chore(security): refresh actions and dependency locks - #708
Conversation
github-actions
Bot
added
area: agents
WalkthroughRepo-wide maintenance: bumps GitHub Actions versions across 20+ workflows, adds ESLint flat config for the health dashboard, updates manifests and dependency overrides, applies formatting-only edits across JS and tests, and adds an Authorization header to Pro activation. No behavioral changes beyond the header addition. ChangesRepository maintenance, CI upgrades, and minor installer tweak
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
📊 Coverage ReportCoverage report not available
Generated by PR Automation (Story 6.1) |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.aiox-core/install-manifest.yaml (1)
4219-4374:⚠️ Potential issue | 🟠 MajorManifest is incomplete: GitHub Actions workflow files are not tracked
The health-dashboard ESLint configuration and dependency updates are properly tracked in lines 4219-4374. However, the manifest is missing entries for 13 GitHub Actions workflow files that were modified as part of this PR's stated objective to update "GitHub Actions to current Node-compatible major versions":
.github/workflows/bob-integration.yml.github/workflows/ci.yml.github/workflows/codeql.yml.github/workflows/cross-platform-bob.yml.github/workflows/macos-testing.yml.github/workflows/npm-publish.yml.github/workflows/pr-automation.yml.github/workflows/pr-labeling.yml.github/workflows/pro-integration.yml.github/workflows/publish-pro.yml.github/workflows/quarterly-gap-audit.yml.github/workflows/release.yml.github/workflows/semantic-release.yml.github/workflows/stale.yml.github/workflows/sync-pro-submodule.yml.github/workflows/test.yml.github/workflows/welcome.ymlEither add these workflow files to the manifest with their updated hashes, or document that this manifest intentionally excludes the
.github/directory.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.aiox-core/install-manifest.yaml around lines 4219 - 4374, The install manifest (.aiox-core/install-manifest.yaml) is missing entries for the updated GitHub Actions workflow files; add manifest entries for each missing workflow (e.g., .github/workflows/ci.yml, .github/workflows/codeql.yml, .github/workflows/release.yml, .github/workflows/test.yml, .github/workflows/npm-publish.yml, etc.) with their correct sha256 hashes, types and sizes matching the updated files, or explicitly document in the manifest that the .github/ directory is intentionally excluded; update the same manifest block where the health-dashboard script files (paths like scripts/diagnostics/health-dashboard/*) are listed so the workflow files are tracked alongside those entries.
🧹 Nitpick comments (2)
.github/workflows/bob-integration.yml (1)
32-35: Action upgrades tov6are valid and current — same node-version deprecation note applies.Both
actions/checkout@v6andactions/setup-node@v6are stable.NODE_VERSION: '20'at line 22 is subject to the same upcoming deprecation concern noted incross-platform-bob.yml— consider bumping to Node 22 or 24 before June 2, 2026.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/bob-integration.yml around lines 32 - 35, The workflow uses actions/checkout@v6 and actions/setup-node@v6 which are fine; update the NODE_VERSION variable (NODE_VERSION) from '20' to a supported LTS (e.g., '22' or '24') to avoid the deprecation noted for Node 20 before June 2, 2026, and ensure any matrix or uses of NODE_VERSION in this workflow reference that updated value consistently; no change needed to actions/checkout@v6 or actions/setup-node@v6 unless you want to pin a different minor tag..github/workflows/cross-platform-bob.yml (1)
23-23:NODE_VERSION: '20'is approaching deprecation on GitHub-hosted runners.Node 20 reaches end-of-life in April 2026, and GitHub has started the deprecation process for Node 20 on GitHub Actions runners — beginning June 2, 2026, runners will start using Node 24 by default. Plan to bump
NODE_VERSIONto'22'or'24'ahead of that date to avoid workflow warnings and eventual breakage.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cross-platform-bob.yml at line 23, Update the workflow's NODE_VERSION value (currently NODE_VERSION: '20') to a supported LTS version such as '22' or '24' to avoid upcoming deprecation; locate the NODE_VERSION environment variable in the cross-platform-bob workflow and change its value to '22' or '24', then run the CI workflow locally or trigger the GitHub Actions run to verify all jobs (tools, caching, builds, and tests) work with the new Node version and adjust any Node-specific tooling/config (e.g., matrix entries, setup-node usage, engine checks) if failures surface.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/npm-publish.yml:
- Around line 50-53: The workflow uses mutable action tags like
actions/checkout@v6 and actions/setup-node@v6; replace each usage of
actions/*@vX (e.g., actions/checkout@v6, actions/setup-node@v6 and the other
actions referenced in the diff) with their corresponding immutable full commit
SHA (e.g., actions/checkout@<commit-sha>) by looking up the upstream GitHub repo
release/commit for each action and updating the uses: entries; ensure every
occurrence of a major-tagged action is changed to the pinned SHA so all steps
(checkout, setup-node, and the other listed actions) reference immutable
commits.
