Skip to content

Update framework workflow: Use default token #1087

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
swissspidy merged 1 commit into from
Jul 21, 2026
+3 −4
Merged

Update framework workflow: Use default token #1087

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions .github/workflows/update-framework.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ concurrency:

permissions:
contents: write
issues: read
pull-requests: write

jobs:
Expand All @@ -30,7 +29,7 @@ jobs:
- name: Check out source code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
token: ${{ secrets.ACTIONS_BOT }}
token: ${{ secrets.GITHUB_TOKEN }}

@coderabbitai coderabbitai Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Map the workflow file and inspect the relevant range with line numbers.
wc -l .github/workflows/update-framework.yml
sed -n '1,220p' .github/workflows/update-framework.yml | cat -n

# Also search for any later git/auth/push steps in this workflow.
rg -n "actions/checkout|persist-credentials|composer|gh auth|git push|GITHUB_TOKEN|GH_TOKEN" .github/workflows/update-framework.yml

Repository: wp-cli/wp-cli-bundle

Length of output: 4895

Do not persist the checkout token.
actions/checkout writes the token into .git/config by default, and the later Composer steps can access it through scripts/plugins. Set persist-credentials: false here and authenticate Git only right before git push.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 29-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/update-framework.yml at line 32, Update the
actions/checkout configuration to set persist-credentials to false, then
authenticate Git immediately before the git push step using the existing
checkout token. Ensure later Composer steps cannot access persisted checkout
credentials while preserving push authentication.

Source: Linters/SAST tools


- name: Set up PHP environment
uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
Expand Down Expand Up @@ -58,7 +57,7 @@ jobs:

- name: Commit and Create Pull Request
env:
GH_TOKEN: ${{ secrets.ACTIONS_BOT }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
PR_BODY: |
**This is an automated pull-request**
Expand All @@ -74,7 +73,7 @@ jobs:

git push -f origin update-framework

PR_NUMBER=$(gh api --method GET "repos/${{ github.repository }}/pulls" -f head="${{ github.repository_owner }}:update-framework" -f base="$DEFAULT_BRANCH" -f state="open" --jq '.[0].number // empty')
PR_NUMBER=$(gh pr list --head "update-framework" --base "$DEFAULT_BRANCH" --state open --json number --jq '.[0].number // empty')
if [ -z "$PR_NUMBER" ]; then
gh pr create \
--title "Update wp-cli framework" \
Expand Down
Loading