fix(ci): harden GitHub Actions workflows#400
Open
emptyhammond wants to merge 6 commits into
Open
Conversation
…ub-app risks The workflow_run trigger runs from the default branch with full secret access while checking out PR-controlled code. Although gated to dependabot[bot] PRs only, the GitHub App token was unrestricted -- meaning a compromised or bypassed gate could grant Claude broad write access to any resource the App can reach. Changes: - Pin all 5 actions to SHA to prevent supply-chain attacks via tag hijacking (a compromised action tag can execute arbitrary code with the workflow secret access) - Scope the GitHub App token to only contents:write and pull-requests:write (the minimum Claude needs to push fixes and comment on PRs), limiting blast radius if the dependabot author gate is bypassed
… github-app risks pull_request_target runs with the default branch workflow definition but has full secret access, and this workflow checks out PR-controlled code (github.event.pull_request.head.ref). The GitHub App token was unrestricted, so a bypassed dependabot author gate could grant write access to any resource the App can reach. Changes: - Pin all 4 actions to SHA to prevent supply-chain attacks via tag hijacking (a compromised action tag can execute arbitrary code with the workflow secret access) - Scope the GitHub App token to only contents:write (the minimum needed to push the regenerated lockfile), limiting blast radius if the dependabot author gate is bypassed
….yml Both workflows created GitHub App tokens with the App full permission set. If the App has permissions beyond what these workflows need (e.g. admin access, repository creation), a compromised action in the chain could exploit the over-privileged token. Changes: - Pin all actions to SHA in both workflows to prevent supply-chain attacks via tag hijacking - Scope claude-review.yml App token to contents:read, pull-requests:write, issues:write (minimum for reviewing PRs and posting comments) - Scope pr-overview.yml App token to contents:read, pull-requests:write (minimum for reading diffs and posting overview comments) - Remove unused issues:write from pr-overview.yml workflow-level permissions (the workflow only comments on PRs, never on issues)
…arallel.yml This workflow had no explicit permissions block, inheriting the repository default (often write-all). None of the 5 jobs (setup, auth-tests, session-tests, ui-tests, rate-limit-test) need write access to the repository, PR, or any other scope -- they only read source code, build, and run Playwright tests. Granting write permissions increases the blast radius if any of the 25 unpinned third-party actions in the chain is compromised via tag hijacking. Changes: - Pin all 25 action uses to SHA to prevent supply-chain attacks via tag hijacking - Add explicit permissions: contents: read at workflow level so no job receives unnecessary write access to the repository, packages, PRs, issues, deployments, or other GitHub resources
Both release workflows (release.yml, release-web-cli.yml) used cache: pnpm in actions/setup-node, restoring cached dependencies from a shared cache namespace. PR-triggered workflows (test.yml, e2e-web-cli-parallel.yml) write to this same cache using keys an attacker can predict. A malicious PR could poison the pnpm store cache, and when a release tag is pushed, the publish job would restore the poisoned cache -- potentially injecting malicious code into the published npm package. Changes: - Remove cache: pnpm from setup-node in both release workflows so publish jobs always install fresh dependencies from the registry, eliminating the cross-workflow cache poisoning vector - Pin all actions to SHA to prevent supply-chain attacks via tag hijacking (especially critical in publish workflows that hold NPM_TOKEN)
Actions referenced by mutable version tags (e.g. @v6) are vulnerable to supply-chain attacks: if a tag is hijacked or force-pushed, the compromised action executes with the workflow secrets and permissions. This is especially dangerous for workflows that access E2E API keys and access tokens (e2e-tests.yml, test.yml). Pin all remaining action uses across these three workflows to immutable commit SHAs so that the exact code running in CI is cryptographically locked to a reviewed version.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
WalkthroughThis PR hardens all 10 GitHub Actions workflows against supply-chain and privilege-escalation attacks. Every third-party action reference is pinned to an immutable commit SHA (replacing mutable version tags), GitHub App tokens are scoped to the minimum permissions each workflow actually needs, and the Changes
Review Notes
|
Review Summary\n\nThis PR correctly pins all GitHub Actions to SHA commits and scopes GitHub App token permissions across 10 workflows. SHA pins are consistent across all files and most permission changes are correct.\n\nOne functional issue to flag:\n\n### pr-overview.yml - missing issues:write on app token will break comment posting\n\nThe PR removes
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.