Uh oh!
There was an error while loading. Please reload this page.
fix: port security, Mergify, and CI fixes from release/v1.0.0 to develop - #2362
Merged
Conversation
…n metadata-governance.yml metadata-governance.yml checked out the PR submitter's fork branch (github.event.pull_request.head.ref) under pull_request_target while holding a token scoped issues:write/pull-requests:write/repository- projects:write, then executed scripts from that checkout. A PR could edit those scripts to run arbitrary code with that token. Per GitHub's securely-using-pull_request_target guidance, pull_request_target must only ever execute trusted code from the base repository's default branch. This is the same vulnerability already fixed on release/v1.0.0 (PR #2355), ported here because for pull_request_target-triggered workflows GitHub resolves the workflow *definition* from the repository's actual default branch (develop), not from whatever branch the PR targets — so the release/v1.0.0 fix never applied to real contributor PRs against develop, where this workflow actually runs.
… CommonJS/ESM breakage Ports the same three fixes already applied and verified on release/v1.0.0 (PRs #2358, #2359, #2360) to develop — the repository's actual default branch, where pull_request_target-triggered workflows resolve their *definition* from, regardless of what branch a PR targets. The release/v1.0.0 fixes never reached these code paths. 1. Node version drift: .nvmrc said 22, package.json engines said >=18, workflows hardcoded a mix of "18"/"20"/"22"/"lts/*" for setup-node (including "20", deprecated on GitHub's hosted runners). Standardised on 24 (current Active LTS per nodejs.org) across .nvmrc, package.json engines.node, and every workflow. Verified no node-version matrix strategies exist, so a blanket normalise was safe. 2. Stale action versions: bumped actions/checkout, setup-node, upload-artifact, download-artifact, github-script, create-github-app-token, tj-actions/changed-files, and add-to-project to their current latest majors — verified via the GitHub API against each project's actual releases, and checked release notes for breaking changes before bumping. Includes two vendored skill workflow files under agents/*/skills/ that carried the same stale pins. 3. CommonJS scripts crashing under this repo's "type": "module": found via the same dependency-graph-walk methodology used on release/v1.0.0, but starting fresh from develop's actual entrypoint set — which differs from release/v1.0.0's (some files already converted to real ESM here, e.g. issues.agent.js/planner.agent.js; others broken here that weren't there, e.g. the Meta Agent skills and scripts/agents/includes/label-sync.js). Renamed 32 files to .cjs and fixed every reference — literal .js paths, extensionless require() calls (this repo's .jest.config.cjs excludes 'cjs' from moduleFileExtensions, so Jest doesn't auto-resolve it either), and requires embedded inside actions/github-script blocks in YAML, which a naive `node scripts/....js`-only entrypoint scan misses entirely. Re-ran the full closure and a repo-wide reference scan afterward: zero stale references remain.
Contributor
Important Review skippedToo many files! This PR contains 111 files, which is 11 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (111)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Merge Protections🔴 1 of 2 protections blocking
🔴 🚦 Auto-queueThis rule is failing.When all merge protections are satisfied and these conditions match, this pull request will be queued automatically.
Show 1 satisfied protection🟢 📃 Configuration Change RequirementsMergify configuration change
|
Contributor
Merge Queue Status
This pull request spent 22 seconds in the queue, including 3 seconds running CI. Required conditions to merge
|
Contributor
⏱️ Aging and SLA annotation
Maintained by project-meta-sync workflow. |
Uh oh!
There was an error while loading. Please reload this page.
Contributor
🔍 Reviewer Summary for PR #2362CI Status: ❌ Recommendations
|
Contributor
Milestone Allocation |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linked issues
Relates to #2351 (relates LS-2809). Ports fixes from release/v1.0.0 (#2355, #2356, #2358, #2359, #2360, #2361) that never reached
develop.Changelog
Fixed
metadata-governance.ymlchecked out the PR submitter's fork branch underpull_request_targetwhile holding a token scopedissues:write/pull-requests:write/repository-projects:write— apwn requestvulnerability. Fixed here specifically because forpull_request_target-triggered workflows, GitHub resolves the workflow definition from the repository's actual default branch (develop), not from whatever branch a PR targets. The identical fix onrelease/v1.0.0(fix(workflows): close pull_request_target fork-checkout hole; bump actions to latest #2355) never applied to real contributor PRs againstdevelop, where this workflow actually runs.merge_protections_settings.auto_merge_conditions: truewas unconditionally auto-merging any mergeable PR, from any author.develop's branch protection requires only thevalidate-pr-templatecheck, so this merged PRs the instant that one check passed — ignoring tests, linting, and security scans entirely. Restricted to the same bot-author condition already used throughout this file (dependabot/imgbot/lightspeed-bot)..nvmrc/package.json/workflows were split across Node 18/20/22/lts — including 20, which is deprecated on GitHub's hosted runners. Standardised on 24 (current Active LTS). Bumped staleactions/*pins to their current latest majors (verified via the GitHub API against each project's actual releases).require/module.exports) whilepackage.jsondeclares"type": "module", causingReferenceError: require is not defined in ES module scopethe moment a workflow actually ran them. Renamed to.cjsand fixed every reference — literal paths, extensionlessrequire()calls, and requires embedded insideactions/github-scriptblocks in YAML. Re-ran a full repo-wide reference scan afterward: zero stale references remain.Risk Assessment
Risk Level: Medium
Potential Impact: Touches CI/automation scripts and one security-relevant workflow, not production application code. The Mergify change alters merge automation behaviour repo-wide — after this merges, non-bot PRs against
developwill no longer auto-merge onvalidate-pr-templatealone and will need to pass whatever checks are actually required, or be merged manually.Mitigation Steps: Every fix here already landed and was verified on
release/v1.0.0first (separate PRs, separate CI runs) before being ported. The CJS renames were found via an automated dependency-graph walk from every real workflow entrypoint (including YAML-embeddedrequire()calls), not manual guessing, and re-verified with a zero-result final scan.How to Test
Prerequisites
None.
Test Steps
developfrom a fork and confirmmetadata-governance.ymlno longer checks out the fork's branch (checkout step should show norepository:/ref:override).validate-pr-templatepassing alone.ReferenceError: require is not defined.Expected Results
No module-resolution errors; Mergify no longer auto-merges non-bot PRs; the fork-checkout vulnerability is closed on the branch that actually matters.
Edge Cases to Verify
Checklist (Global DoD / PR)
ref:/repository:override removed)