Repository navigation
Harden CI workflow - #39
Merged
Merged
Conversation
lwr20
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
Hardens the CI workflow to prevent forked PRs from running with repository secrets and elevated GITHUB_TOKEN permissions, while keeping deploy restricted to push events.
Changes:
- Switch workflow trigger from
pull_request_targettopull_requestand remove thesafe to testlabel gate. - Pin GitHub Actions to commit SHAs and set explicit job permissions.
- Run FOSSA scan only on
pushevents to avoid missing-secret failures on fork PRs.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Replace pull_request_target with pull_request to prevent fork PRs from running with access to FOSSA_API_KEY, QUAY_TOKEN, and GITHUB_TOKEN. Remove the safe-to-test label gate (no longer needed) and gate the FOSSA scan to push events only so it doesn't fail on fork PRs with missing secrets. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Explicitly set permissions to contents:read and checks:write (the latter for golangci-lint PR annotations) rather than relying on the org default write-all token. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces mutable version tags (v4, v5, etc.) with pinned commit SHAs to prevent supply chain attacks via tag force-push, as demonstrated by the hackerbot-claw attack against Trivy. Also fixes the deploy job if condition to use bare expression syntax rather than mixing template and expression syntax. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The deploy job pushes images to Quay using QUAY_TOKEN, not the GITHUB_TOKEN, so packages:write on the GITHUB_TOKEN is not needed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Gate e2e test to push and same-repo PRs only; fork PRs skip it to avoid burning CI resources on untrusted code - Remove redundant job-level if condition (workflow only triggers on push and pull_request) - Simplify deploy checkout ref to github.sha (deploy only runs on push) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Consistent with the deploy job; the pull_request_target workaround of explicitly specifying the PR head SHA is no longer needed now that we use the pull_request trigger. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
lwr20
force-pushed
the
fix/pwn-request-ci-workflow
branch
from
March 25, 2026 11:03
d3b58d6 to
94b5a25
Compare
Forks don't have FOSSA_API_KEY configured, so the scan was failing on pushes to fork branches. Adding a repo check prevents it running anywhere other than the upstream projectcalico/tiger-bench repo. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Behnam-Shobiri
approved these changes
Mar 25, 2026
Behnam-Shobiri
left a comment
Behnam-Shobiri
left a comment
There was a problem hiding this comment.
Just 2 nits
Thank you for fixing this
Prevents GITHUB_TOKEN credentials being stored in the local git config after checkout, reducing the risk of accidental credential exposure in subsequent steps. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This was referenced Mar 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens the CI workflow:
pull_request_targetwithpull_requestso fork PRs no longer run with access toFOSSA_API_KEY,QUAY_TOKEN, or a write-capableGITHUB_TOKENsafe to testlabel gate on thetestjob (no longer needed — fork PR code runs without secrets by design)pushevents only, preventing auth failures on fork PRs whereFOSSA_API_KEYis unavailableThe
deployjob is unaffected — it was already gated topushevents only.Ref: https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation
🤖 Generated with Claude Code