ImplicitPersistCredentials and GlobalPermissionsBlock #12

6f6d6172 · 2026-01-02T23:02:07Z

Backfilling two rules. Normally I'd do separate PRs for each rule, but they're both small enough that I don't think it'll be an issue to review.

ImplicitPersistCredentials: Flags uses of actions/checkout where persist-credentials is not explicitly set. Not setting it means we fall back to the default value of true (valid for versions v2 to v6 (current at the time)). This will cause the action to write these temporary credentials to ~/.git/config or a temporary directory, where it can be found by malicious code and used by an attacker from an external system to gain access to the repository being cloned or even other repositories.
GlobalPermissionsBlock: Following least privileges, each job should explicitly list out the permissions it needs to do its work. A set of permissions configured at the workflow level means they will apply to all jobs, even jobs that might not actually need all of those permissions.

/task https://betterconfluence.atlassian.net/browse/SEC-385
/task https://betterconfluence.atlassian.net/browse/SEC-390

Both of these flagged behaviors are unfortunately pretty common, so we will need to be particular about the upgrade process here.

Copilot

Pull request overview

This PR adds two new security-focused rules for GitHub Actions workflows to help prevent credential leakage and over-permissioned jobs. Both rules address common security issues in CI/CD pipelines that could be exploited during supply chain attacks.

Adds ImplicitPersistCredentials rule to flag actions/checkout usage without explicit persist-credentials setting
Adds GlobalPermissionsBlock rule to flag workflow-level permissions when multiple jobs exist
Introduces a new dig helper function for traversing nested objects in rule expressions

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
lib/claws/rule/implicit_persist_credentials.rb	Implements the ImplicitPersistCredentials rule using expression-based step checking
lib/claws/rule/global_permissions_block.rb	Implements the GlobalPermissionsBlock rule using custom workflow-level validation
spec/claws/rule/implicit_persist_credentials_spec.rb	Adds test coverage for the ImplicitPersistCredentials rule with positive and negative cases
spec/claws/rule/global_permissions_block_spec.rb	Adds test coverage for the GlobalPermissionsBlock rule with various job configurations
lib/claws/base_rule.rb	Adds the `dig` helper function and updates rubocop suppressions for complexity metrics
lib/claws/rule.rb	Registers the two new rules for loading
README.md	Documents both new rules with examples and security rationale

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

lib/claws/base_rule.rb

spec/claws/rule/implicit_persist_credentials_spec.rb

spec/claws/rule/global_permissions_block_spec.rb

README.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 8 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

spec/claws/rule/global_permissions_block_spec.rb

README.md

Copilot · 2026-01-02T23:19:06Z

spec/claws/rule/implicit_persist_credentials_spec.rb

+  end
+end


The test suite is missing a test case for when persist-credentials is explicitly set to true. According to the documentation, explicitly setting it to true (when needed) is also a valid way to satisfy this rule. Add a test case to verify that persist-credentials: true does not trigger a violation.

spec/claws/rule/implicit_persist_credentials_spec.rb

6f6d6172 · 2026-01-02T23:19:12Z

/task https://betterconfluence.atlassian.net/browse/SEC-411

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

spec/claws/rule/implicit_persist_credentials_spec.rb

Copilot · 2026-01-05T18:24:24Z

spec/claws/rule/implicit_persist_credentials_spec.rb

+      YAML
+
+      expect(violations.count).to eq(1)
+      expect(violations[0].line).to eq(8)


The line number expectation appears incorrect. Looking at the YAML structure, the uses: actions/checkout@v6 statement is on line 76 of the YAML, but the test expects the violation to be on line 8. This seems to be checking the wrong line number - should verify the line numbering matches where the violation actually occurs.

spec/claws/rule/global_permissions_block_spec.rb

lib/claws/rule/global_permissions_block.rb

spec/claws/rule/implicit_persist_credentials_spec.rb

lib/claws/base_rule.rb

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-05T18:48:31Z

README.md

+
+### GlobalPermissionsBlock
+
+[The permissions block](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions) dictates which permissions a workflow or a job have or don't have. When permissions are defined at the workflow level, each job gets the same set of permissions, potentially giving more access than a job or a step truly needs. Instead, permissions should be defined at the job level, making sure each job and step has access only to the permissions it needs. This can minimize the impact of untrusted code using an overly permissive `$GITHUB_TOKEN`, such as during a supply chain attack.


