Skip to content

ci: check project formatting with Nix #468

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
robjtede merged 4 commits into from
Aug 2, 2026
Merged

ci: check project formatting with Nix #468

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
65dc7b4
ci: check project formatting with Nix
robjtede Aug 2, 2026
35281a3
ci: collect repeat timing sample
robjtede Aug 2, 2026
f65d51e
ci: collect repeat timing sample
robjtede Aug 2, 2026
019d46d
ci: name formatting job consistently
robjtede Aug 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 14 additions & 3 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,19 +35,30 @@ jobs:
- name: Check with Clippy
run: just clippy

rustfmt:
format:
runs-on: blacksmith-2vcpu-ubuntu-2404

@coderabbitai coderabbitai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C 2 'blacksmith-2vcpu-ubuntu-2404' \
  .github/workflows/lint.yml actionlint.yaml 2>/dev/null || true

Repository: x52dev/inspect-cert-chain

Length of output: 983

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Workflows and actionlint config files:\n'
git ls-files '.github/workflows/*' 'actionlint.yaml' 'actionlint.yml' 'actionlint.json' 2>/dev/null || true

printf '\nRelevant workflow runner labels:\n'
rg -n 'runs-on:|blacksmith' .github/workflows || true

printf '\nActionlint config existence and content:\n'
for f in actionlint.yaml actionlint.yml actionlint.json .github/actionlint.yaml .github/actionlint.yml .github/actionlint.json; do
  [ -f "$f" ] && { printf '\n== %s ==\n' "$f"; cat -n "$f"; }
done

Repository: x52dev/inspect-cert-chain

Length of output: 860

🌐 Web query:

GitHub actionlint unknown runner label actionlint.yaml

💡 Result:

The "unknown runner label" error in actionlint occurs when a workflow uses a runs-on label that is not part of the standard, GitHub-hosted runner set [1][2]. This commonly happens when using custom, self-hosted runner labels [3][4]. To resolve this, you must explicitly declare your custom runner labels in an actionlint.yaml configuration file within your repository's .github directory [5][1]. Configuration Steps: 1. Create or update the configuration file: .github/actionlint.yaml [5]. 2. Add the self-hosted-runner section and list your custom labels under labels [5]: yaml # .github/actionlint.yaml self-hosted-runner: labels: - your-custom-label-1 - your-custom-label-2 Alternatively, you can generate a default configuration file automatically by running [5]: actionlint -init-config If you prefer to suppress these warnings without declaring labels, you can use the -ignore flag when running actionlint [3][6]: actionlint -ignore 'label ".+" is unknown' For more advanced configuration, glob patterns are supported in the labels list if you need to match multiple similar labels [5].

Citations:

Declare the custom runner label for actionlint.

blacksmith-2vcpu-ubuntu-2404 is not a documented hosted runner label. If this is a self-hosted runner label, add it to .github/actionlint.yaml under self-hosted-runner.labels; otherwise, switch the jobs to a supported runner label.

🧰 Tools
🪛 actionlint (1.7.12)

[error] 39-39: label "blacksmith-2vcpu-ubuntu-2404" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2025-vs2026", "windows-2022", "windows-11-arm", "ubuntu-slim", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xlarge", "macos-latest-large", "macos-26-intel", "macos-26-xlarge", "macos-26-large", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xlarge", "macos-14-large", "macos-14", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file

(runner-label)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/lint.yml at line 39, Update the runs-on configuration
using the blacksmith-2vcpu-ubuntu-2404 label: declare it under
self-hosted-runner.labels in .github/actionlint.yaml if it is an intended
self-hosted label, otherwise replace it with a supported hosted runner label.

Source: Linters/SAST tools

steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

@coderabbitai coderabbitai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C 4 \
  'pull_request|pull_request_target|actions/checkout|persist-credentials|permissions|git (fetch|push)' \
  .github/workflows/lint.yml

Repository: x52dev/inspect-cert-chain

Length of output: 1363

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Workflow trigger and job summary:"
sed -n '1,120p' .github/workflows/lint.yml

echo
echo "Subsequent steps in format job with relevant git/authentication commands:"
python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/lint.yml')
text=p.read_text()
lines=text.splitlines()
in_format=False
indent=0
for i,line in enumerate(lines,1):
    if i==38: in_format=True; indent=2
    if in_format:
        if line.startswith('  docs:') or (line.startswith('jobs:') and i<38): continue
        if line.startswith(' ') and len(line)-len(line.lstrip()) <= indent:
            if i>38:
                in_format=False
        if in_format:
            print(f"{i}: {line}")
PY

echo
echo "Files mentioning Justfile and zizmor:"
rg -n 'Justfile|zizmor|artipacked|pull_request_target|pull_request:' .