In @.github/workflows/pr-labeling.yml:
- Line 20: Replace mutable version tags in this privileged workflow with
immutable commit SHAs: locate the "uses:" entries like "uses:
actions/labeler@v6" and the other "uses: ...@v9" and change them to the
corresponding full commit SHA values for those action repositories; update the
workflow YAML so every third-party action in this job uses a pinned commit SHA
instead of a floating tag and verify the SHAs by fetching them from the action
repo's tags/releases before committing.
In @.github/workflows/publish-pro.yml:
- Around line 76-80: The checkout step is persisting the PRO_SUBMODULE_TOKEN
into git config; update the actions/checkout@v6 step (the block that currently
sets token: ${{ secrets.PRO_SUBMODULE_TOKEN }} and submodules: true) to add
persist-credentials: false under with so the token is not stored in local git
config (keep persist-credentials true only if later steps must perform
authenticated git ops).
---
Outside diff comments:
In @.aiox-core/install-manifest.yaml:
- Around line 4219-4374: The install manifest (.aiox-core/install-manifest.yaml)
is missing entries for the updated GitHub Actions workflow files; add manifest
entries for each missing workflow (e.g., .github/workflows/ci.yml,
.github/workflows/codeql.yml, .github/workflows/release.yml,
.github/workflows/test.yml, .github/workflows/npm-publish.yml, etc.) with their
correct sha256 hashes, types and sizes matching the updated files, or explicitly
document in the manifest that the .github/ directory is intentionally excluded;
update the same manifest block where the health-dashboard script files (paths
like scripts/diagnostics/health-dashboard/*) are listed so the workflow files
are tracked alongside those entries.
---
Nitpick comments:
In @.github/workflows/bob-integration.yml:
- Around line 32-35: The workflow uses actions/checkout@v6 and
actions/setup-node@v6 which are fine; update the NODE_VERSION variable
(NODE_VERSION) from '20' to a supported LTS (e.g., '22' or '24') to avoid the
deprecation noted for Node 20 before June 2, 2026, and ensure any matrix or uses
of NODE_VERSION in this workflow reference that updated value consistently; no
change needed to actions/checkout@v6 or actions/setup-node@v6 unless you want to
pin a different minor tag.
In @.github/workflows/cross-platform-bob.yml:
- Line 23: Update the workflow's NODE_VERSION value (currently NODE_VERSION:
'20') to a supported LTS version such as '22' or '24' to avoid upcoming
deprecation; locate the NODE_VERSION environment variable in the
cross-platform-bob workflow and change its value to '22' or '24', then run the
CI workflow locally or trigger the GitHub Actions run to verify all jobs (tools,
caching, builds, and tests) work with the new Node version and adjust any
Node-specific tooling/config (e.g., matrix entries, setup-node usage, engine
checks) if failures surface.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4aaa606e-2e8c-446d-b0f4-feba4d5e1ebb
⛔ Files ignored due to path filters (2)
.aiox-core/scripts/diagnostics/health-dashboard/package-lock.jsonis excluded by!**/package-lock.jsonpackage-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (52)
