ci: check project formatting with Nix - #468
Conversation
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/lint.yml:
- Line 39: Update the runs-on configuration using the
blacksmith-2vcpu-ubuntu-2404 label: declare it under self-hosted-runner.labels
in .github/actionlint.yaml if it is an intended self-hosted label, otherwise
replace it with a supported hosted runner label.
- Line 41: Update the actions/checkout step in the format job to set
persist-credentials to false, leaving the pinned checkout action reference
unchanged.
🪄 Autofix (Beta)
❌ Autofix failed (check again to retry)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: bd51ac86-1668-4810-a0bf-927a15ef5559
📒 Files selected for processing (2)
.github/workflows/lint.ymlflake.nix
|
|
||
| rustfmt: | ||
| project-format: | ||
| runs-on: blacksmith-2vcpu-ubuntu-2404 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 2 'blacksmith-2vcpu-ubuntu-2404' \
.github/workflows/lint.yml actionlint.yaml 2>/dev/null || trueRepository: x52dev/inspect-cert-chain
Length of output: 983
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Workflows and actionlint config files:\n'
git ls-files '.github/workflows/*' 'actionlint.yaml' 'actionlint.yml' 'actionlint.json' 2>/dev/null || true
printf '\nRelevant workflow runner labels:\n'
rg -n 'runs-on:|blacksmith' .github/workflows || true
printf '\nActionlint config existence and content:\n'
for f in actionlint.yaml actionlint.yml actionlint.json .github/actionlint.yaml .github/actionlint.yml .github/actionlint.json; do
[ -f "$f" ] && { printf '\n== %s ==\n' "$f"; cat -n "$f"; }
doneRepository: x52dev/inspect-cert-chain
Length of output: 860
🌐 Web query:
GitHub actionlint unknown runner label actionlint.yaml
💡 Result:
The "unknown runner label" error in actionlint occurs when a workflow uses a runs-on label that is not part of the standard, GitHub-hosted runner set [1][2]. This commonly happens when using custom, self-hosted runner labels [3][4]. To resolve this, you must explicitly declare your custom runner labels in an actionlint.yaml configuration file within your repository's .github directory [5][1]. Configuration Steps: 1. Create or update the configuration file: .github/actionlint.yaml [5]. 2. Add the self-hosted-runner section and list your custom labels under labels [5]: yaml # .github/actionlint.yaml self-hosted-runner: labels: - your-custom-label-1 - your-custom-label-2 Alternatively, you can generate a default configuration file automatically by running [5]: actionlint -init-config If you prefer to suppress these warnings without declaring labels, you can use the -ignore flag when running actionlint [3][6]: actionlint -ignore 'label ".+" is unknown' For more advanced configuration, glob patterns are supported in the labels list if you need to match multiple similar labels [5].
Citations:
- 1: https://github.com/rhysd/actionlint/blob/main/README.md
- 2: https://github.com/rhysd/actionlint/blob/main/rule_runner_label.go
- 3: https://github.com/wimpysworld/tailor/blob/main/docs/LINTING.md
- 4: fix(yaml): make actionlint respect config dense-analysis/ale#4584
- 5: https://github.com/rhysd/actionlint/blob/v1.7.12/docs/config.md
- 6: https://github.com/rhysd/actionlint/blob/main/docs/usage.md
Declare the custom runner label for actionlint.
blacksmith-2vcpu-ubuntu-2404 is not a documented hosted runner label. If this is a self-hosted runner label, add it to .github/actionlint.yaml under self-hosted-runner.labels; otherwise, switch the jobs to a supported runner label.
🧰 Tools
🪛 actionlint (1.7.12)
[error] 39-39: label "blacksmith-2vcpu-ubuntu-2404" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2025-vs2026", "windows-2022", "windows-11-arm", "ubuntu-slim", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xlarge", "macos-latest-large", "macos-26-intel", "macos-26-xlarge", "macos-26-large", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xlarge", "macos-14-large", "macos-14", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/lint.yml at line 39, Update the runs-on configuration
using the blacksmith-2vcpu-ubuntu-2404 label: declare it under
self-hosted-runner.labels in .github/actionlint.yaml if it is an intended
self-hosted label, otherwise replace it with a supported hosted runner label.
