Secure defaults for GitHub Actions suggestions in The Cargo Book
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Documentation
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- github-actions
- Domain
- ci-cd, documentation
Research direction
Read the three Continuous Integration sections linked in the issue and locate each example workflow using actions/checkout@v4. Update the examples to use at least actions/checkout@v6, and review the proposed workflows with zizmor where possible. Done means all referenced GitHub Actions examples use the safer checkout default.
Written by the indexing model from the issue text.
Description
Problem
There are example workflows provided in several places in The Cargo Book, such as:
- https://doc.rust-lang.org/cargo/guide/continuous-integration.html#github-actions
- https://doc.rust-lang.org/cargo/guide/continuous-integration.html#verifying-latest-dependencies
- https://doc.rust-lang.org/cargo/guide/continuous-integration.html#verifying-rust-version
These all use actions/checkout@v4. I'd suggest increasing this to at least actions/checkout@v6, as the checkout action was made more misuse-resistant (specifically with regards to ARTIPACKED) as of v6.
I think this change is worth making because defaults are important, and many people will just copy the workflows as-is and think nothing more of it.
Proposed Solution
I'd suggest increasing this to at least actions/checkout@v6, as the checkout action was made more misuse-resistant (specifically with regards to ARTIPACKED) as of v6.
In general, I'd advocate for using zizmor when possible to make proposed workflows more secure whenever possible.
Notes
I am not affiliated with zizmor, I just think it is a good tool.
- Dominant language
- Rust
- Stars
- 15.5k
- Forks
- 3k
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 55
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from rust-lang/cargo
-
C-bug S-triage
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
A-completions C-bug S-triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
C-bug S-triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Command-fix
Difficulty 1/5 Under an hour Newbie friendliness 82/100
-
cargo remove prints "Removing X" for dependencies that never get removed when the command fails OpenC-bug Command-remove S-triage
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
gitbutlerapp/gitbutler#15998 · 1 comment ·
-
bug triage:deciding
Difficulty 1/5 Under an hour Newbie friendliness 88/100
open-telemetry/otel-arrow#4132 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100