Skip to content

chore(ci): use reusable github actions workflows #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
konradmichalik merged 1 commit into from
Jun 22, 2026
Merged

chore(ci): use reusable github actions workflows #31

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 3 additions & 51 deletions .github/workflows/cgl.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,54 +6,6 @@ on:

jobs:
cgl:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
with:
fetch-depth: 0

# Prepare environment
- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
# @todo Use PHP 8.4 once PHP-CS-Fixer supports PHP 8.4
php-version: 8.3
tools: composer:v2, composer-require-checker, composer-unused, cs2pr
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# Validation
- name: Validate composer.json
run: composer validate

# Install dependencies
- name: Add required packages
run: composer require composer/composer:"^2.2"

# Check Composer dependencies
- name: Check dependencies
run: composer-require-checker check
- name: Reset composer.json
run: git checkout composer.json
- name: Re-install Composer dependencies
uses: ramsey/composer-install@4.0.0
- name: Check for unused dependencies
run: composer-unused --excludePackage=deployer/deployer --excludePackage=sourcebroker/deployer-extended

# Linting
- name: Update composer.lock
run: composer update --lock
- name: Lint composer.json
run: composer lint:composer
- name: Lint Editorconfig
run: composer lint:editorconfig
- name: Lint PHP
run: composer lint:php -- --format checkstyle | cs2pr

# SCA
- name: SCA PHP
run: composer sca:php -- --error-format github

# Migration
- name: Run Rector migration
run: composer migration:rector -- --dry-run
uses: konradmichalik/reusable-github-actions/.github/workflows/cgl.yml@main
with:
php-version: '8.3'
Comment on lines +9 to +11

@coderabbitai coderabbitai Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Verify workflow `uses:` references are pinned to full commit SHAs.
# Expected: no output. Any output indicates unpinned references.
rg -nP --iglob '*.yml' '^\s*uses:\s*[^@]+@(?![0-9a-fA-F]{40}\b)\S+'

Repository: move-elevator/deployer-tools

Length of output: 221

🏁 Script executed:

# First, verify the target file exists and show its content
if [ -f ".github/workflows/cgl.yml" ]; then
  echo "=== File exists: .github/workflows/cgl.yml ==="
  cat -n ".github/workflows/cgl.yml" | head -20
else
  echo "File not found: .github/workflows/cgl.yml"
fi

# List all YAML files in .github/workflows
echo -e "\n=== YAML files in .github/workflows ==="
find .github/workflows -name "*.yml" -o -name "*.yaml" 2>/dev/null | head -20

# Search for unpinned workflow uses with corrected pattern
echo -e "\n=== Searching for unpinned 'uses:' references ==="
rg 'uses:.*@(?!([0-9a-fA-F]{40})($|[^0-9a-fA-F]))' --type yaml -n 2>/dev/null || echo "rg search completed"

Repository: move-elevator/deployer-tools

Length of output: 542

🏁 Script executed:

# Check the other workflow file for context on pinning practices
echo "=== Content of release.yml ==="
cat -n ".github/workflows/release.yml"

# Search for any policy documentation about pinning or security
echo -e "\n=== Searching for policy/documentation files ==="
find . -maxdepth 2 -type f \( -iname "SECURITY*" -o -iname "POLICY*" -o -iname "CONTRIBUTING*" -o -iname "README*" \) -not -path "./.git/*" | head -20

# Check for any comments or docs about action pinning in workflow files
echo -e "\n=== Checking for pinning-related comments in workflows ==="
rg -l 'pin|sha|commit|hash' --type yaml .github/workflows/ 2>/dev/null || true

Repository: move-elevator/deployer-tools

Length of output: 465

🏁 Script executed:

# Check SECURITY.md for pinning policy
echo "=== Content of docs/SECURITY.md ==="
cat ./docs/SECURITY.md

echo -e "\n=== Checking README.md for CI/CD or pinning policies ==="
head -100 ./README.md

