chore: update actions/checkout action to v6.1.0 - #503
Conversation
📝 WalkthroughWalkthroughLint ワークフローの ChangesLint ワークフロー更新
Estimated code review effort: 1 (Trivial) | ~2 minutes Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/lint.yml:
- Line 10: Update the actions/checkout step to set persist-credentials to false,
ensuring the checkout action does not retain GITHUB_TOKEN credentials for
subsequent workflow steps.
- Line 10: Update the actions/checkout step in the workflow to explicitly set
persist-credentials to false, while keeping the existing pinned checkout action
unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: c3917bae-40ae-43f7-8e1c-8e026432f64a
📒 Files selected for processing (1)
.github/workflows/lint.yml
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
workflow=".github/workflows/lint.yml"
rg -n -C 5 'pull_request_target|workflow_run|pull_request|ref:|allow-unsafe-pr-checkout|actions/checkout@' "$workflow"Repository: kufu/hello-world
Length of output: 592
🏁 Script executed:
#!/bin/bash
set -euo pipefail
workflow=".github/workflows/lint.yml"
printf '%s\n' '--- workflow ---'
cat -n "$workflow"
printf '%s\n' '--- checkout pin and permissions ---'
rg -n -C 3 'actions/checkout@|permissions:|persist-credentials|allow-unsafe-pr-checkout|run:|pull_request_target|workflow_run|pull_request' "$workflow"
printf '%s\n' '--- repository status ---'
git status --shortRepository: kufu/hello-world
Length of output: 1645
🌐 Web query:
site:github.com/actions/checkout/releases v6.1.0 allow-unsafe-pr-checkout
💡 Result:
The v6.1.0 release of the actions/checkout GitHub Action includes a breaking change involving the introduction of the allow-unsafe-pr-checkout parameter [1]. This change was implemented to enforce safer defaults for the pull_request_target event [1][2]. When using the pull_request_target event, the action now requires explicit configuration if you intend to perform checkouts that may be considered unsafe under the new security posture [1][2]. This change was backported across multiple major versions of the action, including v2, v3, v4, v5, and v6, to improve security across the board [1][3][4][5][6]. For detailed information regarding the security context and the specific implications of this breaking change, official GitHub documentation advises referring to the changelog entry titled Safer pull_request_target defaults for GitHub Actions checkout [1][2].
Citations:
- 1: https://github.com/actions/checkout/releases/tag/v6.1.0
- 2: https://github.com/actions/checkout/releases
- 3: https://github.com/actions/checkout/releases/tag/v5.1.0
- 4: https://github.com/actions/checkout/releases/tag/v4.4.0
- 5: https://github.com/actions/checkout/releases/tag/v3.7.0
- 6: https://github.com/actions/checkout/releases/tag/v2.8.0
🏁 Script executed:
#!/bin/bash
set -euo pipefail
repo="actions/checkout"
tag="v6.1.0"
pin="d23441a48e516b6c34aea4fa41551a30e30af803"
python3 - <<'PY'
import json, urllib.request
repo = "actions/checkout"
tag = "v6.1.0"
pin = "d23441a48e516b6c34aea4fa41551a30e30af803"
def get(url):
req = urllib.request.Request(url, headers={"Accept": "application/vnd.github+json", "User-Agent": "review-verifier"})
with urllib.request.urlopen(req) as r:
return json.load(r)
ref = get(f"https://api.github.com/repos/{repo}/git/ref/tags/{tag}")
obj = ref["object"]
print("tag_ref_object_type:", obj["type"])
print("tag_ref_object_sha:", obj["sha"])
resolved = obj["sha"]
if obj["type"] == "tag":
tag_obj = get(f"https://api.github.com/repos/{repo}/git/tags/{resolved}")
print("annotated_tag_target_type:", tag_obj["object"]["type"])
print("annotated_tag_target_sha:", tag_obj["object"]["sha"])
resolved = tag_obj["object"]["sha"]
commit = get(f"https://api.github.com/repos/{repo}/commits/{pin}")
print("pin_commit_sha:", commit["sha"])
print("pin_matches_dereferenced_tag:", commit["sha"] == resolved)
PYRepository: kufu/hello-world
Length of output: 2474
🏁 Script executed:
#!/bin/bash
set -euo pipefail
api() {
