Update .gitignore and GitHub Actions configuration - #449
Conversation
…le SHAs with restricted permissions
|
Please read the following Contributor License Agreement (CLA). If you agree with the CLA, please comment with the following: I have read the CLA Document and I hereby sign the CLA You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot. |
📝 WalkthroughWalkthroughThis PR pins release and CLA GitHub Actions to commit SHAs, adds minimal workflow permissions, hardens shell selection on macOS/Linux, and updates ignore/editor settings. ChangesCI workflow hardening
Shell path allowlist fix
Repository configuration updates
Estimated code review effort: 3 (Moderate) | ~25 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dcac1acd36
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| permissions: | ||
| contents: write | ||
| actions: read | ||
|
|
||
| jobs: | ||
| build-and-release: |
There was a problem hiding this comment.
The jobs: key was removed, so build-and-release is now parsed under the top-level permissions mapping instead of as a workflow job. This leaves .github/workflows/windows-release.yml without a valid jobs section, so Windows release runs for tag pushes or manual dispatches will be rejected rather than building/uploading the release assets.
Useful? React with 👍 / 👎.
| if (!string.IsNullOrEmpty(shellFromEnv) && allowedShells.Contains(shellFromEnv)) | ||
| { | ||
| shell = shellFromEnv; |
There was a problem hiding this comment.
For users whose $SHELL is a valid login shell outside this hard-coded list, such as Homebrew fish at /opt/homebrew/bin/fish or Nix-managed shells, this condition rejects the user's actual shell and falls back to /bin/zsh or /bin/bash. In that scenario GetLatestPathVariable() no longer reads the shell startup files that define the user's PATH, so terminal/MCP command discovery can miss tools that are only added by that shell.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
I have read the CLA Document and I hereby sign the CLA
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
src/Everywhere.Core/Interop/EnvironmentVariableUtilities.cs (1)
86-91: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAllowlist omits the Apple Silicon Homebrew prefix (
/opt/homebrew/bin), rejecting legitimate shells.On Apple Silicon macOS, Homebrew installs to
/opt/homebrew, so a user's real$SHELLis commonly/opt/homebrew/bin/bash|zsh|fish. None of these are inallowedShells, so for those users$SHELLis discarded, a warning is logged, and resolution falls back to/bin/zsh. The login-shell PATH then reflects the default shell rather than the user's configured shell, silently dropping PATH customizations that flow downstream into the spawned pty'sPATH.The fallback is safe, but this degrades PATH resolution for a very common macOS configuration.
♻️ Add the Homebrew Apple Silicon paths
var allowedShells = new HashSet<string>(StringComparer.Ordinal) { "/bin/sh", "/bin/bash", "/bin/zsh", "/bin/fish", "/usr/bin/bash", "/usr/bin/zsh", "/usr/bin/fish", - "/usr/local/bin/bash", "/usr/local/bin/zsh", "/usr/local/bin/fish" + "/usr/local/bin/bash", "/usr/local/bin/zsh", "/usr/local/bin/fish", + "/opt/homebrew/bin/bash", "/opt/homebrew/bin/zsh", "/opt/homebrew/bin/fish" };🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/Everywhere.Core/Interop/EnvironmentVariableUtilities.cs` around lines 86 - 91, The allowed shell allowlist in EnvironmentVariableUtilities excludes the Apple Silicon Homebrew prefix, so legitimate shells from /opt/homebrew/bin are rejected and the fallback path is used. Update the allowedShells set in the shell-resolution logic to include the /opt/homebrew/bin variants for bash, zsh, and fish, keeping the existing validation behavior unchanged so users’ configured SHELL values on Apple Silicon macOS are accepted.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/macos-release.yml:
- Around line 30-36: The Checkout code step is persisting the workflow token in
.git/config, which is unnecessary for the later build and release steps. Update
the actions/checkout usage in the Checkout code step to disable persisted
credentials by adding the persist-credentials option set to false, keeping the
rest of the checkout behavior the same.
In @.github/workflows/windows-release.yml:
- Around line 9-14: The workflow structure is invalid because build-and-release
is nested under permissions instead of under a top-level jobs block. Update the
windows-release workflow so permissions only contains permission settings, then
restore the missing jobs key and place build-and-release beneath it with its
existing job definition intact.
- Around line 21-28: The Checkout step in the windows release workflow is
leaving the GitHub token persisted in git config, which is unsafe for a job with
contents: write. Update the actions/checkout usage in the Checkout code step to
disable persisted credentials by setting persist-credentials to false, while
keeping the existing fetch-depth, submodules, and lfs settings intact.
In @.gitignore:
- Line 102: The current ignore rule `*.github` in the gitignore is too broad and
also matches the `.github` directory itself, which can hide new files under that
directory. Update the ignore rule to target only the intended filename pattern
or add an explicit exception for `.github`, and verify the `.github` directory
remains trackable while preserving any intended ignore behavior.
