feat: add commit-check reusable workflow and org-level config#18
feat: add commit-check reusable workflow and org-level config#18shenxianpeng wants to merge 1 commit into
Conversation
|
Warning Review limit reached
More reviews will be available in 55 minutes and 54 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. 📝 WalkthroughWalkthroughAdds two GitHub Actions workflows and a ChangesCommit Check CI Setup
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Commit-Check ❌ |
This cchk.toml serves as the shared base configuration that other repositories can inherit via their own cchk.toml: inherit_from = "github:commit-check/.github:cchk.toml" Local settings in each repo's config override the inherited values.
shenxianpeng
force-pushed
the
feature/add-commit-check-workflow
branch
from
776496a to
fa1d5b5
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/commit-check.yml:
- Line 61: The commit-check/commit-check-action reference on line 61 uses a
mutable version tag `@v2` which poses a supply-chain security risk. Replace the
`@v2` tag with a specific commit SHA to pin the action to a known, immutable
version. This ensures the workflow always uses the exact same version of the
action and prevents unexpected changes from floating tags.
- Around line 58-60: The actions/checkout action in the commit-check workflow on
lines 58-60 uses default credential persistence, which exposes the GitHub token
to potential unauthorized access by third-party actions. Add
`persist-credentials: false` to the `with:` section of the checkout action
(alongside the existing `fetch-depth: 0` parameter) to disable credential
persistence and limit token exposure when third-party actions are invoked.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 1b953619-2b90-4f1c-9444-5ced331180ab
📒 Files selected for processing (3)
.github/workflows/commit-check-self.yml.github/workflows/commit-check.ymlcchk.toml
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
| with: | ||
| fetch-depth: 0 # Required for merge-base checks |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Inspecting checkout steps and nearby options..."
rg -nP '^\s*-\s*uses:\s*actions/checkout@' .github/workflows -A6 -B1
echo
echo "Expected: each checkout used in security-sensitive flows includes 'persist-credentials: false'."Repository: commit-check/.github
Length of output: 1416
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Checking commit-check.yml full context ==="
cat -n .github/workflows/commit-check.yml | head -70
echo
echo "=== Checking pre-commit.yml context ==="
cat -n .github/workflows/pre-commit.yml
echo
echo "=== All workflow files ==="
find .github/workflows -name "*.yml" -type fRepository: commit-check/.github
Length of output: 4280
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== All workflow files and their checkout actions ==="
for f in .github/workflows/*.yml; do
echo "--- $f ---"
rg -nP 'uses:\s*actions/checkout|persist-credentials' "$f" -A2 -B1 || echo " (no checkout or persist-credentials found)"
doneRepository: commit-check/.github
Length of output: 944
Disable credential persistence in checkout.
The checkout action on lines 58–60 uses default credential persistence. Since this reusable workflow invokes third-party actions (commit-check/commit-check-action@v2), add persist-credentials: false to limit token exposure.
🔧 Suggested change
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0 # Required for merge-base checks
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| fetch-depth: 0 # Required for merge-base checks | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| fetch-depth: 0 # Required for merge-base checks | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 58-60: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/commit-check.yml around lines 58 - 60, The
actions/checkout action in the commit-check workflow on lines 58-60 uses default
credential persistence, which exposes the GitHub token to potential unauthorized
access by third-party actions. Add `persist-credentials: false` to the `with:`
section of the checkout action (alongside the existing `fetch-depth: 0`
parameter) to disable credential persistence and limit token exposure when
third-party actions are invoked.
Source: Linters/SAST tools
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
| with: | ||
| fetch-depth: 0 # Required for merge-base checks | ||
| - uses: commit-check/commit-check-action@v2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Checking for unpinned action references in workflow files..."
rg -nP '^\s*-\s*uses:\s*[^@\s]+@(?![0-9a-f]{40}\b)' .github/workflows
echo
echo "Expected: no matches after pinning to full SHA."Repository: commit-check/.github
Length of output: 262
Pin commit-check/commit-check-action to a full commit SHA.
Line 61 uses a mutable tag (@v2), which is a supply-chain risk for a reusable org-wide workflow. This action should be pinned to a specific commit SHA rather than relying on a floating version tag.
🔧 Suggested change
- - uses: commit-check/commit-check-action@v2
+ - uses: commit-check/commit-check-action@<FULL_40_CHAR_SHA>🧰 Tools
🪛 zizmor (1.26.1)
[error] 61-61: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/commit-check.yml at line 61, The
commit-check/commit-check-action reference on line 61 uses a mutable version tag
`@v2` which poses a supply-chain security risk. Replace the `@v2` tag with a
specific commit SHA to pin the action to a known, immutable version. This
ensures the workflow always uses the exact same version of the action and
prevents unexpected changes from floating tags.
Source: Linters/SAST tools
1 participant
The cchk.toml serves as the shared base config that other repos can inherit via:
inherit_from = "github:commit-check/.github:cchk.toml"
Other repos can reuse the workflow by calling:
commit-check/.github/.github/workflows/commit-check.yml@main
Summary by CodeRabbit
Release Notes