curl --fail --silent --show-error --location --insecure \
-H 'Accept: application/vnd.github+json' \
-H 'User-Agent: review-verifier' "$1"
}
repo="actions/checkout"
tag="v6.1.0"
pin="d23441a48e516b6c34aea4fa41551a30e30af803"
ref_json="$(api "https://api.github.com/repos/${repo}/git/ref/tags/${tag}")"
printf '%s\n' "$ref_json" | jq '{type: .object.type, sha: .object.sha}'
tag_type="$(printf '%s' "$ref_json" | jq -r '.object.type')"
tag_sha="$(printf '%s' "$ref_json" | jq -r '.object.sha')"
if [ "$tag_type" = tag ]; then
tag_json="$(api "https://api.github.com/repos/${repo}/git/tags/${tag_sha}")"
printf '%s\n' "$tag_json" | jq '{type: .object.type, sha: .object.sha}'
resolved_sha="$(printf '%s' "$tag_json" | jq -r '.object.sha')"
else
resolved_sha="$tag_sha"
fi
pin_json="$(api "https://api.github.com/repos/${repo}/commits/${pin}")"
printf '%s\n' "$pin_json" | jq --arg resolved "$resolved_sha" \
'{pin_sha: .sha, tag_commit: $resolved, matches: (.sha == $resolved)}'
printf '%s\n' '--- checkout action defaults ---'
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
curl --fail --silent --show-error --location --insecure \
"https://raw.githubusercontent.com/actions/checkout/${pin}/action.yml" > "$tmp"
rg -n -C 2 'persist-credentials|allow-unsafe-pr-checkout|description:' "$tmp"Repository: kufu/hello-world
Length of output: 256
🌐 Web query:
site:github.com/actions/checkout persist-credentials default true README
💡 Result:
The persist-credentials input is a configuration option for the GitHub Actions checkout action (actions/checkout) [1][2]. It determines whether the action should configure Git to use the provided GitHub token or SSH key for subsequent Git operations within the workflow [1][3]. Key details regarding persist-credentials: Default Value: The default value is true [2][4]. Functionality: When set to true, the action configures Git to use the authentication credentials (token or SSH key) used to check out the repository [1][3]. This allows subsequent steps in your workflow to run authenticated Git commands (such as git fetch or git push) without needing to manually configure authentication [1][3]. Security Update (v6.0.0+): As of version 6.0.0, the mechanism for persisting credentials was updated to improve security [5][3]. Instead of writing credentials directly into the local.git/config file, the action now stores them in a separate configuration file located in $RUNNER_TEMP and utilizes Git's includeIf mechanism to conditionally include these credentials when Git operations are performed within the repository's directory [5][6][7]. Opt-out: If you do not want the action to configure these credentials, you can explicitly set persist-credentials to false in your workflow file [1][3]. Cleanup: The action automatically performs cleanup, ensuring the credentials are removed or the includeIf configuration is invalidated during the post-job cleanup phase to prevent unauthorized access after the job finishes [1][4][8].
Citations:
- 1: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 2: https://github.com/actions/checkout/blob/main/action.yml
- 3: https://github.com/actions/checkout/blob/main/README.md
- 4: https://github.com/actions/checkout
- 5: Persist creds to a separate file actions/checkout#2286
- 6: https://github.com/actions/checkout/pull/2286/files
- 7:
persist-credentialsin separate file breaks GitHub authentication for Git worktrees actions/checkout#2318 - 8: https://github.com/actions/checkout/blob/master/adrs/0153-checkout-v2.md
persist-credentials: false を設定してください。
pull_request で PR コードを実行するため、checkout の既定値 true は後続処理に GITHUB_TOKEN を提供します。不要な認証情報の露出を防ぐため、checkout に persist-credentials: false を追加してください。
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 10-10: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/lint.yml at line 10, Update the actions/checkout step to
set persist-credentials to false, ensuring the checkout action does not retain
GITHUB_TOKEN credentials for subsequent workflow steps.
