)
print(f'[{lo}-{hi}]')
for j in range(lo,hi+1):
print(f'{j:5d}\t{lines[j-1]}')
print()
PYRepository: scalableminds/webknossos
Length of output: 2666
Disable persisted checkout credentials.
The checkout step is only followed by the repository-controlled tools/check-todos.sh script and does not need authenticated Git operations. actions/checkout@v7 persists the token by default, so set persist-credentials: false to avoid exposing GITHUB_TOKEN to later steps.
Proposed fix
- uses: actions/checkout@v7
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v7 | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 12-12: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/check_todos.yml at line 12, Update the actions/checkout
step in the workflow to set persist-credentials to false, ensuring the
repository-controlled tools/check-todos.sh step cannot access persisted
GITHUB_TOKEN credentials.
Source: Linters/SAST tools
2 participants
Summary
Latest Version
actions/checkout@v7(previously v3 or v4)actions/setup-node@v7(previously v4)actions/upload-artifact@v7(previously v4)actions/setup-java@v5(previously v4)docker/setup-buildx@v4(previously v3)docker/build-push-action@v7(previously v6)docker/login-action@v4(previously v3)actions/github-script@v9(previously v7)