fix(ci): pass the named CLA secret instead of secrets: inherit - #160
Open
ywatanabe1989 wants to merge 1 commit into
Open
fix(ci): pass the named CLA secret instead of secrets: inherit#160ywatanabe1989 wants to merge 1 commit into
secrets: inherit#160ywatanabe1989 wants to merge 1 commit into
Conversation
`secrets: inherit` forwards EVERY secret this repo holds into the reusable CLA workflow. That caller is triggered by `issue_comment` and `pull_request_target`, both of which an unauthenticated outsider can fire on a public repo, and the callee runs on a shared persistent self-hosted runner. Neither file shows the exposure alone: this caller names no `runs-on`, so the destination lives in the callee. The callee declares exactly one secret (GH_PERSONAL_ACCESS_TOKEN, required), so passing it by name drops every other secret from an attacker-startable job while keeping the CLA check working. Reference implementation: scitex-dev's own .github/workflows/cla.yml.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
secrets: inheritincla.ymlforwards every secret this repo holds into the reusable CLA workflow.That caller is triggered by
issue_commentandpull_request_target— both fireable by an unauthenticated outsider on a public repo — and the callee runs on a shared persistent self-hosted runner.Neither file shows the exposure on its own: this caller names no
runs-on, so the destination lives in the callee. That is why it survived review.Change: pass only
GH_PERSONAL_ACCESS_TOKEN, the one secret the callee declares as required. Every other secret stops being forwarded into an attacker-startable job; the CLA check is unaffected.Reference implementation: scitex-dev's own
.github/workflows/cla.yml.Found while auditing the fleet after scitex-logging hit this on their own repo (their PR #29 is the same change).
🤖 Generated with Claude Code