Source: MCP tools
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/lint.yml
printf '%s\n' '--- referenced action metadata ---'
curl -fsSL https://raw.githubusercontent.com/actions/checkout/v6.1.0/action.yml | sed -n '1,180p'
printf '%s\n' '--- checkout usage ---'
rg -n -C 3 'actions/checkout@|persist-credentials|git (push|pull|fetch|remote)' .github/workflows
printf '%s\n' '--- tag and commit resolution ---'
python3 - <<'PY'
import json, subprocess, urllib.request
repo = "actions/checkout"
tag = "v6.1.0"
pin = "d23441a48e516b6c34aea4fa41551a30e30af803"
def get(path):
req = urllib.request.Request("https://api.github.com/repos/" + repo + path,
headers={"Accept": "application/vnd.github+json",
"User-Agent": "review-verifier"})
with urllib.request.urlopen(req) as r:
return json.load(r)
ref = get("/git/refs/tags/" + tag)
obj = ref["object"]
resolved = obj["sha"]
print("tag_ref_type:", obj["type"])
print("tag_ref_sha:", resolved)
if obj["type"] == "tag":
tag_obj = get("/git/tags/" + obj["sha"])
print("dereferenced_type:", tag_obj["object"]["type"])
print("dereferenced_sha:", tag_obj["object"]["sha"])
resolved = tag_obj["object"]["sha"]
pin_commit = get("/commits/" + pin)["sha"]
print("pin_commit_sha:", pin_commit)
print("pin_matches_tag_commit:", pin_commit == resolved)
PYRepository: kufu/hello-world
Length of output: 9009
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- tag and commit resolution ---'
python3 - <<'PY'
import json, subprocess
repo = "actions/checkout"
tag = "v6.1.0"
pin = "d23441a48e516b6c34aea4fa41551a30e30af803"
def get(path):
out = subprocess.check_output([
"curl", "-fsSL", "-k",
"-H", "Accept: application/vnd.github+json",
"-H", "User-Agent: review-verifier",
"https://api.github.com/repos/" + repo + path,
])
return json.loads(out)
ref = get("/git/refs/tags/" + tag)
obj = ref["object"]
resolved = obj["sha"]
print("tag_ref_type:", obj["type"])
print("tag_ref_sha:", resolved)
if obj["type"] == "tag":
tag_obj = get("/git/tags/" + obj["sha"])
print("dereferenced_type:", tag_obj["object"]["type"])
print("dereferenced_sha:", tag_obj["object"]["sha"])
resolved = tag_obj["object"]["sha"]
pin_commit = get("/commits/" + pin)["sha"]
print("pin_commit_sha:", pin_commit)
print("pin_matches_tag_commit:", pin_commit == resolved)
PY
printf '%s\n' '--- package scripts and dependency lifecycle settings ---'
if [ -f package.json ]; then
cat package.json | sed -n '1,220p'
fi
if [ -f pnpm-workspace.yaml ]; then
cat pnpm-workspace.yaml
fiRepository: kufu/hello-world
Length of output: 900
🌐 Web query:
GitHub Actions pull_request GITHUB_TOKEN permissions fork pull requests read-only actions/checkout persist-credentials security
💡 Result:
In GitHub Actions, workflows triggered by pull requests from forked repositories are subject to specific security restrictions regarding the GITHUB_TOKEN to prevent unauthorized access and potential "pwn request" attacks [1][2]. GITHUB_TOKEN Permissions for Fork PRs When a workflow is triggered by a pull request from a fork (e.g., using the pull_request event), the GITHUB_TOKEN is automatically set to read-only, regardless of any higher permissions specified in the workflow file or repository settings [3][4][5]. This restriction applies to all pull request-related events (such as pull_request_review) with one critical exception: the pull_request_target event [1][4][6]. The pull_request_target event runs in the context of the base repository and maintains the repository's configured GITHUB_TOKEN permissions, which is why it is often used for automation tasks like labeling or status checks [1]. However, this elevated privilege makes pull_request_target workflows a common target for malicious code injection, requiring careful handling [1][2]. actions/checkout