ci(anchor-drift): stop persisting credentials on all six checkout steps (CWE-522) - #55
Merged
Merged
Conversation
The workflow triggers on pull_request and every job runs repository-controlled code (scripts/, conformance/, validate-a2ml.sh from the PR ref). checkout leaves the token in .git/config by default, so that code runs beside a usable credential. No job in this workflow pushes, commits, or reads GITHUB_TOKEN/secrets — the grep is empty — so persistence buys nothing and is pure exposure. Applied to all six checkouts rather than only the one flagged: it is the same defect at each, and leaving five would just be five findings waiting to be filed. Job permissions were already minimal at the top level (actions: read, contents: read) and are left as they are. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QNjWX2B4FffG7zqMBMui6v
Contributor
|
Warning Review limit reachedNext included review available in 24 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
enabled auto-merge (squash)
September 9, 2026 09:14
hyperpolymath
disabled auto-merge
September 9, 2026 09:14
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #53.
What this fixes
.github/workflows/anchor-drift.ymlhas sixactions/checkoutsteps and, onmain, zeropersist-credentialssettings — so all six fall back to theaction's default of
true, leaving the job token in.git/configfor everysubsequent step (CWE-522).
No job in this workflow pushes or otherwise uses the token, and it runs on
pull_requestexecuting repository-controlled code, so the persisted credentialis exposure with no upside.
Why it wasn't fixed in #52
This exact commit (
6a5d1a7) was written as part of PR #52 but rejected at pushtime, because the acting token then lacked the
workflowOAuth scope:That rejection fails the whole push if any single commit touches a workflow
path, so the validator commit landed while this one did not — which is why #52
looked complete and was merged around the gap. The scope has since been granted,
so it is cherry-picked here onto current
main.Verification
Checked semantically by parsing the YAML rather than grepping, so a comment or a
near-miss key cannot pass:
Before, on
main: 6 checkout steps, 0persist-credentialslines.🤖 Generated with Claude Code
https://claude.ai/code/session_01QNjWX2B4FffG7zqMBMui6v