Source: Linters/SAST tools
| project-format: | ||
| runs-on: blacksmith-2vcpu-ubuntu-2404 | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 4 \
'pull_request|pull_request_target|actions/checkout|persist-credentials|permissions|git (fetch|push)' \
.github/workflows/lint.ymlRepository: x52dev/inspect-cert-chain
Length of output: 1363
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Workflow trigger and job summary:"
sed -n '1,120p' .github/workflows/lint.yml
echo
echo "Subsequent steps in format job with relevant git/authentication commands:"
python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/lint.yml')
text=p.read_text()
lines=text.splitlines()
in_format=False
indent=0
for i,line in enumerate(lines,1):
if i==38: in_format=True; indent=2
if in_format:
if line.startswith(' docs:') or (line.startswith('jobs:') and i<38): continue
if line.startswith(' ') and len(line)-len(line.lstrip()) <= indent:
if i>38:
in_format=False
if in_format:
print(f"{i}: {line}")
PY
echo
echo "Files mentioning Justfile and zizmor:"
rg -n 'Justfile|zizmor|artipacked|pull_request_target|pull_request:' .Repository: x52dev/inspect-cert-chain
Length of output: 3835
🌐 Web query:
actions/checkout persist-credentials default true README
💡 Result:
In the actions/checkout GitHub Action, the persist-credentials input controls whether the authentication token or SSH key used for checking out the repository is configured in the local git configuration [1][2]. Key details include: Default behavior: The default value for persist-credentials is true [1][3]. Purpose: When enabled (true), it allows your workflow scripts to run authenticated git commands (such as git push or git pull) without needing to manually re-authenticate [1][2]. Cleanup: The action automatically removes these credentials during the post-job cleanup phase [1][4]. Opting out: You can set persist-credentials: false if you do not want the action to store the authentication credentials in the local git config [1][3]. Starting with version v6.0.0, the action was updated to store these credentials under $RUNNER_TEMP rather than directly in the local git configuration, which requires a runner version of at least v2.329.0 for compatibility with Docker container actions [3].
Citations:
- 1: https://github.com/actions/checkout?tab=readme-ov-file
- 2: https://github.com/actions/checkout/blob/main/README.md
- 3: https://github.com/actions/checkout/tree/v6.0.0
- 4: https://github.com/actions/checkout
🌐 Web query:
Zizmor audits artipacked persist-credentials false
💡 Result:
The artipacked audit in zizmor is a security check designed to detect the unintentional persistence of credentials within GitHub Actions workflows, specifically targeting the default behavior of the actions/checkout action [1]. By default, actions/checkout persists authentication credentials (such as the GITHUB_TOKEN) to the runner's filesystem to enable subsequent git operations [2][3]. If a workflow creates artifacts that include the checked-out repository contents, these credentials can be inadvertently exposed or leaked [1][3]. Zizmor flags this behavior and recommends setting persist-credentials: false in your actions/checkout configuration unless those credentials are explicitly required for subsequent git operations [1]. Key aspects of the artipacked audit include: Severity and Versioning: Zizmor adjusts the severity of artipacked findings based on the version of actions/checkout used [1][4]. Since version 6.0.0, actions/checkout stores credentials in a more isolated location ($RUNNER_TEMP) rather than the repository's.git/config, which reduces (though does not eliminate) the risk of leakage [1][4][2]. Consequently, zizmor typically assigns lower severity findings to workflows using actions/checkout@v6 or later [1][4]. Configuration: The audit explicitly looks for the absence of persist-credentials: false within the with: block of the checkout step [1][5]. While zizmor aims for high signal-to-noise, it has received feedback regarding false positives when developers use expressions for this setting or when the workflow's specific permission context (e.g., contents: read) makes persistence less risky, leading to ongoing efforts to refine its precision [6][7][5]. Remediation: The standard remediation suggested by zizmor is to explicitly set persist-credentials: false for any checkout step that does not strictly require persisted git credentials [1]. For workflows that legitimately require git operations (e.g., git push), the finding can be ignored or suppressed based on the project's specific security requirements [7].
