fix(ci): remove checkout of untrusted PR head in pull_request_target workflow#187
Open
lizhengfeng101 wants to merge 1 commit into
Open
fix(ci): remove checkout of untrusted PR head in pull_request_target workflow#187lizhengfeng101 wants to merge 1 commit into
lizhengfeng101 wants to merge 1 commit into
Conversation
…workflow Remove explicit `ref: github.event.pull_request.head.sha` from the checkout step so that pull_request_target uses its default behavior of checking out the base branch (trusted code). PR head commits are still fetched as git objects for diff computation but are never checked out to the working directory. This resolves two critical CodeQL alerts (actions/untrusted-checkout/critical).
|
✅ OpenCodeReview: No comments generated. Looks good to me. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ref: github.event.pull_request.head.shafrom the checkout step so thatpull_request_targetuses its default behavior of checking out the base branch (trusted code only)git diffcomputation but are never checked out to the working directoryactions/untrusted-checkout/criticalContext
The
ocr-review.ymlworkflow usespull_request_targetto access secrets for fork PRs. Previously it checked out the PR head code (ref: ${{ github.event.pull_request.head.sha }}), which placed untrusted files in the working directory — a malicious fork could exploit this via crafted.npmrc,package.json, or other files to hijack subsequentnpm installor other commands running with secret access.Since
ocr review --from X --to Yusesgit diffbetween two commit objects and does not depend on the working tree contents, removing theref:override has no functional impact.Test plan
ocr review --from ... --to ...still works correctly without the PR head checked out (it only needs the git objects, not the working tree)