[polylane]

Fixes: Org-wide SoferAI bot App private key is reachable from pull_request workflows in 8 repos via a shared module

The pull request title check ran with the organisation's shared bot application key, and GitHub takes the definition of a pull request workflow from the branch under review. Anyone able to push a branch could read a key the bot uses to write across the organisation. The check now uses the repository's built-in token, which only reads.

flowchart TD
  A["Writer edits conventional-pr.yaml on a branch"] --> B["PR targeting main is opened or synchronized"]
  B --> C["GitHub runs the workflow definition<br/>from the PR merge ref"]
  C --> D["lint-pr job receives<br/>secrets.SOFERAI_BOT_PRIVATE_SIGNING_KEY"]
  D --> E["App private key readable in the run"]
  E --> F["sofer-ai-bot installation tokens mintable<br/>for the App's installed repositories"]
  G["Fix in this PR: remove the create-github-app-token step<br/>and use the default read-only GITHUB_TOKEN"] -. "acts here" .-> D

Loading

Detection evidence

Affected: int_ead7055cc001si0oyduvvg3j

Why this fix

This check only reads the pull request title, so the shared bot application key was privilege it never used inside a job whose definition a branch author controls. All 100 sampled runs of this check in SoferAi/app were pull request events and 96 of those branches belonged to unattended bots. The same form already runs successfully in SoferAi/torah-dl, where the last 30 runs passed. The shared module that renders this file is corrected in a separate pull request. Rotating the application key and narrowing its installation scope stay owner actions.

Fix walkthrough

Watch the fix explained (2:28). Recorded for commit 1a5c6a54511ff7886d7ce421c718eeda92d06342.

Out of scope

• Key rotation and installation-scope narrowing are owner actions, recorded on the incident timeline.

Causal chain

• Signal (alert): Org-wide SoferAI bot App private key is reachable from pull_request workflows in 8 repos via a shared module
• Surfacing site: GitHub org SoferAi (integration int_ead7055cc001si0oyduvvg3j) at SoferAi/github:modules/github/files/workflows/conventional-pr.yaml rendered to .github/workflows/conventional-pr.yaml (and soferai-py's .yml) in 8 repositories
• Mechanism: Each rendered conventional-pr workflow triggers on pull_request to main and its lint-pr job injects private-key: ${{ secrets.SOFERAI_BOT_PRIVATE_SIGNING_KEY }} into actions/create-github-app-token. GitHub executes a pull_request workflow definition from the PR merge ref, so a branch author who edits the workflow reads the key in the run; secrets are provided to same-repository branches. No exploitation is observed.
• Producer: SoferAi/github Terraform module "github" (resource github_repository_file.files), instance conventional-pr.yaml file resource, at SoferAi/github:modules/github/main.tf#github_repository_file.files
• Trigger: pull_request event (opened/edited/synchronize) targeting main in any of the 8 repositories
• What happens to the failed unit today: GitHub Actions runs a pull_request workflow from the pull request's merge ref and provides repository secrets to same-repository branches; fork pull requests to private repositories receive neither. The lint job only needs read access, and the org default_workflow_permissions is read.
• Cadence check: In SoferAi/app, 100 of 100 sampled conventional-pr runs were pull_request events and 96 of those branches were renovate (36), codex (31) or release-please (29).
• Blast radius: 8 other resource(s), unknown other tenant(s); data at risk: The org-wide sofer-ai-bot GitHub App private signing key, which mints installation tokens the org uses to write via release-please and git-auto-commit; no data loss or exfiltration observed. The App's installation repository scope is not readable from this integration (GET /apps/sofer-ai-bot returns 403), so the number of repositories the minted tokens reach is unknown.
• Producer evidence:
  • SoferAi/github:modules/github/main.tf lines 34-37 define file_content_map.conventional path .github/workflows/conventional-pr.yaml and content file("${path.module}/files/workflows/conventional-pr.yaml")
  • SoferAi/github:modules/github/main.tf lines 113-142 write that path for each repo whose files list contains conventional, with lifecycle ignore_changes on content
  • SoferAi/github:modules/github/files/workflows/conventional-pr.yaml lines 3-10 trigger pull_request on main and lines 16-21 use create-github-app-token with secrets.SOFERAI_BOT_PRIVATE_SIGNING_KEY
  • Identical rendered copies read in SoferAi/app, api, engine, github, terraform, renovate-config, toraheval (.yaml) and soferai-py (.yml) on 2026-10-14
  • GitHub code search SOFERAI_BOT_PRIVATE_SIGNING_KEY org:SoferAi returns 20 paths; 9 are the module template plus the 8 rendered PR-triggered copies

1 file changed (+4/-7)

• .github/workflows/conventional-pr.yaml: modified, +4/-7

---

Generated by Polylane. You can ask follow-ups by mentioning @polylane in a comment.

[polylane]

Note

Production impact unlikely.

Documentation, test, or CI-only change; nothing that runs in production is affected.

_{Polylane analysed 1a5c6a5 for production impact. You can ask follow-ups by mentioning @polylane in a comment.}

Rate this review: 👍 helpful · 👎 not helpful · 😕 confusing

[polylane]

This pull request is waiting on a decision: merge it if the change is still wanted, or close it if the fix is no longer needed. Either one settles it.

It was opened on 2026-10-14 and has had no new activity for a week. If nothing happens on it within a week, Polylane closes it and keeps the branch, so reopening it brings the change back exactly as it stands.

@matanyall, the change touches what you own, so the review is with you.

[polylane]

This pull request is closing without a merge, and nothing is lost: the branch polylane/autofix/k14z61r2u9uj stays in place, reopening the pull request brings the change back exactly as it stands, and Polylane will propose a fresh fix if the problem returns.

It was opened on 2026-10-14, Polylane reminded the maintainers about it on 2026-10-24, and nothing has happened on it since.

@matanyall, you were asked to review this pull request; reopening it puts it back on your list.