Enhance verify-action-build.py with deep composite/docker verification#629
Open
Enhance verify-action-build.py with deep composite/docker verification#629
Conversation
…dling The Docker container was hardcoded to node:20-slim, causing large spurious diffs when verifying actions built with a different Node.js version (e.g. azure/setup-helm v5.0.0 which switched to node24). Now detects the Node.js version from the action's action.yml `using:` field before building. Also fix the PR diff extraction regex to match `use:` in addition to `uses:` so that PRs with this common typo (e.g. #491) can still be processed. Generated-by: Claude
Member
Author
|
Example raport before approval: 
|
Member
Author
|
Generated with literally few prompts with Claude and few manual fixes after testing and reviewing code. |
6 tasks
Member
Author
|
Verified two proposed actions - also enhanced action detection so that `--from-pr will properly detect the action from a PR manully adding actions.yaml |
For non-JS actions the script previously just printed "SKIPPED". Now it performs comprehensive analysis: - Recursive nested action inspection (all types, not just composite), with trusted org skip for actions/ and github/ - Dockerfile analysis (base image pinning, suspicious commands) - Script pattern scanning (eval, exec, pipe-to-shell, obfuscation) - Dependency pinning checks (Python requirements, package.json, lock files) - Action metadata analysis (shell injection, GITHUB_ENV writes, secrets) - Repository metadata (license, security policy, well-known org) - Structured verification summary table with nested actions sub-table - Interactive open-in-browser + approve flow after verification - All prompts now support 'q' to quit cleanly - Extract action refs from actions.yml entries in PR diffs (--from-pr) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
potiuk
force-pushed
the
worktree-fix-verify-action-node-version
branch
from
612d6b8 to
b5e34c1
Compare
dave2wave
reviewed
Mar 30, 2026
Member
dave2wave
left a comment
dave2wave
left a comment
There was a problem hiding this comment.
Hard to tell since the current three PRs don't fall completely into the changes. I did notice better workflow.
Member
|
@potiuk it looks this PR has fallen behind. Close, rebase, or recreate? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
using:field (e.g.node20→20) and handleuse:typosactionsandgithuborgs skip deep recursive inspection (still checked for hash-pinning) and are marked as trusted in the summary tableactions,github,google-github-actions,aws-actions,azure,docker,hashicorp,pypa,gradleactions.yml:--from-prand dependabot review now also detect action references from added entries inactions.yml(not just workflowuses:lines), e.g. PR Add lhotari/sandboxed-trivy-action v1.0.1 #582qto quit cleanlyTest plan
pypa/gh-action-pypi-publish@ed0c539...actions/checkout@11bd719...— no regressions--cimode (non-interactive)qquit in interactive prompts--from-pr 582(actions.yml format extraction)--from-pr 618(workflow uses: format extraction)--check-dependabot-prsflowGenerated with Claude Code