---
Nitpick comments:
In `@src/Everywhere.Core/Interop/EnvironmentVariableUtilities.cs`:
- Around line 86-91: The allowed shell allowlist in EnvironmentVariableUtilities
excludes the Apple Silicon Homebrew prefix, so legitimate shells from
/opt/homebrew/bin are rejected and the fallback path is used. Update the
allowedShells set in the shell-resolution logic to include the /opt/homebrew/bin
variants for bash, zsh, and fish, keeping the existing validation behavior
unchanged so users’ configured SHELL values on Apple Silicon macOS are accepted.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: c2f9ddf0-08fe-40fc-848e-2eb3a0f418b5
📒 Files selected for processing (5)
.github/workflows/macos-release.yml.github/workflows/windows-release.yml.gitignore.vscode/settings.jsonsrc/Everywhere.Core/Interop/EnvironmentVariableUtilities.cs
| - name: Checkout code | ||
| uses: actions/checkout@v6 | ||
| # actions/checkout v6 does not exist — typo, pinning to correct v4 SHA. | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
| with: | ||
| fetch-depth: 0 | ||
| submodules: true | ||
| lfs: true |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- .github/workflows/macos-release.yml (relevant lines) ---\n'
nl -ba .github/workflows/macos-release.yml | sed -n '1,120p'
printf '\n--- checkout credential settings used elsewhere ---\n'
rg -n "persist-credentials|actions/checkout|contents:\s*write|GITHUB_TOKEN|release" .github/workflows -SRepository: Sylinko/Everywhere
Length of output: 247
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- .github/workflows/macos-release.yml (relevant lines) ---'
nl -ba .github/workflows/macos-release.yml | sed -n '1,120p'
echo
echo '--- checkout credential settings used elsewhere ---'
rg -n "persist-credentials|actions/checkout|contents:\s*write|GITHUB_TOKEN|release" .github/workflows -SRepository: Sylinko/Everywhere
Length of output: 257
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- .github/workflows/macos-release.yml (relevant lines) ---'
sed -n '1,120p' .github/workflows/macos-release.yml | cat -n
echo
echo '--- checkout credential settings used elsewhere ---'
rg -n "persist-credentials|actions/checkout|contents:\s*write|GITHUB_TOKEN|release" .github/workflows -SRepository: Sylinko/Everywhere
Length of output: 8599
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- git usage in .github/workflows/macos-release.yml ---'
rg -n "\bgit\b|actions/checkout|persist-credentials|GITHUB_TOKEN|softprops/action-gh-release" .github/workflows/macos-release.yml -n -S
echo
echo '--- action/checkout default docs pointer not in repo; search for explicit guidance in repo ---'
rg -n "persist-credentials|checkout credentials|local git config" -S .Repository: Sylinko/Everywhere
Length of output: 566
Disable persisted checkout credentials. actions/checkout is leaving its token in .git/config; the later build steps don’t need it, and the release upload can use the workflow token separately. Add persist-credentials: false.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 30-36: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/macos-release.yml around lines 30 - 36, The Checkout code
step is persisting the workflow token in .git/config, which is unnecessary for
the later build and release steps. Update the actions/checkout usage in the
Checkout code step to disable persisted credentials by adding the
persist-credentials option set to false, keeping the rest of the checkout
behavior the same.
Source: Linters/SAST tools
There was a problem hiding this comment.
I have read the CLA Document and I hereby sign the CLA
There was a problem hiding this comment.
@Tusharxhub Thanks for signing the CLA! 🐰
Let me know once you've had a chance to address the persist-credentials: false suggestion on the checkout step, or if you'd like to discuss it further.
| - name: Checkout code | ||
| uses: actions/checkout@v6 | ||
| # Pinned to SHA digest to prevent supply-chain attacks via mutable tag redirection. | ||
| # v6 does not exist — this was a bug. Correct version is v4. | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
| with: | ||
| fetch-depth: 0 | ||
| submodules: true | ||
| lfs: true |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git ls-files .github/workflows/windows-release.yml
wc -l .github/workflows/windows-release.yml
cat -n .github/workflows/windows-release.yml | sed -n '1,220p'Repository: Sylinko/Everywhere
Length of output: 6201
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the workflow for subsequent git usage and any explicit credential handling.
rg -n "persist-credentials|git config|checkout|submodule|lfs|sign|release|push|fetch-depth|contents: write" .github/workflows/windows-release.yml .github/workflows -g '*.yml' -g '*.yaml'Repository: Sylinko/Everywhere
Length of output: 7701
Disable persisted checkout credentials. This release job grants contents: write; keep the token out of git config so later build/signing steps can’t reuse it. Add persist-credentials: false to actions/checkout.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/windows-release.yml around lines 21 - 28, The Checkout
step in the windows release workflow is leaving the GitHub token persisted in
git config, which is unsafe for a job with contents: write. Update the
actions/checkout usage in the Checkout code step to disable persisted
credentials by setting persist-credentials to false, while keeping the existing
fetch-depth, submodules, and lfs settings intact.
| *.svclog | ||
| *.scc | ||
|
|
||
| *.github |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
*.github glob unintentionally matches the .github directory itself.
