Repository navigation
fix(ci): drop the secrets reference from the context-contract job - #53
Conversation
The CI context contract job referenced the secrets context, which trips the
Hypatia scanner's RE001 research extension ("job references secrets.* but does
not install step-security/harden-runner") and surfaced as a new code-scanning
alert on this pull request.
step-security/harden-runner is not in the estate actions allowlist, so adding it
is not an option: it would fail the allowlist preflight and the repository's
selected-actions policy. Use github.token instead. The job needs read access
only, it can read branch rulesets with that token, and the script states plainly
what it could not read (legacy branch protection needs a credential with
Administration: read, which the Actions token cannot have) rather than guessing.
Also move the new workflow to actions/checkout@v7.0.1, the pin the rest of the
estate uses, and record it in actions.lock with the official extension.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details🔇 Additional comments (1)
📝 SummarySummary by CodeRabbit
WalkthroughThe CI workflow now documents its context contract, names the contract job, upgrades checkout, disables persisted credentials, and uses ChangesCI context contract
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Bug fix Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit reads each line, Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Follow-up to #52, which auto-merged on green before this correction could land in the same PR.
Why
The context-contract job added in #52 referenced the secrets context:
That trips Hypatia's
research_extensions: RE001rule ("job referencessecrets.*but does not install step-security/harden-runner — review outbound-egress monitoring"), which surfaced as a new code-scanning alert on the pull request (check runHypatia, appgithub-advanced-security).step-security/harden-runneris not in the estate actions allowlist (rhodium-standard-repositories/actions-allowlist/allowed-actions.json, 89 patterns, nostep-security/*), so adding it is not an option — it would failcheck-allowed-actions.shand the repository's selected-actions policy, which is the startup-failure class the preflight exists to prevent.What changed
GH_TOKEN: ${{ github.token }}— the same installation token, with no secret context referenced, so RE001 is clear. The job needs read access only.Administration: read, which the Actions token cannot have, so the guard reports "branch protection … unreadable … rulesets only" as a notice instead of guessing. It still checks every required context in the repository's rulesets; locally,GH_TOKEN=… bash tools/check-ci-contexts.sh .covers branch protection too.actions/checkout@v4.4.0→@v7.0.1, the pin the rest of the estate uses, which also clears the Node 20 deprecation warning this job was carrying.actions.lockregenerated with the official extension in the same commit.Verification
check-actions-lock-gate.sh— "Immutable direct and transitive lockfile coverage verified."check-allowed-actions.sh— 6uses:refs, 0 uncovered by the allowlist.tools/check-ci-contexts.sh .— exit 0; still exit 1 when the caller job is renamed back.