.aiox-core/core/pro/pro-updater.js.aiox-core/data/entity-registry.yaml.aiox-core/install-manifest.yaml.aiox-core/scripts/diagnostics/health-dashboard/eslint.config.mjs.aiox-core/scripts/diagnostics/health-dashboard/package.json.aiox-core/scripts/diagnostics/health-dashboard/src/pages/DomainDetail.jsx.aiox-core/scripts/diagnostics/health-dashboard/vite.config.js.github/workflows/bob-integration.yml.github/workflows/ci.yml.github/workflows/codeql.yml.github/workflows/cross-platform-bob.yml.github/workflows/macos-testing.yml.github/workflows/npm-publish.yml.github/workflows/pr-automation.yml.github/workflows/pr-labeling.yml.github/workflows/pro-integration.yml.github/workflows/publish-pro.yml.github/workflows/quarterly-gap-audit.yml.github/workflows/release.yml.github/workflows/semantic-release.yml.github/workflows/stale.yml.github/workflows/sync-pro-submodule.yml.github/workflows/test.yml.github/workflows/welcome.ymlbin/utils/pro-detector.jsbin/utils/validate-publish.jspackage.jsonpackages/aiox-pro-cli/bin/aiox-pro.jspackages/installer/src/pro/pro-scaffolder.jspackages/installer/src/updater/index.jspackages/installer/src/wizard/pro-setup.jsscripts/e2e/installed-skills-smoke.jstests/cli/validate-publish.test.jstests/code-intel/hook-runtime.test.jstests/config/config-resolver.test.jstests/ide-sync/transformers.test.jstests/installer/pro-setup-auth.test.jstests/integration/wizard-validation-flow.test.jstests/integration/workflow-intelligence/pattern-learning.test.jstests/pro-wizard.test.jstests/pro/pro-detector.test.jstests/synapse/e2e/agent-scenarios.e2e.test.jstests/synapse/e2e/regression-guards.e2e.test.jstests/synapse/hook-entry.test.jstests/synapse/synapse-memory-provider.test.jstests/unit/dev-context-loader.test.jstests/unit/generate-greeting.test.jstests/unit/greeting-builder.test.jstests/unit/squad/squad-generator-blueprint.test.jstests/unit/squad/squad-migrator.test.jstests/unit/squad/squad-validator.test.jstests/updater/aiox-updater.test.js
| uses: actions/checkout@v6 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| uses: actions/setup-node@v6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify mutable action refs in workflows (expects output lines for non-SHA refs).
rg -nP --glob '.github/workflows/*.yml' "uses:\s*[^@\s]+@v[0-9]+(\.[0-9]+)?(\.[0-9]+)?\b"Repository: SynkraAI/aiox-core
Length of output: 211
🏁 Script executed:
find .github -type f -name "*.yml" -o -name "*.yaml" | head -20Repository: SynkraAI/aiox-core
Length of output: 762
🏁 Script executed:
cat -n .github/workflows/npm-publish.yml 2>/dev/null || echo "File not found"Repository: SynkraAI/aiox-core
Length of output: 19420
Pin workflow actions to immutable commit SHAs.
These steps still use mutable major tags (@v6, @v7, @v8, @v9, etc.). For a publish pipeline that handles NPM credentials, pinning to full commit SHAs materially reduces supply-chain drift and takeover risk.
🔐 Example hardening pattern
- - name: Checkout code
- uses: actions/checkout@v6
+ - name: Checkout code
+ uses: actions/checkout@<full_commit_sha> # v6Affected lines: 50, 53, 78, 81, 136, 154, 157, 169, 253, 256, 405, 450
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/npm-publish.yml around lines 50 - 53, The workflow uses
mutable action tags like actions/checkout@v6 and actions/setup-node@v6; replace
each usage of actions/*@vX (e.g., actions/checkout@v6, actions/setup-node@v6 and
the other actions referenced in the diff) with their corresponding immutable
full commit SHA (e.g., actions/checkout@<commit-sha>) by looking up the upstream
GitHub repo release/commit for each action and updating the uses: entries;
ensure every occurrence of a major-tagged action is changed to the pinned SHA so
all steps (checkout, setup-node, and the other listed actions) reference
immutable commits.