Gitignore glob semantics mean * matches zero or more characters, so *.github also matches the literal .github directory (empty prefix + .github). This silently ignores any new untracked files added under .github/ (new workflows, CODEOWNERS, dependabot.yml, issue templates, etc.), even though already-committed files like .github/workflows/macos-release.yml remain unaffected.
🛠️ Proposed fix — scope the pattern or add an explicit exception
-*.github
+*.github
+!.github/If the intent was to ignore some other pattern (e.g. a backup/config file literally named like foo.github), consider using a more explicit pattern instead.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| *.github | |
| *.github | |
| !.github/ |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.gitignore at line 102, The current ignore rule `*.github` in the gitignore
is too broad and also matches the `.github` directory itself, which can hide new
files under that directory. Update the ignore rule to target only the intended
filename pattern or add an explicit exception for `.github`, and verify the
`.github` directory remains trackable while preserving any intended ignore
behavior.
There was a problem hiding this comment.
I have read the CLA Document and I hereby sign the CLA
There was a problem hiding this comment.
@Tusharxhub Thanks for signing the CLA! This comment doesn't relate to the .gitignore *.github pattern issue flagged above — let me know once you've had a chance to address it, or if you'd like to discuss the fix (adding !.github/ as an exception) further.
(=^･ω･^=)
|
done |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/cla.yml (1)
25-26: 🔒 Security & Privacy | 🔵 Trivial | ⚖️ Poor tradeoffArchived upstream action — SHA pin mitigates tag-hijack but not lack of patches.
zizmor flags this as
archived-uses. The comment already documents the tradeoff, but since the upstream repo is archived it won't receive security fixes even at a pinned SHA. Worth periodically evaluating a maintained fork/alternative for the CLA bot.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cla.yml around lines 25 - 26, The CLA workflow currently uses contributor-assistant/github-action at a pinned SHA, but the upstream action is archived and will not receive security fixes. Review the cla workflow entry that uses contributor-assistant/github-action and replace it with a maintained fork or alternative action, or otherwise update the workflow to avoid relying on an archived upstream while preserving the existing CLA bot behavior.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/cla.yml:
- Around line 25-26: The CLA workflow currently uses
contributor-assistant/github-action at a pinned SHA, but the upstream action is
archived and will not receive security fixes. Review the cla workflow entry that
uses contributor-assistant/github-action and replace it with a maintained fork
or alternative action, or otherwise update the workflow to avoid relying on an
archived upstream while preserving the existing CLA bot behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 86634551-bc95-478e-b19d-d9ae40795c56
📒 Files selected for processing (1)
.github/workflows/cla.yml
|
I have read the CLA Document and I hereby sign the CLA |
1 similar comment
|
I have read the CLA Document and I hereby sign the CLA |
| - name: Checkout code | ||
| uses: actions/checkout@v6 | ||
| # actions/checkout v6 does not exist — typo, pinning to correct v4 SHA. | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
There was a problem hiding this comment.
The lastest version is v7.0.0. v4.2.2 is outdated with Node 20.
|
|
||
| - name: Setup Node | ||
| uses: actions/setup-node@v6 | ||
| uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 |
There was a problem hiding this comment.
The lastest version is v6.4.0. v4.1.0 is outdated with node 22.
|
|
||
| - name: Setup .NET | ||
| uses: actions/setup-dotnet@v5 | ||
| uses: actions/setup-dotnet@3951f0dfe7a07e2313ec93c75700083e2005cbab # v4.3.0 |
|
|
||
| - name: Upload Release Assets | ||
| uses: softprops/action-gh-release@v3 | ||
| uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.2.1 |
| uses: actions/checkout@v6 | ||
| # Pinned to SHA digest to prevent supply-chain attacks via mutable tag redirection. | ||
| # v6 does not exist — this was a bug. Correct version is v4. | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
|
|
||
| - name: Setup Node | ||
| uses: actions/setup-node@v6 | ||
| uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 |
|
|
||
| - name: Setup .NET | ||
| uses: actions/setup-dotnet@v5 | ||
| uses: actions/setup-dotnet@3951f0dfe7a07e2313ec93c75700083e2005cbab # v4.3.0 |
|
|
||
| - name: Setup MSBuild | ||
| uses: microsoft/setup-msbuild@v3 | ||
| uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2.0.0 |
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0 |
|
|
||
| - name: Upload Release Assets | ||
| uses: softprops/action-gh-release@v3 | ||
| uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.2.1 |
2 participants
Description
Type of Change
Current Behavior
Updated/Expected Behavior
Implementation Details
Screenshots / Recordings
Checklist
Breaking Changes
Obsoletions / Deprecations
Fixed Issues
Summary by CodeRabbit
.gitignorecoverage for GitHub-specific paths and a VS Code setting to ignore pull request results on themainbranch.