Repository: move-elevator/deployer-tools

Length of output: 4116

🏁 Script executed:

# Search for zizmor or other security linting configs
echo "=== Searching for security/linting configs ==="
find . -maxdepth 2 -type f \( -name ".zizmor*" -o -name "*zizmor*" -o -name ".github-security*" \) 2>/dev/null

# Check all .github root files
echo -e "\n=== Files in .github root ==="
ls -la .github/ | grep -v workflows

# Check if there's a dependabot or similar security config
echo -e "\n=== Checking for dependabot/security configs ==="
ls -la .github/

# Search for any mentions of "zizmor" in the repo
echo -e "\n=== Searching for zizmor mentions ==="
rg -r 'zizmor' --type yaml --type json 2>/dev/null || echo "No zizmor references found"

Repository: move-elevator/deployer-tools

Length of output: 542

🌐 Web query:

zizmor github actions security linter

💡 Result:

zizmor is a security-focused static analysis tool designed specifically for GitHub Actions [1][2]. Written in Rust, it aims to identify and help remediate potential vulnerabilities within CI/CD configurations [2][3]. Key features of zizmor include: Security Auditing: It detects common security issues such as template injection vulnerabilities, accidental credential exposure, excessive runner permissions, and the use of known vulnerable actions [2][4]. Integration Options: zizmor-action: The official GitHub Action for automated integration. It supports uploading results to GitHub Advanced Security (where available) or printing them directly to the console [5][6]. Manual Integration: Users can run zizmor directly in their workflows using various output formats, including SARIF (for code scanning integration), JSON, or plain text [6]. Developer-Friendly: It is designed with a high signal-to-noise ratio and supports multiple "personas" (like pedantic or auditor) to adjust sensitivity [1]. Offline Capability: zizmor functions as an offline-native tool, though it can optionally utilize a GitHub API token to fetch remote workflows or interact with GitHub's ecosystem [1][7]. Compatibility: It can be integrated into broader linter frameworks such as Super-Linter and MegaLinter [6]. Official documentation and resources are available at https://zizmor.sh/ and the source code can be found in the zizmorcore/zizmor repository on GitHub [1][2].

Citations:

🌐 Web query:

github reusable workflows pinning commit sha best practice

💡 Result:

The best practice for referencing reusable workflows in GitHub Actions is to pin them to a full-length commit SHA [1][2][3]. Using mutable references like branch names or tags is a significant security risk, as a compromised upstream repository could allow an attacker to inject malicious code that your workflows would automatically execute [1][2][4]. Key recommendations and best practices include: Pin to full SHA: Always reference reusable workflows using a 40-character commit SHA [2][4]. This ensures immutability and guarantees that the exact code you audited is the code that runs, protecting against supply chain attacks such as malicious tag re-pointing [1][4]. Maintain readability with comments: While the reference must be a SHA, it is a common best practice to append the intended version tag as a comment for readability and easier maintenance, for example: uses: owner/repo/.github/workflows/workflow.yml@a1b2c3d4e5f6g7h8i9j0k1l2 # v1.0.0 [4][5]. Use organization policies: If using GitHub Enterprise, configure the organization-level policy to Require actions to be pinned to a full-length commit SHA [1][3]. This enforcement mechanism prevents accidental use of mutable references and ensures consistent security standards across your organization [3]. Implement drift audits: Because organization policies may not recursively verify nested reusable workflows, implement periodic audits or CI checks to walk the dependency tree of your workflows [1]. Tools or custom scripts can be used to parse YAML files, resolve the references, and fail builds that contain unpinned refs [1]. Leverage automation: Use tools like Dependabot or specialized CI utilities (e.g., pinact) to help manage and update these pinned references, ensuring that you can receive security patches and feature updates while maintaining control over when upgrades occur [3][5]. Note on same-repo workflows: Reusable workflows located within the same repository (e.g.,./.github/workflows/my-workflow.yml) are implicitly pinned to the commit SHA of the caller, so they do not require explicit SHA pinning [4]. Cross-repository references, however, must always be explicitly pinned [4].

