#151: addressing Aquasec findings #152
Conversation
lsulak
requested review from
Zejnilovic,
benedeki,
dk1844,
jakipatryk,
miroslavpojer and
salamonpavel
as code owners
WalkthroughPinned GitHub Actions used in multiple workflows to specific commit SHAs; added explicit Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (5 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
JaCoCo
|
| Overall Project | 59.84% | 🍏 |
|---|
There is no coverage information present for the Files changed
JaCoCo
|
| Overall Project | 70.17% | 🍏 |
|---|
There is no coverage information present for the Files changed
JaCoCo
|
| Overall Project | 91.42% | 🍏 |
|---|
There is no coverage information present for the Files changed
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
.github/workflows/build.yml.github/workflows/dependent_items.yml.github/workflows/jacoco_report.yml.github/workflows/license_check.yml.github/workflows/release.yml.github/workflows/test_filenames_check.yml
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-09-09T11:30:33.202Z
Learnt from: benedeki
Repo: AbsaOSS/fa-db PR: 140
File: project/plugins.sbt:18-18
Timestamp: 2025-09-09T11:30:33.202Z
Learning: The fa-db repository at AbsaOSS/fa-db has an existing GitHub Actions workflow (.github/workflows/release.yml) that uses sbt ci-release with all required secrets (PGP_PASSPHRASE, PGP_SECRET, SONATYPE_PASSWORD, SONATYPE_USERNAME) properly configured for Maven Central publishing.
Applied to files:
.github/workflows/license_check.yml.github/workflows/release.yml.github/workflows/build.yml.github/workflows/jacoco_report.yml.github/workflows/test_filenames_check.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)
- GitHub Check: Build, Test and Doc (2.12.17)
- GitHub Check: Build, Test and Doc (2.13.12)
- GitHub Check: Build, Test and Doc (2.13.12)
- GitHub Check: Build, Test and Doc (2.12.17)
- GitHub Check: Build, Test and Measure
- GitHub Check: Build, Test and Doc (2.12.17)
- GitHub Check: Build, Test and Doc (2.13.12)
🔇 Additional comments (6)
.github/workflows/license_check.yml (1)
32-34: LGTM! Consistent SHA pinning across workflows.The commit SHAs match those used in build.yml, ensuring consistent action versions across the CI/CD pipeline.
.github/workflows/release.yml (1)
25-33: Security pinning applied with beneficial standardization.Actions are pinned to commit SHAs, and the addition of
java-version: "adopt@1.8"standardizes the Java version across workflows (already present in build.yml and jacoco_report.yml). This ensures consistent build environments..github/workflows/jacoco_report.yml (2)
52-55: Consistent security pinning applied.Actions pinned to the same commit SHAs used across other workflows, ensuring version consistency.
115-115: GitHub Script action pinned consistently to v8.0.0.All three github-script steps use the same commit SHA (
ed597411d8f924073f98dfc5c65a23a2325f34cd), which corresponds to v8.0.0, the latest stable release..github/workflows/test_filenames_check.yml (1)
30-34: Verify AbsaOSS/filename-inspector SHA mapping to v0.1.0 release.The action is pinned to commit SHA
355108975e656fac9faaa04209b6df3f9997c8fa. Confirm this commit corresponds to the v0.1.0 release tag..github/workflows/build.yml (1)
48-50: Excellent security improvement: Actions pinned to immutable commit SHAs.This change aligns with supply-chain security best practices by replacing mutable version tags with immutable commit references.
Note: The olafurpg/setup-scala commit SHA correctly corresponds to v14, but the actions/checkout commit SHA (8e8c483db84b4bee98b60c0593521ed34d9990e8) corresponds to version 6.0.1, not v2.
Likely an incorrect or invalid review comment.
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: z0al/dependent-issues@v1.5.2 | ||
| - uses: z0al/dependent-issues@950226e7ca8fc43dc209a7febf67c655af3bdb43 |
There was a problem hiding this comment.
The z0al/dependent-issues action is from a repository archived by the owner on Sep 26, 2023. While pinning to a commit SHA is a security best practice, using an action from an archived repository introduces maintenance and security risks since it is now read-only. Consider migrating to an actively maintained alternative for issue dependency management.
