mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
Alem Tuzlak
edf10769ac
Comprehensive CI/CD security hardening pass over all 33 workflows. Action pinning - Every `uses:` is now pinned to a 40-char commit SHA with a `# vX.Y.Z` comment alongside (167 occurrences resolved). Tag-style refs like `@v4` are mutable and have been used in past supply-chain attacks (e.g. tj-actions/changed-files in March 2025) to repoint widely-used actions to malicious commits. - Removed redundant `version: "10.13.1"` hardcodes from `pnpm/action-setup` call sites so the action inherits from package.json `packageManager` (one source of truth). Automated maintenance - Added `.github/dependabot.yml` for the `github-actions` ecosystem so SHA pins stay current. Without this, pins go stale fast and new upstream advisories never reach us. Minor/patch bumps are grouped; major bumps stay separate so they get a real review. Static analysis - Added `.github/zizmor.yml` configuration and `.github/workflows/security_zizmor.yml` (blocking on PR, runs on push to main, weekly schedule for advisory drift). zizmor catches the well-known classes of Actions footguns: template injection from untrusted input, dangerous triggers, unpinned uses, excessive token scopes, secret exfil patterns. - All 28 high-severity and 54 medium-severity findings from the baseline scan are remediated. Each suppression in zizmor.yml carries a per-finding justification comment so future maintainers can audit the trust assumption. Workflow hardening (from zizmor + manual audit) - Added `persist-credentials: false` to every `actions/checkout` except the 7 workflows that legitimately push back to the repo via the workflow token (release tagging, auto-formatting, docs-sync, registry updates). Each retained credential persistence carries a `persist-credentials required: ...` comment explaining the call site. - Routed every attacker-controllable expansion (`github.head_ref`, `github.event.pull_request.head.repo.full_name`, `inputs.*`, step outputs) through `env:` and referenced as quoted shell variables. Eliminates 17 template-injection vectors in fork-PR-reachable workflows. - Added per-job `permissions:` blocks across 14 workflows; demoted broad workflow-level `id-token: write` to the specific Depot-runner jobs that need it; narrowed `pull-requests: write` / `actions: write` to the jobs that actually call those APIs. Audit-driven fixes - `publish-release.yml` build job: dropped `token:` and added `persist-credentials: false`. The subsequent `Upload workspace` step was packing `.git/config` (with the persisted GITHUB_TOKEN) into a 1-day-retention artifact downloadable by anyone with `actions:read`. - `auto_merge_showcases.yml`: team-membership check now authorizes on the PR AUTHOR (`pull_request.user.login`), never `context.actor` — the actor is whoever triggered the latest event, so a team member synchronizing or reopening an outsider's PR would otherwise green-light auto-merge of code they didn't author. - `static_quality.yml`: pinned ruff to a specific version so a compromised release can't land on the next PR run with the persisted-credentials write token in the format job. - `showcase_capture-previews.yml`: switched the args-string construction to a bash array so a slug or demo value containing whitespace or shell metacharacters stays a single argument rather than being re-tokenized by the shell.
44 lines
1.3 KiB
YAML
44 lines
1.3 KiB
YAML
name: Update PR branch
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [labeled]
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
update-branch:
|
|
if: github.event.label.name == 'qa:update-branch'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Update PR branch with base
|
|
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
|
|
with:
|
|
script: |
|
|
const { owner, repo } = context.repo;
|
|
const pull_number = context.payload.pull_request.number;
|
|
|
|
try {
|
|
await github.rest.pulls.updateBranch({ owner, repo, pull_number });
|
|
core.info(`Updated branch for PR #${pull_number}`);
|
|
} catch (error) {
|
|
if (error.status === 422) {
|
|
core.info(`Branch already up to date or cannot be updated: ${error.message}`);
|
|
} else {
|
|
core.setFailed(`Failed to update branch: ${error.message}`);
|
|
}
|
|
} finally {
|
|
try {
|
|
await github.rest.issues.removeLabel({
|
|
owner,
|
|
repo,
|
|
issue_number: pull_number,
|
|
name: 'qa:update-branch',
|
|
});
|
|
} catch (error) {
|
|
core.warning(`Could not remove label: ${error.message}`);
|
|
}
|
|
}
|