🔒 Aisle Security Analysis

We found 2 potential security issue(s) in this PR:

1. 🟡 GitHub Action dependency not pinned to commit SHA (oven-sh/setup-bun)

Description

The composite action .github/actions/setup-node-env/action.yml uses a third-party GitHub Action by mutable tag rather than pinning to an immutable commit SHA.

• The uses: oven-sh/setup-bun@​v2.2.0 reference can be retagged upstream (intentionally or after compromise)
• If retagged, CI would execute attacker-controlled code with the workflow's token/permissions and runner environment
• The change updates the tag from v2.1.3 to v2.2.0 but still does not pin to a specific commit digest

Vulnerable code:

- name: Setup Bun
  if: inputs.install-bun == 'true'
  uses: oven-sh/setup-bun@​v2.2.0

Recommendation

Pin third-party actions to an immutable commit SHA, and keep the human-readable tag in a comment for maintenance.

Example:

- name: Setup Bun
  if: inputs.install-bun == 'true'
  # v2.2.0
  uses: oven-sh/setup-bun@<40-char-commit-sha>
  with:
    bun-version: "1.3.9"

Additionally:

• Use a tool like pinact to automate pinning
• Enable Dependabot updates for github-actions to keep pinned SHAs updated safely
• Review the upstream release/commit before bumping versions

2. 🔵 CI security regression: secret-scanning, workflow audit (zizmor), and dependency audit removed from GitHub Actions CI

Description

The .github/workflows/ci.yml workflow removed the entire secrets job that previously performed security checks in CI:

• Secret scanning / key detection: pre-commit ... detect-private-key
• Workflow security auditing: pre-commit ... zizmor on changed workflow files
• Production dependency vulnerability auditing: pre-commit ... pnpm-audit-prod (runs pnpm audit --prod --audit-level=high)

With this job removed, these checks are no longer enforced on CI runs (push/PR). While the hooks still exist in .pre-commit-config.yaml, they are now developer-optional rather than CI-enforced, reducing detection of committed secrets, insecure workflow modifications, and vulnerable production dependencies.

Relevant removed CI block (from this change):

  secrets:
    ...
      - name: Detect committed private keys
        run: pre-commit run --all-files detect-private-key

      - name: Audit changed GitHub workflows with zizmor
        ...
        run: |
          ...
          pre-commit run zizmor --files "${workflow_files[@]}"

      - name: Audit production dependencies
        run: pre-commit run --all-files pnpm-audit-prod

No equivalent checks appear elsewhere in the GitHub workflows after this change (search across .github/workflows/*.yml|*.yaml found no remaining usage of detect-private-key, zizmor, or pnpm-audit-prod).

Recommendation

Re-introduce CI enforcement for these security checks (either restore the secrets job in ci.yml or move it into a dedicated security workflow that runs on pull_request and push).

Example (restore a dedicated job):

secrets:
  if: github.event_name != 'pull_request' || !github.event.pull_request.draft
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@​v6
      with:
        fetch-depth: 0

    - uses: actions/setup-python@​v6
      with:
        python-version: '3.12'

    - name: Install pre-commit
      run: |
        python -m pip install --upgrade pip
        python -m pip install pre-commit

    - name: Detect committed private keys
      run: pre-commit run --all-files detect-private-key

    - name: Audit changed workflows with zizmor
      env:
        BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
      run: |
        set -euo pipefail
        mapfile -t workflow_files < <(git diff --name-only "${BASE_SHA}" HEAD -- '.github/workflows/*.yml' '.github/workflows/*.yaml')
        [ ${#workflow_files[@]} -eq 0 ] || pre-commit run zizmor --files "${workflow_files[@]}"

    - name: Audit production dependencies
      run: pre-commit run --all-files pnpm-audit-prod

Also consider making CodeQL run on a schedule and/or on push/PR (it currently appears to be workflow_dispatch only).

Analyzed PR: #51912 at commit 499c36a

_{Last updated on: 2026-03-22T00:12:52Z}

Greptile Summary

This PR makes two targeted CI optimizations: bumps oven-sh/setup-bun from v2.1.3 to v2.2.0 to eliminate the Node 20 deprecation warning before the June 2026 GitHub Actions cutoff, and narrows the compat-node22 matrix lane from a full pnpm test run to a focused CLI smoke + singleton + release-check suite, while making build-smoke reuse the artifact uploaded by build-artifacts on push events instead of rebuilding from scratch.

Key changes:

• setup-node-env/action.yml: [email protected] → v2.2.0 — straightforward upstream version pin to resolve the pending deprecation warning.
• compat-node22 lane: replaces pnpm test with node openclaw.mjs --help, node openclaw.mjs status --json --timeout 1, pnpm test:build:singleton, node scripts/stage-bundled-plugin-runtime-deps.mjs, and node --import tsx scripts/release-check.ts. Full test coverage continues on the primary Node lanes; Node 22 is now a compatibility + release smoke check.
• build-smoke artifact reuse: adds build-artifacts to needs with an explicit needs.build-artifacts.result == 'success' guard in the if condition. On push, a download-artifact@v8 step provides the already-built dist/; on pull_request, the original pnpm build still runs. The build-artifacts in needs is correctly handled for PRs because the explicit needs.build-artifacts.result reference in the if expression causes GitHub Actions to evaluate the condition (rather than auto-skip the job) when build-artifacts is itself skipped.

Confidence Score: 5/5

• Safe to merge; changes are narrowly scoped CI optimizations with correct conditional logic and no behavioral impact on the application.
• Both changed files contain targeted, well-reasoned CI configuration updates. The build-artifacts/build-smoke dependency logic is correct: the explicit needs.build-artifacts.result reference in the if expression ensures GitHub Actions evaluates the condition (rather than auto-skipping) when build-artifacts is skipped on PRs. The compat-node22 command change reduces redundant work while keeping the coverage that matters for Node 22 compatibility. The setup-bun version bump is a routine maintenance update. No application code is touched.
• No files require special attention.

_{Last reviewed commit: "Merge branch 'main' ..."}