Repository navigation
harden(ci): pin action refs to SHA + least-privilege permissions - #63544
Merged
Merged
Conversation
…ions label-issues.yml used a mutable @main ref and declared no permissions block. Pin to commit 538065e and scope the token to contents:read + issues:write.
community-requester-id.yaml runs under pull_request_target and handles a GitHub App private key. Pin machine-learning-apps/actions-app-token@0.21 (archived, mutable tag) to SHA b5f0e20, pin+bump actions/checkout v2 -> v4 (SHA 11d5960), and add a contents:read permissions block.
Contributor
|
✅ No issues found Checked 07d036e • notify-only, does not block merge |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens GitHub Actions workflows against the mutable-action-ref → CI code execution class flagged by a security report (four independent scanners converged on
label-issues.yml). Fixes two files.Findings & fixes
1.
label-issues.yml(the reported finding)uses: sap-tutorials/tutorial-actions@main— a mutable branch ref. Anyone able to push totutorial-actions@maingets code execution here withGITHUB_TOKENon the nextissues: openedevent (triggerable by any user). Nopermissions:block, so the job ran at the repo default token scope.538065eee0c5ae18cc88e430da2241a0668b9b79(currentmain), plus a least-privilege block (contents: read,issues: write).2.
community-requester-id.yaml(found during the sweep — higher risk)pull_request_target(writable token, runs for fork PRs) and feeds a GitHub App private key (SAP_TUTORIALS_APP_PEM_BASE64) to a third-party, archived action pinned at a mutable tag (machine-learning-apps/actions-app-token@0.21). A re-pointed tag there = full App compromise, not justGITHUB_TOKEN.actions-app-tokenpinned to SHAb5f0e20;actions/checkoutpinned to SHA and bumpedv2 → v4(v2 is EOL/Node 12); addedpermissions: contents: read(all writes go through the App token, so the ambient token needs no write scope).Audit of the remaining 4 workflows — no action needed
close_inactive_issues.ymlactions/stale@v9notify-tutorials-ims.ymltutorial-pr-checks.yml@v1, scoped permstutorial-pr-comment.yml@v1, scoped permsRepo default workflow token is already
read— this bounds (but does not remove) thelabel-issuesexposure; the SHA pin closes the actual channel.Residual notes
tutorial-actions,tutorial-ci) are pinned by SHA/tag but still depend onsap-tutorialspush-access controls.package-ecosystem: github-actions) to keep SHA pins current without reintroducing mutable refs.🤖 Generated with Claude Code