Repository navigation
Conversation
📝 WalkthroughWalkthroughThis PR adds four new GitHub Actions workflows: Claude Code Review (PR-triggered automated review), Claude Code (comment-triggered interactive assistant), CodeQL (scheduled/PR security analysis), and Semgrep (static analysis with SARIF upload). A minor punctuation fix is also made to docs/Usage.md. ChangesCI/CD Workflow Additions
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #682 +/- ##
=========================================
Coverage 54.46% 54.46%
Complexity 663 663
=========================================
Files 91 91
Lines 3604 3604
Branches 399 399
=========================================
Hits 1963 1963
Misses 1463 1463
Partials 178 178 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (4)
.github/workflows/semgrep.yml (1)
46-46: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
upload-sarif@v3vsv4used incodeql.yml.This PR pins
github/codeql-action/upload-sariftov3here whilecodeql.ymlin the same PR usesinit@v4/analyze@v4. Consider aligning the major version across workflows to avoid divergent behavior/deprecation timelines for the sharedcodeql-actionfamily.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/semgrep.yml at line 46, The semgrep workflow is pinning github/codeql-action/upload-sarif to a different major version than the other CodeQL workflow steps, so align the shared codeql-action version across workflows. Update the upload-sarif step to match the v4 family used by codeql.yml, and verify the surrounding CodeQL job configuration still references the same action major version consistently..github/workflows/claude-code-review.yml (2)
29-32: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winSet
persist-credentials: falseon checkout.
actions/checkout@v4The auth token is persisted in the local git config. This enables your scripts to run authenticated git commands. The token is removed during post-job cleanup. Set persist-credentials: false to opt-out. Since this workflow only reads the repo for review (no push needed), any subsequent step or compromised third-party action could otherwise reuse the persisted token.🔒 Proposed fix
- name: Checkout repository uses: actions/checkout@v4 with: fetch-depth: 1 + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/claude-code-review.yml around lines 29 - 32, The Checkout repository step in the workflow should opt out of persisting the auth token. Update the actions/checkout@v4 configuration in the checkout step to set persist-credentials to false, since this review workflow only needs read access. Keep the change scoped to the existing checkout action block so the repository can still be cloned without leaving reusable credentials in git config.Source: Linters/SAST tools
30-30: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider updating
actions/checkoutbeyond v4.
actions/checkouthas since released major versions beyond v4, and GitHub Actions runners are moving JS actions to newer Node runtimes, which can surface deprecation warnings on older action majors. Worth confirming the intended pinned version for this repo's workflows.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/claude-code-review.yml at line 30, The workflow is pinned to an older major of actions/checkout, so update the checkout step in the GitHub Actions workflow to the intended newer supported major and confirm the repo’s pinning policy. Use the actions/checkout usage in the claude-code-review workflow as the locator, and keep the version aligned with current GitHub Actions runner/runtime recommendations..github/workflows/claude.yml (1)
28-31: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winSet
persist-credentials: falseon checkout.Same as flagged in
claude-code-review.yml: The auth token is persisted in the local git config. This enables your scripts to run authenticated git commands. The token is removed during post-job cleanup. Set persist-credentials: false to opt-out. This is more important here given the trigger surface is broader/untrusted (see comment on Line 15).🔒 Proposed fix
- name: Checkout repository uses: actions/checkout@v4 with: fetch-depth: 1 + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/claude.yml around lines 28 - 31, Update the Checkout repository step in the claude workflow to opt out of persisting the GitHub token in local git config. In the actions/checkout usage, add persist-credentials set to false so scripts in this broader trigger surface cannot run authenticated git commands; keep the change scoped to the checkout step identified by actions/checkout@v4.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/claude.yml:
- Around line 15-19: Gate the existing `@claude` trigger in the claude workflow so
only trusted users can invoke it; the current job condition in the workflow
`if:` block matches comment/body mentions from anyone and can reach steps using
`secrets.CLAUDE_CODE_OAUTH_TOKEN`. Update the condition to combine the mention
checks with an `author_association` allowlist (OWNER, MEMBER, COLLABORATOR) for
the relevant events, and keep the logic localized to the same workflow trigger
expression so untrusted commenters cannot start the job.