Citations:

Pin reusable workflow to an immutable commit SHA.

Line 9 uses @main, which is mutable and creates a supply-chain security risk. GitHub's recommended best practice is to pin reusable workflows to a full 40-character commit SHA to prevent supply-chain attacks. The same issue also exists in .github/workflows/release.yml at line 10.

Suggested fix for cgl.yml 
-    uses: konradmichalik/reusable-github-actions/.github/workflows/cgl.yml@main
+    uses: konradmichalik/reusable-github-actions/.github/workflows/cgl.yml@<FULL_40_CHAR_COMMIT_SHA>

Apply the same fix to .github/workflows/release.yml line 10.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: konradmichalik/reusable-github-actions/.github/workflows/cgl.yml@main
with:
php-version: '8.3'
uses: konradmichalik/reusable-github-actions/.github/workflows/cgl.yml@abc123def456789012345678901234567890abcd
with:
php-version: '8.3'
🧰 Tools
🪛 zizmor (1.25.2)

[error] 9-9: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/cgl.yml around lines 9 - 11, The reusable workflow
reference in both `.github/workflows/cgl.yml` and
`.github/workflows/release.yml` uses `@main` which is mutable and poses a
supply-chain security risk. Replace `@main` with a full 40-character commit SHA
in the konradmichalik/reusable-github-actions/.github/workflows/cgl.yml
reference on line 9 of cgl.yml and in the analogous reference on line 10 of
release.yml to pin the workflow to an immutable commit.

Source: Linters/SAST tools

24 changes: 1 addition & 23 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,27 +6,5 @@ on:
- '*'

jobs:
# Job: Create release
release:
if: startsWith(github.ref, 'refs/tags/')
runs-on: ubuntu-latest
outputs:
release-notes-url: ${{ steps.create-release.outputs.url }}
steps:
- uses: actions/checkout@v7
with:
fetch-depth: 0

# Check if tag is valid
- name: Check tag
run: |
if ! [[ ${{ github.ref }} =~ ^refs/tags/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}$ ]]; then
exit 1
fi

# Create release
- name: Create release
id: create-release
uses: softprops/action-gh-release@v3
with:
generate_release_notes: true
uses: konradmichalik/reusable-github-actions/.github/workflows/release.yml@main

@coderabbitai coderabbitai Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/release.yml | head -20

Repository: move-elevator/deployer-tools

Length of output: 293

🌐 Web query:

GitHub Actions reusable workflow pinning commit hash best practices security

💡 Result:

The security best practice for GitHub Actions reusable workflows is to pin all references to a full-length commit SHA [1][2][3]. Using a tag or branch (e.g., @v1) as a reference is inherently mutable, meaning the underlying code can change without the workflow file being updated [4][5][6]. If an attacker compromises the repository containing the reusable workflow, they can force-push a malicious update to a tag, which your pipelines would automatically execute [1][3][7]. Pinning to a full-length commit SHA ensures immutability; it binds your workflow to a specific, cryptographically verified snapshot of the code, preventing such supply chain attacks [1][7][8]. To maintain the benefits of versioning while ensuring security, follow these conventions: 1. Use full-length commit SHAs: Always use the 40-character commit hash for references [9][1][10]. 2. Add descriptive comments: Append the original version tag as a comment to preserve readability and aid automated tooling (e.g., uses: owner/repo/.github/workflows/main.yml@a1b2c3d4... # v1.2.3) [7][5][8]. 3. Automate updates: Configure automated dependency managers like Dependabot or Renovate to monitor for new tags and generate pull requests that update the SHA and the associated comment [7][6][8]. 4. Enforce via policy: If you are using GitHub Enterprise or an organization account, enable the policy "Require actions to be pinned to a full-length commit SHA" in your organization settings to prevent unpinned references across all repositories [9][1][10][3]. Note that while some organizational policies may explicitly target "actions," you should manually audit and pin reusable workflows with the same level of rigor, as they share similar security risks [9][3]. Beyond pinning, remember that reusable workflows operate with the caller's permissions and secrets [9][11]. Therefore, you should also: - Limit secret inheritance: Prefer explicit secret passing (secrets:...) over secrets: inherit to minimize exposure [11]. - Validate inputs: Treat all workflow inputs as untrusted and validate them before use to prevent command injection [11].