| steps: | ||
| - name: Label PR based on files changed | ||
| uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4 | ||
| uses: actions/labeler@v6 # v6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find .github -name "pr-labeling.yml" -type fRepository: SynkraAI/aiox-core
Length of output: 96
🏁 Script executed:
cat -n .github/workflows/pr-labeling.ymlRepository: SynkraAI/aiox-core
Length of output: 1844
🌐 Web query:
GitHub Actions security best practices pinning commit SHA pull_request_target
💡 Result:
GitHub Actions security best practices emphasize pinning third-party actions to full commit SHAs rather than mutable tags (e.g., @v4) to prevent supply chain attacks where tags are rewritten to malicious commits [1][2][3][4][5]. Use the format uses: owner/repo@commit-sha # version and add comments for readability. Tools like Dependabot or Renovate can automate updates to new SHAs [2][5]. GitHub now supports organization/enterprise policies to enforce SHA pinning [6]. For pull_request_target workflows, which run in the base repo context with access to secrets and write permissions, risks are amplified if untrusted PR code is executed [7][8][9][10][11]. Never checkout the PR head SHA (github.event.pull_request.head.sha); always use the base branch [9][12][11]. Additional mitigations: - Set minimal permissions: permissions: { contents: read } at job level [4]. - Add checks: if: github.event.pull_request.head.repo.full_name == github.repository to block forks [9]. - Use persist-credentials: false in checkout [12]. - Split workflows: use pull_request for testing untrusted code, workflow_run or manual triggers for privileged actions [12][11]. - Avoid running scripts/builds from PR; use for labeling/commenting only [10]. Official GitHub guidance warns of these risks explicitly [10][4]. Use Scorecards to audit pinned actions and risky patterns [4].
Citations:
- 1: Pin GitHub Actions to commit SHAs in release workflow github/gh-aw#10021
- 2: Pin all GitHub Actions to immutable SHA commits for supply chain security github/gh-aw#5691
- 3: https://www.stepsecurity.io/blog/pinning-github-actions-for-enhanced-security-a-complete-guide
- 4: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions?learn=getting_started&learnProduct=actions
- 5: Pin third party actions to commit sha cli/cli#10731
- 6: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
- 7: https://paulserban.eu/blog/post/pullrequest-vs-pullrequesttarget-the-github-actions-trigger-hiding-a-security-nightmare/
- 8: https://paulserban.eu/blog/post/why-is-pullrequesttarget-so-dangerous-a-security-explainer/
- 9: https://securitylab.github.com/resources/github-actions-new-patterns-and-mitigations/
- 10: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
- 11: https://actsense.dev/vulnerabilities/insecure_pull_request_target/
- 12: https://rt-thread.medium.com/github-pull-request-target-reference-guide-d7a24691b8dc
Pin action references to full commit SHAs in this privileged workflow.
Lines 20 and 27 use mutable major version tags (@v6, @v9) in a pull_request_target job with write permissions. This creates a supply-chain vulnerability where tags can be rewritten to malicious commits. Pin to immutable commit SHAs to reduce this risk:
- uses: actions/labeler@v6 # v6
+ uses: actions/labeler@4a7f0c54e7c7c3a7c9b7d5e4c0b8a0f0e1d2c3a # v6.x
- uses: actions/github-script@v9 # v9
+ uses: actions/github-script@60a0be6bdc99f9ccde99c9e87d98b6faca389af3 # v9.x🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-labeling.yml at line 20, Replace mutable version tags
in this privileged workflow with immutable commit SHAs: locate the "uses:"
entries like "uses: actions/labeler@v6" and the other "uses: ...@v9" and change
them to the corresponding full commit SHA values for those action repositories;
update the workflow YAML so every third-party action in this job uses a pinned
commit SHA instead of a floating tag and verify the SHAs by fetching them from
the action repo's tags/releases before committing.
