Skip to content

chore: enforce semantic pr #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
smnatale wants to merge 2 commits into from
Closed

chore: enforce semantic pr #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c0c5cd5
enforce semantic pr
smnatale Apr 14, 2026
62f740a
minor tweak
smnatale Apr 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions .github/PULL_REQUEST_TEMPLATE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
## Description


Add description here

## Screenshots/Images

Add images here

31 changes: 31 additions & 0 deletions .github/workflows/semantic-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
name: Semantic PR

on:
pull_request:
branches: [main]

permissions:
pull-requests: read

jobs:
semantic-pr:
runs-on: ubuntu-latest
steps:
- uses: amannn/action-semantic-pull-request@v5
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Comment on lines +14 to +16
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "1) Find mutable action refs in workflows (tags like `@v5`):"
rg -n --glob '.github/workflows/*.yml' 'uses:\s*[^@]+@v?[0-9]+(\.[0-9]+)?$'

echo
echo "2) Resolve current object behind amannn/action-semantic-pull-request@v5:"
curl -fsSL https://api.github.com/repos/amannn/action-semantic-pull-request/git/ref/tags/v5 | jq -r '.object | "type=\(.type) sha=\(.sha)"'

echo
echo "If type=tag, resolve that tag object to the commit SHA before pinning."

Repository: smnatale/coderabbit.nvim

Length of output: 291

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Exploring repository structure ==="
ls -la .github/ 2>/dev/null || echo ".github/ not found"

echo
echo "=== Check if .github/workflows/ exists ==="
ls -la .github/workflows/ 2>/dev/null || echo ".github/workflows/ not found"

echo
echo "=== List all files in the repository to understand structure ==="
git ls-files | head -30

Repository: smnatale/coderabbit.nvim

Length of output: 1568

🏁 Script executed:

#!/bin/bash
cat -n .github/workflows/semantic-pr.yml

Repository: smnatale/coderabbit.nvim

Length of output: 981

🌐 Web query:

GitHub Actions security best practices mutable action tags pull_request_target

💡 Result:

GitHub Actions security best practices for mutable action tags and pull_request_target focus on preventing supply chain attacks and remote code execution (RCE). Key practices: 1. Pin actions to full-length commit SHAs for immutability: Avoid tags like @v1 or branches like @main, as they are mutable and can be hijacked. Use specific SHAs, e.g., uses: tj-actions/changed-files@abcdef1. This is the only way to ensure immutability. 2. For pull_request_target: Use only when necessary (e.g., labeling PRs needing write access). Never checkout untrusted PR code with actions/checkout using ref: ${{ github.event.pull_request.head.sha }}. This grants RCE with access to secrets and GITHUB_TOKEN (read/write by default). Instead, use pull_request for builds/tests (limited permissions), then workflow_run for privileged follow-ups after approval. 3. Additional mitigations: - Set explicit permissions: {contents: read} or job-level restrictions; default to read-only. - Avoid saving caches or artifacts in pull_request_target to prevent poisoning. - Require manual approval (e.g., 'safe to test' label) or restrict to same-repo PRs: if: github.event.pull_request.head.repo.full_name == github.repository. - Use verified creators from Marketplace; review/fork third-party actions. - Enable GitHub features: Dependabot for updates, CodeQL for scanning workflows, action allowlists. Recent changes (effective Dec 2025): pull_request_target always uses default branch for workflow source/ref, aligning with security model. Examples: Safe pull_request_target (labeling): on: pull_request_target permissions: pull-requests: write steps: - uses: actions/labeler@v4 # No checkout of PR head Unsafe (avoid): on: pull_request_target steps: - checkout: ref: ${{ github.event.pull_request.head.sha }} - run: npm install # Executes untrusted code with secrets

Citations:

Pin the third-party action to an immutable commit SHA.

This workflow uses pull_request_target (line 4), a privileged event that executes with access to secrets and tokens. The action reference on line 14 uses the mutable semantic version tag @v5, which could be compromised if the upstream maintainer's account is hijacked or a tag is force-pushed. Pin the action to a specific commit SHA for immutability and supply-chain security.

Suggested change 
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@<FULL_COMMIT_SHA> # v5

To find the commit SHA for v5, run: curl -s https://api.github.com/repos/amannn/action-semantic-pull-request/git/ref/tags/v5 | jq '.object.sha'

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/semantic-pr.yml around lines 14 - 16, The workflow
currently references the third-party action as
amannn/action-semantic-pull-request@v5 (in the uses: line), which is mutable;
replace the tag with the corresponding immutable commit SHA for the v5 release
(e.g., amannn/action-semantic-pull-request@<commit-sha>) so the action is
pinned, and update the uses: entry accordingly; locate the uses:
amannn/action-semantic-pull-request@v5 string in the workflow and swap the tag
for the commit SHA obtained from the repo (ensure no other references to `@v5`
remain).

with:
types: |
feat
fix
chore
docs
test
refactor
ci
perf
requireScope: false
subjectPattern: ^[a-z].+$
subjectPatternError: |
The subject "{subject}" found in the pull request title "{title}"
must start with a lowercase letter.
Loading