From ca12dcc28d062099dbe24a7f2e01bcdae881a4f5 Mon Sep 17 00:00:00 2001 From: Ken Dreyer Date: Mon, 2 Mar 2026 10:50:34 -0500 Subject: [PATCH] RHOAIENG-51481: switch pull_request_target to pull_request External contributors disclosed vulnerabilities in our pull_request_target workflows. Switching to pull_request prevents untrusted fork code from running with access to repository secrets. Leave the dependabot-auto-merge workflow unchanged, because it checks github.actor as a guard and never checks out code. Now that we are running these workflows on pull_request triggers, forks will not have access to the GHA secrets. Skip running these workflows altogether on PRs that originate from forks, rather than failing when GHA cannot find the secrets any more. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/amber-auto-review.yml | 7 +++---- .github/workflows/claude-live-test.yml | 3 ++- .github/workflows/components-build-deploy.yml | 7 ++++--- .github/workflows/e2e.yml | 3 ++- scripts/validate-amber-workflows.sh | 6 +++--- 5 files changed, 14 insertions(+), 12 deletions(-) diff --git a/.github/workflows/amber-auto-review.yml b/.github/workflows/amber-auto-review.yml index 7355b2f862..62cef8e1ee 100644 --- a/.github/workflows/amber-auto-review.yml +++ b/.github/workflows/amber-auto-review.yml @@ -9,11 +9,12 @@ name: Amber Automatic Code Review on: - pull_request_target: + pull_request: types: [opened, synchronize] jobs: amber-review: + if: github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest permissions: contents: write @@ -30,11 +31,9 @@ jobs: fetch-depth: 1 path: base-ref - - name: Checkout PR head + - name: Checkout PR code uses: actions/checkout@v6 with: - repository: ${{ github.event.pull_request.head.repo.full_name }} - ref: ${{ github.event.pull_request.head.ref }} fetch-depth: 0 - name: Determine command file path (security) diff --git a/.github/workflows/claude-live-test.yml b/.github/workflows/claude-live-test.yml index cb30491ef2..b1908c69aa 100644 --- a/.github/workflows/claude-live-test.yml +++ b/.github/workflows/claude-live-test.yml @@ -5,7 +5,7 @@ name: Claude Live Testing # Claude will test the feature with browser automation and provide reports on: - pull_request_target: + pull_request: types: [labeled] branches: [ main, master ] @@ -21,6 +21,7 @@ concurrency: jobs: # Security check - only proceed if claude-test label was added check-label: + if: github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest outputs: should-run: ${{ steps.check.outputs.should-run }} diff --git a/.github/workflows/components-build-deploy.yml b/.github/workflows/components-build-deploy.yml index 07eed040b5..8843bac6b0 100644 --- a/.github/workflows/components-build-deploy.yml +++ b/.github/workflows/components-build-deploy.yml @@ -12,7 +12,7 @@ on: - 'components/frontend/**' - 'components/public-api/**' - 'components/ambient-api-server/**' - pull_request_target: + pull_request: branches: [main] paths: - '.github/workflows/components-build-deploy.yml' @@ -42,6 +42,7 @@ concurrency: jobs: detect-changes: + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest outputs: frontend: ${{ steps.filter.outputs.frontend }} @@ -166,13 +167,13 @@ jobs: cache-to: type=gha,mode=max - name: Build ${{ matrix.component.name }} image for pull requests but don't push - if: (matrix.component.changed == 'true' || github.event.inputs.force_build_all == 'true' || contains(github.event.inputs.components, matrix.component.name)) && github.event_name == 'pull_request_target' + if: (matrix.component.changed == 'true' || github.event.inputs.force_build_all == 'true' || contains(github.event.inputs.components, matrix.component.name)) && github.event_name == 'pull_request' uses: docker/build-push-action@v6 with: context: ${{ matrix.component.context }} file: ${{ matrix.component.dockerfile }} platforms: linux/amd64,linux/arm64 - push: true + push: false tags: ${{ matrix.component.image }}:pr-${{ github.event.pull_request.number }} cache-from: type=gha cache-to: type=gha,mode=max diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 3930629081..e75b71eafd 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -5,7 +5,7 @@ name: E2E Tests # Maintainers: Review PR code before adding label! on: - pull_request_target: + pull_request: types: [labeled] branches: [ main, master ] @@ -16,6 +16,7 @@ concurrency: jobs: # Security check - only proceed if safe-to-test label was added check-label: + if: github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest outputs: should-run: ${{ steps.check.outputs.should-run }} diff --git a/scripts/validate-amber-workflows.sh b/scripts/validate-amber-workflows.sh index ed1feb694a..88e4b58065 100755 --- a/scripts/validate-amber-workflows.sh +++ b/scripts/validate-amber-workflows.sh @@ -94,10 +94,10 @@ echo "Test 4: Workflow Trigger Validation" echo "------------------------------------" # amber-auto-review should trigger on PR events -if grep -q "pull_request_target:" ".github/workflows/amber-auto-review.yml"; then - report_test 0 "amber-auto-review triggers on pull_request_target" +if grep -q "pull_request:" ".github/workflows/amber-auto-review.yml"; then + report_test 0 "amber-auto-review triggers on pull_request" else - report_test 1 "amber-auto-review missing pull_request_target trigger" + report_test 1 "amber-auto-review missing pull_request trigger" fi # amber-issue-handler should have proper label/comment filtering