Citations:
- 1: https://docs.zizmor.sh/audits/
- 2: https://github.com/actions/checkout
- 3: https://yossarian.net/til/post/actions-checkout-can-leak-github-credentials/
- 4: https://github.com/woodruffw/zizmor/blob/main/crates/zizmor/src/audit/artipacked.rs
- 5: [BUG] False positive detection for artipacked when
persist-credentials: falseis properly set zizmorcore/zizmor#755 - 6: [BUG]: credential persistence through GitHub Actions artifacts zizmorcore/zizmor#290
- 7: feat: Improve precision on artipacked + autofixes zizmorcore/zizmor#1098
🌐 Web query:
site:github.com/zizmorcore/zizmor artifacts zizmor-artifacts leak persisted credentials
💡 Result:
Zizmor is a static analysis tool for GitHub Actions that includes an audit check named artipacked designed to detect risks related to credential persistence and leakage [1][2]. The artipacked check specifically focuses on the default behavior of the actions/checkout action, which persists Git credentials on the runner's local filesystem [3][2]. By default, persist-credentials is set to true [4][2]. If these credentials remain on the disk, subsequent steps in the workflow—such as actions/upload-artifact—may inadvertently archive and upload the entire workspace (including the persisted credentials) as a job artifact [4][2]. If the resulting artifact is publicly accessible or stored in a way that allows unauthorized access, this can lead to the exposure of the credentials [4][2]. To mitigate this risk, zizmor recommends setting persist-credentials to false in your actions/checkout step, unless the credentials are explicitly required for subsequent Git operations [5][2]: - uses: actions/checkout@v4 with: persist-credentials: false Zizmor can identify these vulnerable patterns in workflow definitions and, in many cases, provides an automated fix to apply this configuration [5][4]. The tool is designed to be a static analysis utility, meaning it does not execute code or access runtime state; instead, it inspects workflow and action files to suggest these security improvements [6].
Citations:
- 1: https://github.com/zizmorcore/zizmor
- 2: https://github.com/zizmorcore/zizmor/blob/main/docs/audits.md
- 3: https://github.com/zizmorcore/zizmor/blob/563b7b25/crates/zizmor/src/audit/artipacked.rs
- 4: https://github.com/zizmorcore/zizmor/blob/563b7b25/crates/zizmor/tests/integration/snapshots/integration__e2e__gha_hazmat.snap
- 5: feat: Improve precision on artipacked + autofixes zizmorcore/zizmor#1098
- 6: https://github.com/zizmorcore/zizmor/blob/main/docs/usage.md
Disable checkout credential persistence.
This format job does not need authenticated Git after checkout. actions/checkout persists credentials by default, and this workflow has no subsequent authenticated Git operation that requires them. Set persist-credentials: false in the checkout step.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 41-41: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/lint.yml at line 41, Update the actions/checkout step in
the format job to set persist-credentials to false, leaving the pinned checkout
action reference unchanged.
Source: Linters/SAST tools
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. The agent generated fixes only for
Lines 39–44 runs-on: blacksmith-2vcpu-ubuntu-2404
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
- name: Install Nix
uses: nixbuild/nix-quick-install-action@9f63be77f412a248c9d9a65a4c82cf066cdf8f0c # v35 |
1 participant
Summary
ci-formatdevshell containing only the repository formatting toolsnicknovitski/nix-developas a separate setup stepWhy
The existing Blacksmith job checks only Rust formatting. This applies the fastest repeatable Nix setup measured in xwc while expanding coverage to the Justfile, Nix, Markdown, YAML, TOML, and Rust sources through
just fmt.The native Linux, macOS, and Windows test and release jobs remain unchanged.
Timing
The broader formatting check adds approximately 3.5 seconds at the median. Across the three new samples, installing Nix took 0–1 seconds and entering the devshell took 6–8 seconds.
Validation
nix develop .#ci-format -c just fmtnix flake check --no-build --all-systemsgit diff --check