Repository navigation
fix(ci): drop EOL Python 3.8/3.9, align deps + pin actions #17
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,26 +9,26 @@ on: | |
| types: [ published ] | ||
|
|
||
| env: | ||
| PYTHON_VERSION: "3.11" | ||
|
|
||
| jobs: | ||
| test: | ||
| runs-on: ${{ matrix.os }} | ||
| strategy: | ||
| matrix: | ||
| os: [ubuntu-latest, windows-latest, macos-latest] | ||
| python-version: ["3.10", "3.11", "3.12"] | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Python ${{ matrix.python-version }} | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: ${{ matrix.python-version }} | ||
|
|
||
| - name: Cache pip packages | ||
| uses: actions/cache@v4 | ||
|
Comment on lines
+23
to
+31
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -euo pipefail
for spec in actions/checkout@v4 actions/setup-python@v5 actions/cache@v4; do
repo=${spec%@*}
ref=${spec#*@}
printf '%s: ' "$spec"
curl -fsSL "https://raw.githubusercontent.com/${repo}/${ref}/action.yml" |
grep -E '^[[:space:]]+using:'
doneRepository: dominicusin/package-maximizer Length of output: 284 🌐 Web query:
💡 Result: As of August 27, 2026, the migration of GitHub Actions runners from Node.js 20 to Node.js 24 is in its final stages [1]. The official timeline for this transition is as follows: June 16, 2026: Node.js 24 became the default runtime for JavaScript/TypeScript actions on GitHub Actions runners [1][2]. September 23, 2026: Node.js 20 is scheduled to be removed from GitHub Actions runners entirely [1]. Workflows that still rely on Node.js 20 can temporarily continue using it by setting the environment variable ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true [1]. This opt-out mechanism will remain functional until the final removal on September 23, 2026, after which any action still configured to use node20 will cease to function correctly [1]. Developers are encouraged to update their action configurations by changing the runs.using field in their action.yml files from node20 to node24 [3][4]. While Node.js 20 reached its end-of-life (EOL) in April 2026, it remained available on runner images for a period to facilitate the migration to Node.js 24 [1][5]. Note that standard runner images have also separately transitioned their default pre-installed Node.js versions (often to Node.js 22) [5], which is distinct from the Node.js runtime environment used specifically for executing GitHub Actions [1]. Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- workflow lines 1-80 ---'
sed -n '1,80p' .github/workflows/ci.yml
printf '%s\n' '--- action runtime metadata ---'
for spec in actions/checkout@v4 actions/checkout@v7 actions/setup-python@v5 actions/setup-python@v7 actions/cache@v4 actions/cache@v6; do
repo=${spec%@*}
ref=${spec#*@}
printf '%s: ' "$spec"
curl -fsSL "https://raw.githubusercontent.com/${repo}/${ref}/action.yml" |
grep -E '^[[:space:]]+using:' || true
doneRepository: dominicusin/package-maximizer Length of output: 2269 Use Node24-compatible workflow actions.
🧰 Tools🪛 zizmor (1.29.0)[warning] 23-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 15-65: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) [error] 31-31: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default (cache-poisoning) 🤖 Prompt for AI AgentsSource: MCP tools |
||
| with: | ||
| path: ~/.cache/pip | ||
| key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }} | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
rg -n -C 3 '^(on:|permissions:)|pull_request(_target)?:|actions/checkout@|persist-credentials' .github/workflows/ci.ymlRepository: dominicusin/package-maximizer
Length of output: 556
🏁 Script executed:
sed -n '1,120p' .github/workflows/ci.ymlRepository: dominicusin/package-maximizer
Length of output: 1975
🌐 Web query:
actions/checkout v4 persist-credentials default true GitHub Actions pull_request GITHUB_TOKEN permissions fork pull requests documentation💡 Result:
The
actions/checkoutaction (v4) has apersist-credentialsinput that defaults totrue[1][2]. When set totrue, the action configures the local Git environment with the provided token (typically theGITHUB_TOKEN), allowing subsequent steps to perform authenticated Git operations (likegit push) [1][3]. The token is removed during post-job cleanup [1]. RegardingGITHUB_TOKENpermissions for pull requests from forks: 1. Automatic Read-Only Restriction: GitHub security design automatically enforces read-only permissions for theGITHUB_TOKENon all workflows triggered by pull requests from forks (except for thepull_request_targetevent) [4][5][6]. This happens regardless of anypermissionsblock defined in your workflow [7]. 2. Impact onpersist-credentials: Even ifpersist-credentialsis set totrueand the workflow explicitly requests write permissions, the persisted token will remain read-only [3][7]. Consequently, any attempt to perform a write operation (e.g.,git push) using this token will fail with a 403 error [3][7]. 3. Security Best Practice: Because checking out and running code from a fork can be a security risk (as it may execute untrusted scripts), it is standard practice to setpersist-credentials: falsein such workflows to prevent the token from being available in the local Git configuration [8]. If your workflow requires write access (e.g., to post comments or update status checks), you should avoid relying on the persisted token from a fork-triggered checkout and instead utilize a different event (likeworkflow_run) or a guardedpull_request_targetto safely handle the interaction [7].Citations:
Disable persisted checkout credentials and declare read-only permissions.
actions/checkout@v4persistsGITHUB_TOKENby default. This job runs repository-controlled installation and test commands onpull_request, so that code can read the token from local Git configuration. Fork pull requests receive read-only tokens, but this workflow does not declarepermissions, so same-repository pull requests or permissive repository defaults may expose a write-capable token. Setpersist-credentials: falseandpermissions: contents: readunless authenticated Git operations are required.🧰 Tools
🪛 zizmor (1.29.0)
[warning] 23-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 15-65: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents
Sources: MCP tools, Linters/SAST tools