Skip to content

ci: run streamflow-sdk library unit tests on push and PR #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
auroraxo wants to merge 1 commit into from
Closed

ci: run streamflow-sdk library unit tests on push and PR #7

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
name: CI

on:
push:
branches: [main]
pull_request:

env:
CARGO_TERM_COLOR: always

jobs:
test:
name: cargo test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

@aikido-pr-checks aikido-pr-checks Bot Oct 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GitHub Action actions/checkout persist Git credentials in workflow - low severity
This actions/checkout step relies on the action's default persist-credentials behavior (true) instead of explicitly configuring it. With that unsafe default, actions/checkout v2 and above persists the GITHUB_TOKEN in the repository's local git config (or, on more recent versions, in a file under $RUNNER_TEMP) for the rest of the workflow run. Subsequent workflow steps or third-party actions can read this token, increasing the risk of credential theft or misuse within the pipeline. This finding is only raised when the step relies on the implicit default; a step that explicitly sets persist-credentials: true because the workflow performs an authenticated git push is not flagged.

Show fix

Remediation: Explicitly set persist-credentials: false on actions/checkout steps that do not need to push commits back to the repository, rather than relying on the unsafe default. If the workflow does perform an authenticated git push, explicitly set persist-credentials: true so the intent is documented and this step won't be re-flagged.

Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info

- name: Install stable toolchain
run: |
rustup update --no-self-update stable
rustup default stable
rustc --version
- name: Cache cargo registry & target
uses: actions/cache@v5
with:
path: |
~/.cargo/registry
~/.cargo/git
target
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
restore-keys: |
${{ runner.os }}-cargo-
- name: Library unit tests
run: cargo test -p streamflow-sdk --lib