The documentation URL appears to use an older or incorrect path structure. Based on other GitHub Actions documentation links in this file (e.g., line 304), the URL should likely be https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#permissions instead of using the /actions/reference/workflows-and-actions/ path.

Suggested change

[The permissions block](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions) dictates which permissions a workflow or a job have or don't have. When permissions are defined at the workflow level, each job gets the same set of permissions, potentially giving more access than a job or a step truly needs. Instead, permissions should be defined at the job level, making sure each job and step has access only to the permissions it needs. This can minimize the impact of untrusted code using an overly permissive `$GITHUB_TOKEN`, such as during a supply chain attack.

[The permissions block](https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#permissions) dictates which permissions a workflow or a job have or don't have. When permissions are defined at the workflow level, each job gets the same set of permissions, potentially giving more access than a job or a step truly needs. Instead, permissions should be defined at the job level, making sure each job and step has access only to the permissions it needs. This can minimize the impact of untrusted code using an overly permissive `$GITHUB_TOKEN`, such as during a supply chain attack.

the suggested url literally redirects to my url. what r u doin

README.md

btrautmann

This is awesome! Very clean PR, easy to review/follow

domain lgtm

rdadlani

well explained, well documented. tests make it really clear what's happening. love it. domain lgtm. 💪 nice work.

6f6d6172 · 2026-01-06T18:24:54Z

/no-platform

6f6d6172 added 4 commits January 2, 2026 16:07

dig helper function for attributes/keys with special characters

9034c5b

implicit persist credentials

1de0f66

global permissions block rule

266636a

ImplicitPersistCredentials and GlobalPermissionsBlock docs

3ddc503

6f6d6172 requested a review from Copilot January 2, 2026 23:02

Copilot started reviewing on behalf of 6f6d6172 January 2, 2026 23:02 View session

Copilot AI reviewed Jan 2, 2026

View reviewed changes

6f6d6172 and others added 2 commits January 2, 2026 18:08

workflow syntax fix

c95bc6b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

return default when working with hashes too

6697923

6f6d6172 requested a review from Copilot January 2, 2026 23:14

Copilot started reviewing on behalf of 6f6d6172 January 2, 2026 23:14 View session

Copilot AI reviewed Jan 2, 2026

View reviewed changes

6f6d6172 added 3 commits January 5, 2026 13:14

v4 -> v6 just to appease the robot

c963421

test case for default global permissions

473e0da

additional test case for different values of persist-credentials

a95da7a

6f6d6172 requested a review from Copilot January 5, 2026 18:20

Copilot started reviewing on behalf of 6f6d6172 January 5, 2026 18:20 View session

Copilot AI reviewed Jan 5, 2026

View reviewed changes

6f6d6172 added 2 commits January 5, 2026 13:36

alright you got me there

fbd1cfd

forgot how kw args work for a sec

d5c0d7c

6f6d6172 requested a review from Copilot January 5, 2026 18:42

Copilot started reviewing on behalf of 6f6d6172 January 5, 2026 18:42 View session

Copilot AI reviewed Jan 5, 2026

View reviewed changes

btrautmann approved these changes Jan 6, 2026

View reviewed changes

rdadlani approved these changes Jan 6, 2026

View reviewed changes

6f6d6172 merged commit cb534e2 into main Jan 6, 2026
11 checks passed


		### GlobalPermissionsBlock

		[The permissions block](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions) dictates which permissions a workflow or a job have or don't have. When permissions are defined at the workflow level, each job gets the same set of permissions, potentially giving more access than a job or a step truly needs. Instead, permissions should be defined at the job level, making sure each job and step has access only to the permissions it needs. This can minimize the impact of untrusted code using an overly permissive `$GITHUB_TOKEN`, such as during a supply chain attack.

ImplicitPersistCredentials and GlobalPermissionsBlock #12

ImplicitPersistCredentials and GlobalPermissionsBlock #12

Uh oh!

Conversation

6f6d6172 commented Jan 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Jan 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

6f6d6172 commented Jan 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

6f6d6172 Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

6f6d6172 Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

btrautmann left a comment

Choose a reason for hiding this comment

Uh oh!

rdadlani left a comment

Choose a reason for hiding this comment

Uh oh!

6f6d6172 commented Jan 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants