ci: harden GitHub Actions with pinned SHAs and tarball verification - #79
Merged
0xdevcollins merged 6 commits intoJul 20, 2026
Merged
Conversation
📝 WalkthroughWalkthroughCI setup and workflows now use pinned GitHub Action revisions, restricted permissions, and disabled checkout credential persistence. Stellar CLI installation is versioned, checksum-verified, extracted with restrictive flags, and validated after installation. ChangesCI hardening
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/rustfmt.yml (1)
24-25: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPrevent credential persistence in checkout.
actions/checkoutpersists the GitHub token in the local git config by default. To follow security best practices and address static analysis warnings, explicitly disable this behavior when credentials are not needed for subsequent steps.
.github/workflows/rustfmt.yml#L24-L25: Addwith:andpersist-credentials: falseto the checkout step..github/workflows/verify-build.yml#L34-L35: Addwith:andpersist-credentials: falseto the checkout step.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/rustfmt.yml around lines 24 - 25, Disable checkout credential persistence by adding the appropriate with configuration to the actions/checkout step in .github/workflows/rustfmt.yml lines 24-25 and .github/workflows/verify-build.yml lines 34-35, setting persist-credentials to false in both locations.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/verify-build.yml:
- Around line 34-35: Replace the checkout action commit with the v4.1.1 commit
b4ffde65f46336ab88eb53be808477a3936bae11 everywhere it is referenced:
.github/workflows/verify-build.yml lines 34-35, .github/workflows/rustfmt.yml
lines 24-25, CI_HARDENING_SUMMARY.md lines 9-14, and CI_VALIDATION_REPORT.md
lines 5-6.
---
Nitpick comments:
In @.github/workflows/rustfmt.yml:
- Around line 24-25: Disable checkout credential persistence by adding the
appropriate with configuration to the actions/checkout step in
.github/workflows/rustfmt.yml lines 24-25 and .github/workflows/verify-build.yml
lines 34-35, setting persist-credentials to false in both locations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 854179f5-2ceb-4a5f-9949-e29434cb6ed3
📒 Files selected for processing (5)
.github/actions/setup-rust-stellar/action.yml.github/workflows/rustfmt.yml.github/workflows/verify-build.ymlCI_HARDENING_SUMMARY.mdCI_VALIDATION_REPORT.md
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ACTION_RESOLUTION.md`:
- Around line 43-49: Update the dtolnay/rust-toolchain entry in the “Valid SHAs
Used” table to remove the “(1.97.1)” suffix while retaining “stable,” unless the
workflow is explicitly changed to use a fixed Rust toolchain version. Ensure the
documentation accurately reflects the rolling toolchain configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: fb8b883c-81c2-49e8-a2ba-3e42c9beb3f6
📒 Files selected for processing (6)
.github/actions/setup-rust-stellar/action.yml.github/workflows/rustfmt.yml.github/workflows/verify-build.ymlACTION_RESOLUTION.mdCI_HARDENING_SUMMARY.mdCI_VALIDATION_REPORT.md
🚧 Files skipped from review as they are similar to previous changes (5)
- CI_VALIDATION_REPORT.md
- .github/workflows/verify-build.yml
- .github/actions/setup-rust-stellar/action.yml
- .github/workflows/rustfmt.yml
- CI_HARDENING_SUMMARY.md
…t files
- Swatinem/rust-cache: 7e35be21 was an untagged master commit mislabeled
as v2.9.1; repin to the real v2.9.1 tag commit (c1937114, verified via
git ls-remote refs/tags/v2.9.1^{}).
- Add the version-tag trailing comments on every pinned uses: line, as
requested in boundlessfi#75.
- Strip trailing whitespace in the workflow files.
- Remove the generated ACTION_RESOLUTION.md, CI_HARDENING_SUMMARY.md and
CI_VALIDATION_REPORT.md; their content lives in the PR description.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/rustfmt.yml:
- Line 30: Update the rustfmt workflow step using the dtolnay/rust-toolchain
configuration so the formatting command explicitly invokes the stable toolchain,
such as through cargo +stable or RUSTUP_TOOLCHAIN=stable, while preserving the
existing check behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: fdb03351-0959-4998-a7a0-76cce8a35360
📒 Files selected for processing (3)
.github/actions/setup-rust-stellar/action.yml.github/workflows/rustfmt.yml.github/workflows/verify-build.yml
🚧 Files skipped from review as they are similar to previous changes (2)
- .github/actions/setup-rust-stellar/action.yml
- .github/workflows/verify-build.yml
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR hardens the GitHub Actions CI pipeline by pinning all third-party actions to immutable commit SHAs, removing unnecessary OIDC token permissions, and adding SHA-256 verification for the Stellar CLI download. These changes eliminate supply-chain attack vectors and reduce the blast radius of compromised dependencies.
Closes: #75
Changes
.github/workflows/rustfmt.ymlPurpose: Format validation workflow for Rust code
Changes:
id-token: writefrom permissions (now onlycontents: readandactions: read)actions/checkout@v2→actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c(v4.1.1)actions-rs/toolchain@v1→dtolnay/rust-toolchain@1482605baf623a1ba7bb69329c91659433264734(stable)Impact: Eliminates reliance on archived action, reduces permissions to minimum required, uses immutable action versions.
.github/workflows/verify-build.ymlPurpose: Build verification and testing workflow for contracts
Changes:
id-token: writefrom permissions (now onlycontents: readandactions: read)actions/checkout@v4→actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c(v4.1.1)Impact: Reduces OIDC token exposure, uses immutable action version. No changes to build/test logic.
.github/actions/setup-rust-stellar/action.ymlPurpose: Composite action that sets up Rust toolchain and Stellar CLI
Changes:
Swatinem/rust-cache@v2→Swatinem/rust-cache@23bce251a8cd2ffc3c1075eac063c4173a8a8848(v2.7.3)dtolnay/rust-toolchain@master→dtolnay/rust-toolchain@1482605baf623a1ba7bb69329c91659433264734(stable)stellar-cli-23.1.3-x86_64-unknown-linux-gnu.tar.gz2eb70d75d8f7da3ca9c1f6a69e5055f686cfc8f3ef8e7e06dd10a45e33d3476e/tmpfirst with--no-same-owner --no-same-permissionsflags/usr/local/bin/via sudoImpact: Eliminates tarball tampering risk, prevents file permission exploits, uses immutable action versions.
Security Benefits
Testing
Summary by CodeRabbit
Chores
Security