Clear the open DevHub findings - #44
Merged
Merged
Conversation
A version tag is mutable. Whoever can push to one of these action repos can move the reference to different code, and our next workflow run picks it up. DevHub flags this as a high-severity unpinned_github_actions violation. ruby/setup-ruby@v1 was the weaker of the two. On that repo v1 is a branch rather than a tag, so it is expected to move and nobody would read a move as suspicious. Its head is v1.321.0, which is what the pin records, so the action does not change. Checkout goes from v3.7.0 to v7.0.1. Nothing here depends on the credential handling that changed in v6: no git commands run after checkout, and submodules: true is a no-op because the repo has no .gitmodules. The cost is that setup-ruby no longer tracks its own updates, so a newer Ruby in the matrix may need a bump here too.
The workflow has no permissions: block, so the job runs with the repository default token scope. zizmor flags this as excessive-permissions (high), and DevHub reports it. Every step only reads the repo: checkout, setup-ruby, then bundle exec rake. Nothing writes back.
Checkout leaves the job token in the workspace git config, so zizmor raises an artipacked finding on each workflow and DevHub reports both. Neither job uses those credentials. The Ruby build only reads. submodules: true is a no-op, since there is no .gitmodules and no gitlink entry in the index. bundler-cache: true makes setup-ruby run bundle install, and the Gemfile has no git sources. The gemspec shells out to git ls-files, which is a local read. The gitleaks scan only execs the gitleaks binary against the local clone. It reaches the GitHub API through the GITHUB_TOKEN we pass in env, not through git.
The scan pinned v6.0.0, one major behind, so DevHub showed it as stale. Both workflows now sit on the same pin. v7's one breaking change does not reach us. It blocks checking out a fork PR head for pull_request_target and workflow_run, and neither workflow uses those triggers. v6.0.0 was also a bad place to sit. GitHub backported that same fork PR block to v6.1.0, so v6.0.0 is the last v6 without the safer default.
meticulesque
approved these changes
Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DevHub reports five zizmor findings for this repo, three high and two medium. This clears all five.