Repository navigation
Warn when the job token is readable by the cifail image (#39) - #42
Merged
Merged
Conversation
The action mounts the workspace into the container, and actions/checkout v5 and earlier persist the job token in .git/config by default. The step now warns when the workspace's .git/config (or a path: checkout's, one level down) holds an extraheader. Checkout v6+ only writes an includeIf to a file under $RUNNER_TEMP, so it does not trigger. The README example checks out with persist-credentials: false. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #39.
The action runs the image with the whole workspace mounted (
-v "$PWD:/work").actions/checkoutv5 and earlier persist the job token in.git/configunless givenpersist-credentials: false, so for those users the image can read theGITHUB_TOKEN.What changes
action.yml: before it starts the container, the step checks.git/configand./*/.git/config(forpath:checkouts one level down) for anextraheader. If it finds one, it emits a::warning::that names the file and the fix. It warns rather than hiding.git, because the container needs the workspace: it reads the log, writes the reports there, and cifail runsgitfor correlation.actions/checkout@v7andpersist-credentials: false, followed by a note on why.### Securityentry in the changelog.Why checkout v6+ does not warn
I checked
src/git-auth-helper.tsat checkout v7.0.1. It writes the token to$RUNNER_TEMP/git-credentials-<uuid>.config, and.git/configgets onlyincludeIf.gitdir:….pathentries pointing there.$RUNNER_TEMPis not mounted, and the include path contains noextraheader. So the check fires exactly when the token is inside the workspace.Tested
The step script was extracted the way
ci.ymldoes and run underbash --noprofile --norc -e -o pipefail, with a stubdocker, in a scratch workspace:.git/configwith no credential.git/configwith[http "https://github.com/"] extraheader = …(checkout ≤ v5).git/configwith only a v6-styleincludeIf→git-credentials-<uuid>.configsub/.git/configwithextraHeader(mixed case)sub/; the root has none).gitat allshellcheck passes on the script, and
check-versions.shpasses.🤖 Generated with Claude Code