chore: workflow update, re-enable yarn hardened mode #1835
Conversation
WalkthroughThis pull request updates two GitHub Actions workflow files: Changes
Possibly related PRs
Suggested labels
Poem
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
jaybuidl
added
Type: Maintenance 🚧
Type: Toolchain ⚒️
✅ Deploy Preview for kleros-v2-university ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
✅ Deploy Preview for kleros-v2-neo ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
✅ Deploy Preview for kleros-v2-testnet ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
|
Code Climate has analyzed commit e65377f and detected 0 issues on this pull request. View more on Code Climate. |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
.github/workflows/sentry-release.yml (2)
71-71: Optimize the version setting command.The
catcommand can be simplified.-echo "version=v$(cat package.json | jq -r .version)-$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT" +echo "version=v$(jq -r .version package.json)-$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"🧰 Tools
🪛 actionlint (1.7.4)
71-71: shellcheck reported issue in this script: SC2002:style:1:22: Useless cat. Consider 'cmd < file | ..' or 'cmd file | ..' instead
(shellcheck)
45-45: Fix YAML formatting.Remove trailing spaces from these lines to maintain consistent formatting.
Also applies to: 49-49, 51-51, 57-57
🧰 Tools
🪛 yamllint (1.35.1)
[error] 45-45: trailing spaces
(trailing-spaces)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/contracts-testing.yml(2 hunks).github/workflows/sentry-release.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/sentry-release.yml
71-71: shellcheck reported issue in this script: SC2002:style:1:22: Useless cat. Consider 'cmd < file | ..' or 'cmd file | ..' instead
(shellcheck)
🪛 yamllint (1.35.1)
.github/workflows/sentry-release.yml
[error] 45-45: trailing spaces
(trailing-spaces)
[error] 49-49: trailing spaces
(trailing-spaces)
[error] 51-51: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (15)
- GitHub Check: Redirect rules - kleros-v2-testnet
- GitHub Check: Redirect rules - kleros-v2-testnet
- GitHub Check: Header rules - kleros-v2-testnet
- GitHub Check: Header rules - kleros-v2-testnet
- GitHub Check: Pages changed - kleros-v2-testnet
- GitHub Check: Pages changed - kleros-v2-testnet
- GitHub Check: Redirect rules - kleros-v2-neo
- GitHub Check: Header rules - kleros-v2-neo
- GitHub Check: Pages changed - kleros-v2-neo
- GitHub Check: Redirect rules - kleros-v2-university
- GitHub Check: Header rules - kleros-v2-university
- GitHub Check: Pages changed - kleros-v2-university
- GitHub Check: contracts-testing
- GitHub Check: Analyze (javascript)
- GitHub Check: dependency-review
🔇 Additional comments (6)
.github/workflows/contracts-testing.yml (3)
Line range hint
13-14: LGTM! Good security practice.Adding explicit
contents: readpermission follows the principle of least privilege, which is a security best practice for GitHub Actions.🧰 Tools
🪛 yamllint (1.35.1)
[warning] 26-26: wrong indentation: expected 6 but found 4
(indentation)
27-27: LGTM! Enhanced security with pinned commit.Pinning to a specific commit hash instead of a version tag is a security best practice that prevents potential supply chain attacks.
71-71: LGTM! Re-enabled yarn hardened mode.Removing
YARN_ENABLE_HARDENED_MODE=0effectively re-enables yarn's hardened mode, which is more secure and aligns with the PR objective..github/workflows/sentry-release.yml (3)
Line range hint
8-9: LGTM! Consistent security improvements.Security changes are consistent with contracts-testing.yml and include:
- Added explicit permissions following least privilege
- Pinned harden-runner to specific commit
- Updated allowed-endpoints list with legitimate yarn and GitHub endpoints
Also applies to: 20-34
🧰 Tools
🪛 actionlint (1.7.4)
71-71: shellcheck reported issue in this script: SC2002:style:1:22: Useless cat. Consider 'cmd < file | ..' or 'cmd file | ..' instead
(shellcheck)
🪛 yamllint (1.35.1)
[warning] 19-19: wrong indentation: expected 6 but found 4
(indentation)
[error] 45-45: trailing spaces
(trailing-spaces)
[error] 49-49: trailing spaces
(trailing-spaces)
[error] 51-51: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
40-50: LGTM! Improved build reproducibility.Good improvements in the setup:
- Pinned yarn to specific version (4.5.1)
- Added Node.js 20.x with proper yarn caching
🧰 Tools
🪛 yamllint (1.35.1)
[error] 45-45: trailing spaces
(trailing-spaces)
[error] 49-49: trailing spaces
(trailing-spaces)
53-62: LGTM! Proper cache configuration.Cache configuration is well structured with:
- Correct paths for npm and node_modules
- Proper cache key format including version and lockfiles
🧰 Tools
🪛 yamllint (1.35.1)
[error] 57-57: trailing spaces
(trailing-spaces)
❌ Deploy Preview for kleros-v2-testnet-devtools failed. Why did it fail? →
|
PR-Codex overview
This PR focuses on updating the GitHub Actions workflows for improved dependency management and security enhancements. Key modifications include version upgrades for tools and changes in dependency installation processes.
Detailed summary
step-security/harden-runnerversion in.github/workflows/contracts-testing.ymland.github/workflows/sentry-release.yml.corepacksetup for Yarn in.github/workflows/sentry-release.yml.actions/checkoutandactions/setup-nodeversions..github/workflows/sentry-release.yml..github/workflows/sentry-release.yml..github/workflows/sentry-release.yml.Summary by CodeRabbit