Repository navigation
ci(KNO-16687): harden GitHub Actions workflows - #1109
Conversation
- Declare read-only permissions in release.yml and drop the unused write scope from dependabot-changeset.yml (both use the bot token). - Check the PR author instead of the spoofable github.actor. - Pin eas-cli instead of installing latest. - Install integration deps with --immutable and scope the integration secrets to the test step. - Don't persist checkout credentials unless the job pushes. - Pass step outputs and matrix values to scripts through env. Co-authored-by: Chris Bell <chris@cjbell.co>
Co-authored-by: Chris Bell <chris@cjbell.co>
Co-authored-by: Chris Bell <chris@cjbell.co>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Left a non-blocking comment: this GitHub Actions hardening change is not a docs, dependency, or auto-release PR, so it is not auto-approved. Human review is needed; kylemcd and mattmikolay were assigned.
Sent by Cursor Approval Agent: SDK approver
There was a problem hiding this comment.
Left a non-blocking comment: this is GitHub Actions hardening, not a dependency update, so it is outside this agent's approval criteria. Human review is needed, and no reviewers were assigned.
Sent by Cursor Approval Agent: Depdency updates (control, switchboard, CLI, javascript, telegraph)
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1109 +/- ##
=======================================
Coverage 78.48% 78.48%
=======================================
Files 140 140
Lines 4508 4508
Branches 1314 1314
=======================================
Hits 3538 3538
Misses 873 873
Partials 97 97 |
| yarn config set npmAuthToken $NPM_TOKEN | ||
| yarn config set npmAuthToken "$NPM_TOKEN" |
There was a problem hiding this comment.
no, but doing it in quotes means it can't escape values into the command
Description
Hardens this repo's GitHub Actions, following the guidance linked from KNO-16655. That guidance covers four things: pin every action to a full SHA from the action's own repo, stop
run:steps from pulling unpinned code, declare least-privilegepermissions:, and lint so pins can't regress. Tracked in KNO-16687.Every action here was already SHA-pinned. Each pin was checked with
git ls-remote --tagsand zizmor's online impostor-commit audit, and each one matches a release tag in the action's own repo. This PR fixes the remaining gaps.Token permissions
release.ymlhad nopermissions:block. It now hascontents: read. Checkout, the prerelease-exit push, andchangesets/actionall useKNOCK_ENG_BOT_GITHUB_TOKEN.changesets/actionv1.8.0 prefers theGITHUB_TOKENenv var over itsgithub-tokeninput, so it never uses the job token.dependabot-changeset.ymldrops fromcontents: write+pull-requests: readtocontents: read. Theghlookup, the PR checkout, and the push all use the bot token.Unpinned or untrusted code
eas-clito 27.1.0 instead oflatest. That's the newest release past a 7-day cooldown.--immutable. Its secrets move from job-levelenvto the test step, so dependency install scripts no longer see them.github.event.pull_request.user.logininstead of the spoofablegithub.actor.Credentials and injection
persist-credentials: falseis set on every checkout that doesn't push. The release checkout and the Dependabot PR-branch checkout keep the bot token because later steps push with it. Each has an inlinezizmor: ignore[artipacked]explaining why.env:instead of${{ }}interpolation. The pre.json guard usesjq --arg.Keeping it that way
github-actions, with a 7-day cooldown, grouped into one PR.GitHub Actions Securityworkflow runs zizmor 1.31.1 viazizmor-actionv0.8.0 on changes under.github/..github/zizmor.ymlrequires a full SHA for every action, includingactions/*, which zizmor allows on tags by default.secrets-outside-envis disabled until secrets move into environments.Follow-ups that need repo or org settings
NPM_TOKENandKNOCK_ENG_BOT_GITHUB_TOKENinto a protectedreleaseenvironment.Todos
pushtomainand on Dependabot PRs, so this PR's CI can't exercise them.Checklist
actions/checkout@v4,dorny/paths-filter@v3, and a${{ github.event.pull_request.title }}injection fails it with exit code 14. actionlint 1.7.7 is clean.