chore: update fullsend shim workflow #144
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -41,7 +41,7 @@ jobs: | |
| if: >- | ||
| github.event_name != 'issue_comment' | ||
| || github.event.comment.user.type != 'Bot' | ||
| uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@main | ||
|
There was a problem hiding this comment. [medium] supply chain / bot-authored security change This security-sensitive change (removing SHA pinning from a privileged workflow) is authored by a bot account (fullsend-ai-fullsend[bot]). The PR description frames this as a template synchronization ('brings it back in sync'), but the practical effect is to weaken a supply chain security control. Bot-authored PRs that degrade security controls warrant heightened scrutiny. Suggested fix: Require explicit human approval for any bot-authored PR that modifies workflow permission scopes or unpins workflow/action references. Consider adding a CODEOWNERS rule for .github/workflows/ that requires security team review. There was a problem hiding this comment. [high] permission-expansion Reusable workflow reference changed from pinned SHA (701e62a9c6f104ed68f8d4085d9c3b8bad3a82e4) to mutable branch reference (@main). This workflow runs on pull_request_target with elevated permissions including id-token: write (OIDC token minting) and actions: write. SHA pinning ensures immutability of the called workflow code — switching to @main means any push to the main branch of konflux-ci/.fullsend will immediately change the code executed in this privileged context. This is a supply-chain risk and also breaks the repository's established convention of pinning all action/workflow references to immutable SHAs. Suggested fix: Keep the SHA-pinned reference. Update the pinned SHA to the new target commit: uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@ # main There was a problem hiding this comment. [low] process-gap Security-relevant change (removing SHA pinning for a privileged workflow) submitted by a bot as a template sync with no linked issue or ADR documenting the rationale for accepting increased supply-chain risk. Suggested fix: Document the decision to accept or reject the upstream template's move to @main, either in an issue linked to this PR or in an ADR. |
||
| with: | ||
| event_action: ${{ github.event.action }} | ||
|
|
||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[high] supply chain / workflow pinning
The reusable workflow reference is changed from a pinned SHA (701e62a9c6f104ed68f8d4085d9c3b8bad3a82e4) to a mutable branch reference (@main). This workflow grants id-token: write and actions: write permissions at the workflow level, is triggered by pull_request_target, and the workflow comments explicitly document security considerations around credential exfiltration. Every other external action and reusable workflow reference across all workflow files in this repository is pinned to a commit SHA — this change is the sole exception. A compromise of the .fullsend repository’s main branch would immediately grant the attacker the ability to mint OIDC tokens scoped to this repository and trigger arbitrary workflow runs, without any change being reviewed in this repository.
Suggested fix: Keep the workflow reference pinned to a specific commit SHA. If the intent is to track upstream updates, use Dependabot or Renovate to propose SHA bumps as reviewable PRs, preserving the '# main' trailing comment for documentation.