In @.github/workflows/codeql.yml:
- Around line 59-60: The checkout step in the CodeQL workflow should not persist
the GITHUB_TOKEN in local git config. Update the existing actions/checkout@v4
step in the workflow to set persist-credentials to false so later steps cannot
access the token unnecessarily. Keep the change scoped to the checkout
configuration in the workflow file.
In @.github/workflows/semgrep.yml:
- Around line 35-36: The checkout step in the Semgrep workflow is persisting the
GitHub token unnecessarily for a scan-only job. Update the `actions/checkout@v4`
step in the workflow to set `persist-credentials: false`, matching the safer
pattern used elsewhere such as in `codeql.yml`, so the credentials are not left
in the local git config.
- Around line 38-42: The workflow still uses the deprecated
returntocorp/semgrep-action, so update the semgrep job to use the native
semgrep/semgrep CI flow instead. Replace the action step in the semgrep workflow
with a semgrep ci invocation, and preserve the existing Semgrep configuration
inputs such as token/deployment handling and SARIF generation if needed. Use the
semgrep job/step in the workflow as the place to make the change.
---
Nitpick comments:
In @.github/workflows/claude-code-review.yml:
- Around line 29-32: The Checkout repository step in the workflow should opt out
of persisting the auth token. Update the actions/checkout@v4 configuration in
the checkout step to set persist-credentials to false, since this review
workflow only needs read access. Keep the change scoped to the existing checkout
action block so the repository can still be cloned without leaving reusable
credentials in git config.
- Line 30: The workflow is pinned to an older major of actions/checkout, so
update the checkout step in the GitHub Actions workflow to the intended newer
supported major and confirm the repo’s pinning policy. Use the actions/checkout
usage in the claude-code-review workflow as the locator, and keep the version
aligned with current GitHub Actions runner/runtime recommendations.
In @.github/workflows/claude.yml:
- Around line 28-31: Update the Checkout repository step in the claude workflow
to opt out of persisting the GitHub token in local git config. In the
actions/checkout usage, add persist-credentials set to false so scripts in this
broader trigger surface cannot run authenticated git commands; keep the change
scoped to the checkout step identified by actions/checkout@v4.
In @.github/workflows/semgrep.yml:
- Line 46: The semgrep workflow is pinning github/codeql-action/upload-sarif to
a different major version than the other CodeQL workflow steps, so align the
shared codeql-action version across workflows. Update the upload-sarif step to
match the v4 family used by codeql.yml, and verify the surrounding CodeQL job
configuration still references the same action major version consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2c50d23f-3d7d-4cd6-94c3-2d1a0ca675c8
📒 Files selected for processing (5)
.github/workflows/claude-code-review.yml.github/workflows/claude.yml.github/workflows/codeql.yml.github/workflows/semgrep.ymldocs/Usage.md
| if: | | ||
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | ||
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## claude workflow"
if [ -f .github/workflows/claude.yml ]; then
cat -n .github/workflows/claude.yml | sed -n '1,260p'
else
echo "missing .github/workflows/claude.yml"
fi
echo
echo "## search for related references"
rg -n --hidden -S "author_association|`@claude`|pull_request_review_comment|pull_request_review|issue_comment|issues:|permissions:|secrets?\.|id-token:write|contents:read|issues:read|pull-requests:read|actions:read" .github/workflows . || trueRepository: SasanLabs/VulnerableApp
Length of output: 8852
Gate @claude behind trusted associations in .github/workflows/claude.yml:15-19.
Right now any user can mention @claude in an issue/PR comment or issue body and trigger a job that reads ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}. Add an author_association check (OWNER/MEMBER/COLLABORATOR) alongside the mention match so untrusted commenters can’t invoke Claude on repo-owned secrets.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude.yml around lines 15 - 19, Gate the existing `@claude`
trigger in the claude workflow so only trusted users can invoke it; the current
job condition in the workflow `if:` block matches comment/body mentions from
anyone and can reach steps using `secrets.CLAUDE_CODE_OAUTH_TOKEN`. Update the
condition to combine the mention checks with an `author_association` allowlist
(OWNER, MEMBER, COLLABORATOR) for the relevant events, and keep the logic
localized to the same workflow trigger expression so untrusted commenters cannot
start the job.
