-
Notifications
You must be signed in to change notification settings - Fork 1
fix: restrict package publishing to main #37
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
+23
−18
Merged
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: reserve-protocol/dtf-interface
Length of output: 1221
🌐 Web query:
reserve-protocol/dtf-interface .github/workflows/publish.yml changesets/action v1 authentication checkout v6 persist-credentials💡 Result:
The.github/workflows/publish.yml file in the reserve-protocol/dtf-interface repository utilizes several GitHub Actions to automate the release process [1][2][3]. Regarding the specific components of your query: 1. changesets/action v1: This action is used to automate versioning and publishing [1][4]. As of early 2026, version 1.x is maintained for compatibility with Changesets v2 [5][4]. Recent updates (such as v1.7.0) have improved authentication handling by automatically using the GitHub-provided token by default, allowing most users to omit explicit GITHUB_TOKEN configuration [6][7]. When custom tokens are required, they can be passed via the github-token input [5][4]. 2. actions/checkout v6: This version introduced an updated approach to credential security where authentication tokens are stored in a separate file under $RUNNER_TEMP rather than directly in the local.git/config [8][9]. The persist-credentials input defaults to true, which configures the token or SSH key with the local git config (or the new secure storage mechanism in v6) to enable authenticated git commands [8][10][11]. Users can set persist-credentials: false to opt out of this behavior [8][10]. 3. Note on Docker Container Actions: There are documented reports that the v6 credential mechanism (persist-credentials: true) may face compatibility issues when used within Docker container actions, as the credentials stored in $RUNNER_TEMP are not automatically accessible inside the container environment [12]. Users encountering this may need to manually map the temporary directory or adjust their workflow configuration [12].
Citations:
🌐 Web query:
site:github.com/reserve-protocol/dtf-interface/blob .github/workflows/publish.yml "changesets/action@v1" "pnpm release:ci"💡 Result:
The configuration you mentioned, including.github/workflows/publish.yml, changesets/action@v1, and a pnpm command like release:ci, is a common pattern used in monorepo projects to automate package publishing with Changesets [1][2]. The changesets/action@v1 is a GitHub Action designed to automate the release process by managing version bumps and changelog generation [1][2]. In a workflow file, the publish input for this action defines the command used to actually publish the packages to a registry (such as npm) [1][2]. When using this action in a pnpm monorepo: 1. Workflow Setup: The.github/workflows/publish.yml file typically checks out the code, sets up Node.js, and installs dependencies using pnpm [1][2]. 2. Publish Command: The changesets/action is configured with the publish parameter [1][2]. While your prompt mentions pnpm release:ci, the action often executes a command that runs the release process [1][2]. In many configurations, this command might be defined in the package.json scripts (e.g., "release": "changeset publish") [1][2]. 3. Execution: If your project uses pnpm release:ci, this command is likely a custom script defined in your package.json that aggregates tasks such as building, testing, and ultimately publishing via changesets [3]. To implement this, ensure your publish command in the GitHub Action is mapped correctly to the script that performs the publish operation [1][2]. If release:ci is the intended script, you would set: - name: Changeset Release uses: changesets/action@v1 with: publish: pnpm release:ci env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} This setup ensures that when changes are pushed to your main branch, the action checks for new changesets, generates a PR if necessary, or publishes if a release PR has been merged [1][2].
Citations:
🌐 Web query:
site:github.com/changesets/action README github-token default GITHUB_TOKEN publish command💡 Result:
When using the
changesets/actionto publish packages, the action provides agithub-tokeninput that defaults to the GitHub-providedGITHUB_TOKEN[1][2]. You generally do not need to configure this manually unless you require specific custom token behavior [2][3]. Key technical details regarding theGITHUB_TOKENand publishing command include: Default Configuration: Thegithub-tokeninput is defined in the action's configuration and defaults to${{ github.token }}[1][3]. This allows the action to authenticate with the repository automatically without requiring you to manually passGITHUB_TOKENin the environment variables [2][3]. Permissions: If you rely on the defaultGITHUB_TOKEN, your workflow job must have the necessary permissions granted. Typically, this requires setting the following at the job level [4][5]: permissions: contents: write pull-requests: write Publish Command: Thepublishinput inchangesets/actiondefines the command used to build and publish your packages (e.g.,pnpm publishornpm run release) [1][2][6]. The action automatically exposes the configuredgithub-tokenas an environment variable (GITHUB_TOKEN) to this command execution context [3]. Custom Tokens and Triggering Workflows: If you need the publishing process to trigger subsequent workflows (which the defaultGITHUB_TOKENexplicitly does not do to prevent recursive loops), you must use a personal access token (PAT) [7][8]. In this case, pass your custom token to thegithub-tokeninput [2]: with: github-token: ${{ secrets.YOUR_CUSTOM_PAT }} Important Note: SettingGITHUB_TOKENas an environment variable in the workflow step does not configure the action itself; for custom tokens, you must use thegithub-tokeninput explicitly [2].Citations:
🌐 Web query:
site:github.com/actions/checkout README persist-credentials true v6 RUNNER_TEMP💡 Result:
Starting with version 6 (v6) of the actions/checkout GitHub Action, the behavior of the persist-credentials input was updated to improve security [1][2][3]. Instead of writing credentials directly into the local.git/config file, the action now stores them in a separate file located under $RUNNER_TEMP [1][4][2]. This change utilizes Git's includeIf mechanism to conditionally include these credentials only when necessary [3]. Key details regarding this change: - Security Improvement: By isolating credentials from the main Git configuration, this approach enhances security [3]. - Compatibility: No changes are required in your workflow YAML files, as standard commands like git fetch and git push will continue to function automatically [1][4][5]. - Runner Requirement: If you are running authenticated Git commands from a Docker container action, you must use Actions Runner version 2.329.0 or later to ensure the runner can access the credentials stored in $RUNNER_TEMP [1][2][3]. - Opt-out: You can still disable this behavior entirely by setting persist-credentials: false in your workflow configuration [1][4][5].
Citations:
Disable checkout credential persistence.
actions/checkout@v6persists a credential by default. Laterpnpm installor release scripts can use it for authenticated Git operations, and this job hascontents: write. Setpersist-credentials: false. Letchangesets/action@v1use its scopedgithub-tokeninput, which defaults to${{ github.token }}.🧰 Tools
🪛 zizmor (1.29.0)
[warning] 22-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Sources: MCP tools, Linters/SAST tools