| uses: actions/checkout@v6 | ||
| with: | ||
| token: ${{ secrets.PRO_SUBMODULE_TOKEN }} | ||
| submodules: true | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/publish-pro.yml | sed -n '70,85p'Repository: SynkraAI/aiox-core
Length of output: 588
🏁 Script executed:
rg "uses: actions/checkout" .github/workflows/ -A 5 -B 1Repository: SynkraAI/aiox-core
Length of output: 19024
🌐 Web query:
actions/checkout persist-credentials security risk GitHub Actions
💡 Result:
In GitHub Actions, actions/checkout’s persist-credentials controls whether the action configures the GitHub token/credentials into the runner’s local git configuration so later steps can run authenticated git commands. 1) Is persist-credentials a security risk? Yes, in the sense that persisting credentials increases the amount of time and places where credentials can be accessed within the job; therefore it expands the attack surface if any later step/action becomes compromised. This is explicitly the rationale for using persist-credentials: false unless git push/authenticated git commands are needed: “prevents Git credentials from being persisted… reducing the risk of credential exposure if the workflow is compromised.” [1] 2) How GitHub describes the behavior (current state) The official actions/checkout README states: - “The auth token is persisted in the local git config… The token is removed during post-job cleanup.” [2] - “Set persist-credentials: false to opt-out.” [2] Also, newer checkout versions improved credential handling: persist-credentials “now stores credentials in a separate file under $RUNNER_TEMP instead of directly in .git/config.” [3] 3) Does it increase privileges across steps/jobs? Community discussion in the project indicates persisting credentials does not broaden access beyond what is already possible with GITHUB_TOKEN inside a job (i.e., other steps already can access the token), and the main additional risk is “credential exposure” (e.g., being able to use a persisted token for git operations without explicit handling). [4] 4) Practical guidance (what to do) - Default to least privilege and avoid persisting credentials unless required for git operations (push/authenticated fetch). Use persist-credentials: false on checkout steps that only need to read the repository. [1] - Ensure your workflow grants the minimum permissions for GITHUB_TOKEN (good security practice is defaulting to read-only for contents, and increasing only when needed per job). [5] Example: - name: Checkout (read-only) uses: actions/checkout@v6 with: persist-credentials: false This reduces the credential-at-rest exposure surface compared to persisting into git config. [1][2]
Citations:
- 1: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html
- 2: https://github.com/actions/checkout/blob/main/README.md
- 3: actions/checkout@v4...v6
- 4: Remove
persist-credentialsor change the default tofalseactions/checkout#485 - 5: https://docs.github.com/actions/security-guides/security-hardening-for-github-actions
Add persist-credentials: false to avoid persisting PRO_SUBMODULE_TOKEN in git config.
The checkout step uses a sensitive token for submodules but doesn't disable credential persistence. By default, actions/checkout stores the token in the local git config, expanding the attack surface if subsequent steps are compromised. Add persist-credentials: false unless authenticated git operations beyond the initial checkout are required.
Suggested fix
- name: Checkout repository
uses: actions/checkout@v6
with:
token: ${{ secrets.PRO_SUBMODULE_TOKEN }}
submodules: true
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: actions/checkout@v6 | |
| with: | |
| token: ${{ secrets.PRO_SUBMODULE_TOKEN }} | |
| submodules: true | |
| uses: actions/checkout@v6 | |
| with: | |
| token: ${{ secrets.PRO_SUBMODULE_TOKEN }} | |
| submodules: true | |
| persist-credentials: false |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish-pro.yml around lines 76 - 80, The checkout step is
persisting the PRO_SUBMODULE_TOKEN into git config; update the
actions/checkout@v6 step (the block that currently sets token: ${{
secrets.PRO_SUBMODULE_TOKEN }} and submodules: true) to add persist-credentials:
false under with so the token is not stored in local git config (keep
persist-credentials true only if later steps must perform authenticated git
ops).
Admin merge requested by repository owner after required CI/security checks passed; CodeRabbit comments are tracked for follow-up as needed.
Squash merge PR SynkraAI#708. Temporarily disabled repository ruleset CODEOWNERS review requirement and restored it after merge. CodeRabbit automated change request was dismissed after required CI/security checks passed.
1 participant
Summary
comma-danglewarnings.Validation
npm ci --ignore-scripts --no-audit --no-fundnpm audit --json→ 0 vulnerabilitiesnpm audit --omit=dev --json→ 0 vulnerabilitiesnpm audit --prefix .aiox-core/scripts/diagnostics/health-dashboard --json→ 0 vulnerabilitiesnpm run lintnpm run typechecknpm run test:ci→ 338 passed / 11 skipped suites, 8409 passed / 149 skipped testsnpm run validate:semantic-lintnpm run validate:publishnpm run lint --prefix .aiox-core/scripts/diagnostics/health-dashboardnpm run build --prefix .aiox-core/scripts/diagnostics/health-dashboardnpx yaml-lint .github/workflows/*.ymlactionlint -no-colorSummary by CodeRabbit