and persist-credentials The actions/checkout action, by default, persists the GITHUB_TOKEN in the local Git configuration to allow subsequent Git commands (like git fetch or git push) to be authenticated [2][7]. Because this token is restricted to read-only on fork PRs, any attempt to perform a write operation (e.g., git push) using this persisted token will fail with a 403 error [7]. Security Considerations To mitigate security risks, especially when dealing with untrusted code in fork pull requests: 1. Limit Token Exposure: Set persist-credentials: false in your actions/checkout step if your workflow does not require authenticated Git operations [2][8]. This prevents the GITHUB_TOKEN from being written to the runner's disk, reducing exposure [2][9]. 2. Safe Checkout: Recent versions of actions/checkout (v7+) introduce additional protections, refusing to check out fork pull request code by default under the pull_request_target or workflow_run triggers [2][8]. You must explicitly set allow-unsafe-pr-checkout: true to bypass this, which should only be done after reviewing the associated security risks [2]. 3. Principle of Least Privilege: Always use the permissions key in your workflow file to explicitly define the minimum required access for your GITHUB_TOKEN, rather than relying on default settings [10][3]. If your workflow requires write access for tasks like posting status checks or updating PRs, prefer using the pull_request_target event with strict controls, or consider using a GitHub App installation token for more granular and secure authentication [10][1].
Citations:
- 1: https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
- 2: https://github.com/actions/checkout
- 3: https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/
- 4: Clarify Permissions Calculation for Workflow Jobs in Documentation github/docs#33566
- 5: https://docs.github.com/en/enterprise-server@3.2/actions/reference/authentication-in-a-workflow
- 6: Clarify
How the permissions are calculated for a workflow jobgithub/docs#32398 - 7: https://latchkey.dev/learn/github-actions/github-actions-checkout-persisted-credentials-403
- 8: ci: restore fork PR checkout under pull_request_target for actions/checkout v7 liquibase/liquibase#7833
- 9: https://github.com/actions/checkout/tree/v6.0.0
- 10: https://docs.github.com/en/actions/tutorials/authenticate-with-github_token
🏁 Script executed:
#!/bin/bash
set +e
printf '%s\n' '--- tag resolution with Git ---'
git ls-remote https://github.com/actions/checkout.git \
'refs/tags/v6.1.0' 'refs/tags/v6.1.0^{}'
printf '%s\n' '--- pinned commit resolution ---'
git ls-remote https://github.com/actions/checkout.git \
'd23441a48e516b6c34aea4fa41551a30e30af803'
printf '%s\n' '--- package scripts and dependency lifecycle settings ---'
if [ -f package.json ]; then
cat package.json | sed -n '1,240p'
else
echo 'package.json not found'
fi
if [ -f pnpm-workspace.yaml ]; then
cat pnpm-workspace.yaml
fiRepository: kufu/hello-world
Length of output: 1949
persist-credentials: false を明示してください。
actions/checkout@v6.1.0 の既定値は true です。pull_request の GITHUB_TOKEN は読み取り専用ですが、後続の pnpm コマンドから認証済み Git 操作が可能になります。不要な認証情報の露出を防ぐため、設定を追加してください。
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 10-10: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/lint.yml at line 10, Update the actions/checkout step in
the workflow to explicitly set persist-credentials to false, while keeping the
existing pinned checkout action unchanged.
Sources: MCP tools, Linters/SAST tools
This PR contains the following updates:
v6.0.3→v6.1.0Release Notes
actions/checkout (actions/checkout)
v6.1.0Compare Source
Configuration
📅 Schedule: (in timezone Asia/Tokyo)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.