🤖 Prompt for AI Agents
.github/workflows/dependent_items.yml around lines 31-31: the workflow uses the
archived z0al/dependent-issues action; replace it with an actively maintained
alternative (either a maintained fork of dependent-issues or a different
marketplace action that provides the same issue-dependency functionality), pin
that replacement to a release tag or commit SHA, update any inputs/outputs in
the workflow to match the new action's interface, remove the archived action
reference, and run the workflow locally or in a test branch to verify behavior.
| if: steps.jacocorun.outcome == 'success' | ||
| id: jacoco-core | ||
| uses: madrapps/jacoco-report@v1.6.1 | ||
| uses: madrapps/jacoco-report@50d3aff4548aa991e6753342d9ba291084e63848 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cd .github/workflows && cat jacoco_report.yml | head -100Repository: AbsaOSS/fa-db
Length of output: 3585
🏁 Script executed:
sed -n '60,105p' .github/workflows/jacoco_report.ymlRepository: AbsaOSS/fa-db
Length of output: 2157
JaCoCo report action pinned to commit SHA.
All three jacoco-report steps consistently use the same commit SHA (50d3aff4548aa991e6753342d9ba291084e63848). Pinning to a specific commit SHA ensures the exact, immutable version of the action's code is used, with a commit SHA uniquely identifying a specific state of the repository. Add a comment indicating which version the SHA corresponds to (e.g., # v1.7.2) for improved clarity and maintainability.
🤖 Prompt for AI Agents
.github/workflows/jacoco_report.yml around line 70: the jacoco-report action is
pinned to a commit SHA (50d3aff4548aa991e6753342d9ba291084e63848) but lacks a
comment indicating the corresponding action version; add a brief inline comment
on the same line (or immediately above) specifying which released tag/version
that SHA maps to (for example “# v1.7.2”), and do the same for the other two
jacoco-report steps so each pinned SHA is annotated with its human-readable
version.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/license_check.yml (1)
32-34: SHA is verified; security improvements are correct.The pinning of
actions/checkoutto SHA8e8c483db84b4bee98b60c0593521ed34d9990e8(v6.0.1) and the addition ofpersist-credentials: falseare both proper security practices. SHA pinning prevents tag-moving attacks, and disabling credential persistence prevents accidental credential leakage in subsequent workflow steps.Consider adding a version comment above line 32 for maintainability:
# actions/checkout@v6.0.1 uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
.github/workflows/build.yml.github/workflows/jacoco_report.yml.github/workflows/license_check.yml.github/workflows/release.yml.github/workflows/test_filenames_check.yml
🚧 Files skipped from review as they are similar to previous changes (4)
- .github/workflows/jacoco_report.yml
- .github/workflows/test_filenames_check.yml
- .github/workflows/release.yml
- .github/workflows/build.yml
🧰 Additional context used
🧠 Learnings (2)
📓 Common learnings
Learnt from: benedeki
Repo: AbsaOSS/fa-db PR: 140
File: project/plugins.sbt:18-18
Timestamp: 2025-09-09T11:30:33.202Z
Learning: The fa-db repository at AbsaOSS/fa-db has an existing GitHub Actions workflow (.github/workflows/release.yml) that uses sbt ci-release with all required secrets (PGP_PASSPHRASE, PGP_SECRET, SONATYPE_PASSWORD, SONATYPE_USERNAME) properly configured for Maven Central publishing.
📚 Learning: 2025-09-09T11:30:33.202Z
Learnt from: benedeki
Repo: AbsaOSS/fa-db PR: 140
File: project/plugins.sbt:18-18
Timestamp: 2025-09-09T11:30:33.202Z
Learning: The fa-db repository at AbsaOSS/fa-db has an existing GitHub Actions workflow (.github/workflows/release.yml) that uses sbt ci-release with all required secrets (PGP_PASSPHRASE, PGP_SECRET, SONATYPE_PASSWORD, SONATYPE_USERNAME) properly configured for Maven Central publishing.
Applied to files:
.github/workflows/license_check.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Build, Test and Doc (2.12.17)
- GitHub Check: Build, Test and Measure
- GitHub Check: Build, Test and Doc (2.13.12)
🔇 Additional comments (1)
.github/workflows/license_check.yml (1)
37-37: Use caution with unmaintained action; SHA pinning is correct but consider alternatives.Pinning
olafurpg/setup-scalato a commit SHA is a sound security practice. However, this project is no longer maintained, which means the pinned version will not receive future security updates. Consider evaluating maintained alternatives such as japgolly/setup-everything-scala, coursier/setup-action, or the official actions/setup-java which supports sbt projects.
Closes: #151
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.