## ci: 強化 GitHub Actions workflows 安全性(修補 pwn-request 與 secrets 外洩風險) - #80
Merged
Merged
Conversation
…posure - build.yml: checkout immutable head.sha instead of mutable head.ref to prevent TOCTOU attacks under pull_request_target; disable credential persistence; add least-privilege top-level permissions; replace 'secrets: inherit' with explicit secret passing - deploy.yml: drop unnecessary GH_PAT for same-run artifact download; remove unused checkout of untrusted PR code; declare secrets interface - deploy-to-gh-pages.yml: remove dead pull_request event refs (workflow is workflow_dispatch only) - lhci.yml: add least-privilege top-level permissions
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
摘要
本 PR 針對 CI/CD workflows 進行安全性掃描後的修補,解決一個 High 等級漏洞與數個中低風險問題。
🔴 High:
pull_request_target+ 可變 ref 的 TOCTOU 攻擊(pwn request)build.yml使用pull_request_target觸發(帶有完整 secrets 存取權),但 checkout 的是head.ref(可變的分支名稱)。攻擊情境:safe-to-deploylabelGH_PAT)的環境中執行修正:checkout 改用事件觸發當下不可變的
head.sha,並加上persist-credentials: false避免 token 殘留於 git config。🟠 Medium
secrets: inherit過度授權(build.yml):原本將所有 repo secrets 傳給 deploy job,改為只明確傳遞GC_WORKLOAD_IDENTITY_PROVIDERGH_PAT(deploy.yml):此 workflow 只透過同一 run 的workflow_call呼叫,下載 artifact 使用預設 job token 即可,移除 PAT 減少外洩風險deploy.yml):deploy job 完全沒用到 repo 檔案,卻 checkout 了不受信任的 PR code,已移除🟡 Low
build.yml/lhci.yml:加上 top-levelpermissions: contents: read(最小權限)deploy-to-gh-pages.yml:移除永遠為空的pull_requestevent 引用(此 workflow 僅由workflow_dispatch觸發)變更檔案
.github/workflows/build.ymlhead.sha、persist-credentials: false、top-level permissions、明確傳遞 secrets.github/workflows/deploy.ymlGH_PAT與未使用的 checkout、宣告secrets介面.github/workflows/deploy-to-gh-pages.yml.github/workflows/lhci.yml後續建議(本 PR 未包含)
@v4)pin 到 full commit SHA,並以 Dependabot 管理更新hugo-version取代"latest",確保供應鏈安全與 build 可重現性safe-to-deploylabel 流程:審核最新 commit 後才貼 label,新 commit 進來時移除舊 labelGH_PAT已無其他用途,從 repo secrets 中刪除測試方式
workflow_dispatch手動觸發build.yml驗證 build → deploy → comment 全流程