Chore: [AEA-0000] - make action more secure#8
Conversation
|
This PR is linked to a ticket in an NHS Digital JIRA Project. Here's a handy link to the ticket: AEA-0000 |
There was a problem hiding this comment.
Pull request overview
This PR hardens the repository’s GitHub Action and workflows by reducing credential persistence and limiting secret propagation between reusable workflows.
Changes:
- Disable credential persistence for
actions/checkoutin the composite action (persist-credentials: false). - Stop inheriting all caller secrets into the
tag_releasereusable workflow jobs. - Update the devcontainer base image version and remove the
postAttachCommandthat configuredgit-secrets.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
action.yml |
Prevents checkout from persisting credentials in the workspace. |
.github/workflows/release.yml |
Removes secrets: inherit from the reusable workflow invocation. |
.github/workflows/pull_request.yml |
Removes secrets: inherit from the reusable workflow invocation. |
.github/workflows/ci.yml |
Removes secrets: inherit from the reusable workflow invocation. |
.devcontainer/devcontainer.json |
Bumps devcontainer image version and removes git-secrets registration on attach. |
| "USER_GID": "${localEnv:GROUP_ID:}" | ||
| }, | ||
| "updateRemoteUserUID": false | ||
| }, |
There was a problem hiding this comment.
The postAttachCommand that registers git-secrets has been removed, and there doesn’t appear to be any other git-secrets setup in the repo. If the intention is still to have local secret scanning in the devcontainer, please add an equivalent hook elsewhere (e.g., postCreateCommand) or document that this is now handled in the base image; otherwise this change effectively drops that safeguard.
| }, | |
| }, | |
| "postCreateCommand": "if command -v git-secrets >/dev/null 2>&1; then git secrets --install -f && git secrets --register-aws; else echo 'WARNING: git-secrets is not installed in this devcontainer image; local secret scanning hooks were not configured.'; fi", |
Summary
Details