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Set persist-credentials: false on checkout.
Checkout persists the GITHUB_TOKEN in the local git config by default, exposing it to all subsequent steps in the job unnecessarily since this workflow only reads code.
🔒 Proposed fix
- name: Checkout repository
uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 59-68: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml around lines 59 - 60, The checkout step in the
CodeQL workflow should not persist the GITHUB_TOKEN in local git config. Update
the existing actions/checkout@v4 step in the workflow to set persist-credentials
to false so later steps cannot access the token unnecessarily. Keep the change
scoped to the checkout configuration in the workflow file.
Source: Linters/SAST tools
| - uses: actions/checkout@v4 | ||
|
|
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Set persist-credentials: false on checkout.
Same concern as in codeql.yml: the token is persisted unnecessarily for a scan-only job.
🔒 Proposed fix
- uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v4 | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 35-37: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/semgrep.yml around lines 35 - 36, The checkout step in the
Semgrep workflow is persisting the GitHub token unnecessarily for a scan-only
job. Update the `actions/checkout@v4` step in the workflow to set
`persist-credentials: false`, matching the safer pattern used elsewhere such as
in `codeql.yml`, so the credentials are not left in the local git config.
Source: Linters/SAST tools
| - uses: returntocorp/semgrep-action@fcd5ab7459e8d91cb1777481980d1b18b4fc6735 | ||
| with: | ||
| publishToken: ${{ secrets.SEMGREP_APP_TOKEN }} | ||
| publishDeployment: ${{ secrets.SEMGREP_DEPLOYMENT_ID }} | ||
| generateSarif: "1" |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the workflow around the referenced lines.
sed -n '1,120p' .github/workflows/semgrep.yml
# Look for any Semgrep-related migration hints in the repo.
rg -n "semgrep|returntocorp/semgrep-action|semgrep/semgrep" .github README* .Repository: SasanLabs/VulnerableApp
Length of output: 2290
🌐 Web query:
returntocorp/semgrep-action deprecated semgrep/semgrep official GitHub Actions configuration docs
💡 Result:
The GitHub Action repository returntocorp/semgrep-action is officially deprecated [1][2][3]. Users are advised to stop using this wrapper script and instead migrate to native Semgrep support in their GitHub Actions pipelines [1][4]. To implement Semgrep natively, you should configure your GitHub Actions workflow to run the semgrep/semgrep Docker image directly [5][6]. This eliminates the need for a third-party wrapper action [1]. Official configuration guidelines and sample YAML files for native integration can be found in the Semgrep documentation at: https://docs.semgrep.dev/semgrep-ci/sample-ci-configs [5]. A standard implementation typically involves adding a job to your.github/workflows/semgrep.yml file that uses the semgrep/semgrep container image and executes the semgrep ci command [5]: jobs: semgrep: name: semgrep/ci runs-on: ubuntu-latest container: image: semgrep/semgrep steps: - uses: actions/checkout@v4 - run: semgrep ci env: SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
Citations:
- 1: https://github.com/returntocorp/semgrep-action/
- 2: https://github.com/semgrep/semgrep-action
- 3: https://github.com/marketplace/actions/semgrep-action
- 4: https://github.com/semgrep/semgrep-action/blob/develop/README.md
- 5: https://docs.semgrep.dev/semgrep-ci/sample-ci-configs
- 6: https://docs.semgrep.dev/kb/semgrep-ci/using-nonroot-docker-image-with-gha
Replace the deprecated Semgrep action
returntocorp/semgrep-action is deprecated; switch this workflow to the native semgrep/semgrep CI flow (semgrep ci) instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/semgrep.yml around lines 38 - 42, The workflow still uses
the deprecated returntocorp/semgrep-action, so update the semgrep job to use the
native semgrep/semgrep CI flow instead. Replace the action step in the semgrep
workflow with a semgrep ci invocation, and preserve the existing Semgrep
configuration inputs such as token/deployment handling and SARIF generation if
needed. Use the semgrep job/step in the workflow as the place to make the
change.
Summary by CodeRabbit