Repository: x52dev/inspect-cert-chain

Length of output: 3835

🌐 Web query:

actions/checkout persist-credentials default true README

💡 Result:

In the actions/checkout GitHub Action, the persist-credentials input controls whether the authentication token or SSH key used for checking out the repository is configured in the local git configuration [1][2]. Key details include: Default behavior: The default value for persist-credentials is true [1][3]. Purpose: When enabled (true), it allows your workflow scripts to run authenticated git commands (such as git push or git pull) without needing to manually re-authenticate [1][2]. Cleanup: The action automatically removes these credentials during the post-job cleanup phase [1][4]. Opting out: You can set persist-credentials: false if you do not want the action to store the authentication credentials in the local git config [1][3]. Starting with version v6.0.0, the action was updated to store these credentials under $RUNNER_TEMP rather than directly in the local git configuration, which requires a runner version of at least v2.329.0 for compatibility with Docker container actions [3].

Citations:

🌐 Web query:

Zizmor audits artipacked persist-credentials false

💡 Result:

The artipacked audit in zizmor is a security check designed to detect the unintentional persistence of credentials within GitHub Actions workflows, specifically targeting the default behavior of the actions/checkout action [1]. By default, actions/checkout persists authentication credentials (such as the GITHUB_TOKEN) to the runner's filesystem to enable subsequent git operations [2][3]. If a workflow creates artifacts that include the checked-out repository contents, these credentials can be inadvertently exposed or leaked [1][3]. Zizmor flags this behavior and recommends setting persist-credentials: false in your actions/checkout configuration unless those credentials are explicitly required for subsequent git operations [1]. Key aspects of the artipacked audit include: Severity and Versioning: Zizmor adjusts the severity of artipacked findings based on the version of actions/checkout used [1][4]. Since version 6.0.0, actions/checkout stores credentials in a more isolated location ($RUNNER_TEMP) rather than the repository's.git/config, which reduces (though does not eliminate) the risk of leakage [1][4][2]. Consequently, zizmor typically assigns lower severity findings to workflows using actions/checkout@v6 or later [1][4]. Configuration: The audit explicitly looks for the absence of persist-credentials: false within the with: block of the checkout step [1][5]. While zizmor aims for high signal-to-noise, it has received feedback regarding false positives when developers use expressions for this setting or when the workflow's specific permission context (e.g., contents: read) makes persistence less risky, leading to ongoing efforts to refine its precision [6][7][5]. Remediation: The standard remediation suggested by zizmor is to explicitly set persist-credentials: false for any checkout step that does not strictly require persisted git credentials [1]. For workflows that legitimately require git operations (e.g., git push), the finding can be ignored or suppressed based on the project's specific security requirements [7].

Citations:

🌐 Web query:

site:github.com/zizmorcore/zizmor artifacts zizmor-artifacts leak persisted credentials

💡 Result:

Zizmor is a static analysis tool for GitHub Actions that includes an audit check named artipacked designed to detect risks related to credential persistence and leakage [1][2]. The artipacked check specifically focuses on the default behavior of the actions/checkout action, which persists Git credentials on the runner's local filesystem [3][2]. By default, persist-credentials is set to true [4][2]. If these credentials remain on the disk, subsequent steps in the workflow—such as actions/upload-artifact—may inadvertently archive and upload the entire workspace (including the persisted credentials) as a job artifact [4][2]. If the resulting artifact is publicly accessible or stored in a way that allows unauthorized access, this can lead to the exposure of the credentials [4][2]. To mitigate this risk, zizmor recommends setting persist-credentials to false in your actions/checkout step, unless the credentials are explicitly required for subsequent Git operations [5][2]: - uses: actions/checkout@v4 with: persist-credentials: false Zizmor can identify these vulnerable patterns in workflow definitions and, in many cases, provides an automated fix to apply this configuration [5][4]. The tool is designed to be a static analysis utility, meaning it does not execute code or access runtime state; instead, it inspects workflow and action files to suggest these security improvements [6].

Citations:

Disable checkout credential persistence.

This format job does not need authenticated Git after checkout. actions/checkout persists credentials by default, and this workflow has no subsequent authenticated Git operation that requires them. Set persist-credentials: false in the checkout step.

🧰 Tools
🪛 zizmor (1.28.0)

[warning] 41-41: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/lint.yml at line 41, Update the actions/checkout step in
the format job to set persist-credentials to false, leaving the pinned checkout
action reference unchanged.

Source: Linters/SAST tools


- name: Install Nix
uses: nixbuild/nix-quick-install-action@9f63be77f412a248c9d9a65a4c82cf066cdf8f0c # v35

- name: Install Rust (nightly)
uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
with:
toolchain: nightly
components: rustfmt

- name: Check with Rustfmt
run: cargo fmt -- --check
- name: Enter Nix devshell
uses: nicknovitski/nix-develop@9be7cfb4b10451d3390a75dc18ad0465bed4932a # v1.2.1
with:
arguments: .#ci-format

- name: Format project
run: just fmt

- name: Check formatting diff
run: git diff --exit-code

docs:
runs-on: blacksmith-2vcpu-ubuntu-2404
Expand Down
10 changes: 10 additions & 0 deletions flake.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,16 @@
doCheck = true;
};

devShells.ci-format = pkgs.mkShell {
packages = [
config.formatter
pkgs.fd
pkgs.just
pkgs.prettier
pkgs.taplo
];
};

devShells.default = pkgs.mkShell {
buildInputs = [ x52just ];

Expand Down
Loading