ci: harden the bundle-snapshot workflow against fork PRs - #378
Open
atinux wants to merge 2 commits into
Open
Conversation
The update job checked out the fork PR head and ran pnpm
install/prepack/vitest in the same job as a contents:write
GITHUB_TOKEN — fork-controlled scripts could hijack the later
github-script step via GITHUB_PATH/GITHUB_ENV.
Split the work: a build job with permissions: {} runs the PR code and
uploads the refreshed snapshot as an artifact; the privileged update
job never checks out code and only applies the artifact (API commit for
branches, patch comment for forks).
The report job trusted the fork-controlled artifact's pr-number and spliced its output.txt into a bot comment inside a fixed backtick fence — a crafted payload could target arbitrary issues or break out of the code block. Validate the pr-number format and outcome values, verify the PR's head SHA matches the workflow run, and fence the excerpt with a run longer than any backtick run it contains.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
comark
@comark/angular
@comark/ansi
@comark/html
@comark/nuxt
@comark/react
@comark/svelte
@comark/vue
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Splits the snapshot update into a tokenless
buildjob (permissions: {}) that runs the PR's code and a privilegedupdatejob that only applies the resulting artifact, and makes the report job validate the artifact'spr-number/outcomeand verify the PR head SHA against the workflow run before commenting; comment fences now adapt to backtick runs in PR-controlled text.Why
A security scan found that fork PR code executed in a job holding a
contents: writetoken (script-injection via$GITHUB_PATH/$GITHUB_ENVinto the token-bearinggithub-scriptstep), and that the fork-controlled artifact could drive bot comments on arbitrary issues or escape its own code fence. Theupdatejob no longer checks out or executes PR code at all.🤖 Prepared by an AI agent (OpenCode) from a security-audit findings list; commits are signed by the repository owner's key.