Citations:

🌐 Web query:

zizmor GitHub Actions security checker unpinned-uses

💡 Result:

The unpinned-uses audit is a security check provided by zizmor, a static analysis tool for GitHub Actions [1][2]. Its primary purpose is to identify and flag GitHub Actions or reusable workflows that are not pinned to a specific, immutable SHA reference [1][3]. Key details of the unpinned-uses audit include: Functionality and Configuration: The rule ensures that actions are pinned by SHA hash, which protects against supply chain attacks where a tagged or branch-based reference (like v1 or main) is updated with malicious code [1][4]. As of zizmor v1.20.0, the default policy requires hash-pinning for all actions, including official GitHub actions [1][5]. Users can customize this behavior via a zizmor.yml configuration file, where they can define granular policies (e.g., allowing ref-pinning for trusted organizations) using pattern matching [1]. Audit Policies: The audit supports three primary policies for matched patterns: - hash-pin: Requires the action to be pinned by a full SHA reference [1]. - ref-pin: Allows pinning by symbolic reference (e.g., tags or branches) or SHA reference [1]. - any: Requires no specific pinning [1]. Execution Requirements: The audit does not require online access to perform the initial detection of unpinned uses [6]. However, if you wish to use the tool's auto-fix feature to automatically resolve findings by pinning them to the latest SHA, online access and a GitHub token are required to fetch the commit hashes [6]. If you wish to revert to a more permissive policy for first-party actions (like those under actions/) after the v1.20.0 change, you can add the following to your zizmor.yml file [1][5]: rules: unpinned-uses: config: policies: actions/: ref-pin github/: ref-pin dependabot/: ref-pin

Citations:

Pin the release reusable workflow reference to a commit hash.

Line 10 references @main, which is mutable and allows unreviewed upstream changes in the release path. Pinning to a full-length commit SHA prevents supply chain attacks where an attacker could compromise the upstream repository and force-push malicious code to the branch.

Suggested fix 
-    uses: konradmichalik/reusable-github-actions/.github/workflows/release.yml@main
+    uses: konradmichalik/reusable-github-actions/.github/workflows/release.yml@<FULL_40_CHAR_COMMIT_SHA>
🧰 Tools
🪛 zizmor (1.25.2)

[error] 10-10: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml at line 10, The reusable GitHub Actions
workflow reference in the release.yml file uses `@main`, which is mutable and
vulnerable to supply chain attacks. In the uses statement referencing
konradmichalik/reusable-github-actions/.github/workflows/release.yml, replace
`@main` with a full-length commit SHA (40 character hash) to pin the workflow to a
specific immutable commit. This ensures that only the reviewed version of the
upstream workflow can be executed.

Source: Linters/SAST tools

14 changes: 14 additions & 0 deletions composer-unused.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
<?php

declare(strict_types=1);

use ComposerUnused\ComposerUnused\Configuration\Configuration;
use ComposerUnused\ComposerUnused\Configuration\NamedFilter;

return static function (Configuration $config): Configuration {
// These packages are consumed via Deployer's recipe loading mechanism,
// not through PHP `use`/autoload, so composer-unused cannot detect them.
return $config
->addNamedFilter(NamedFilter::fromString('deployer/deployer'))
->addNamedFilter(NamedFilter::fromString('sourcebroker/deployer-extended'));
};