From fdabce48ce7f57c8c3e83d4d971cacbac9f40158 Mon Sep 17 00:00:00 2001 From: Philip Meholm Date: Tue, 12 May 2026 01:15:39 +0200 Subject: [PATCH] add: disable non-repo prs from running actions. upd:hardcode checkout version --- .../workflows/dev-changelog-on-pr-open.yml | 28 ++++++------ .github/workflows/dev-dependabot-handler.yml | 12 +++--- .github/workflows/labeler.yml | 10 ++--- .../shared/generate-changelog-file.yaml | 43 +++++++++---------- 4 files changed, 45 insertions(+), 48 deletions(-) diff --git a/.github/workflows/dev-changelog-on-pr-open.yml b/.github/workflows/dev-changelog-on-pr-open.yml index 36e12ee..ac8dc6d 100644 --- a/.github/workflows/dev-changelog-on-pr-open.yml +++ b/.github/workflows/dev-changelog-on-pr-open.yml @@ -5,35 +5,33 @@ on: types: [opened, synchronize, reopened] branches: [dev] -env: - author: ${{ github.event.pull_request.user.login }} - title : ${{ github.event.pull_request.title }} - header: "## Changes" - - jobs: create-changelog-fragment: runs-on: ubuntu-latest - # needs: check_if_changelog_exists - # if: needs.check_if_changelog_exists.outputs.changelog_exists == 'false' + # Reject PRs from forks — pull_request_target runs with repo secrets, + # so we must never checkout or trust fork-controlled content here. + if: github.event.pull_request.head.repo.full_name == github.repository permissions: contents: write + env: + PR_BODY: ${{ github.event.pull_request.body }} + PR_AUTHOR: ${{ github.event.pull_request.user.login }} + PR_TITLE: ${{ github.event.pull_request.title }} steps: - name: Extract changelog from PR body id: extract-changelog run: | - # Use awk to extract content between "${{ github.event.pull_request.body}}" and the next "##" heading. remove multiline comments - content_body=$(echo "${{ github.event.pull_request.body}}" | awk '/^${{env.header}}/{flag=1; next} /^##/{flag=0} flag' | perl -0777 -pe 's///sg' | xargs) + # PR_BODY passed via env var — never interpolate untrusted input directly into shell + content_body=$(printf '%s' "$PR_BODY" | awk '/^## Changes/{flag=1; next} /^##/{flag=0} flag' | perl -0777 -pe 's///sg' | xargs) - if [ -n "$content" ]; then - content="- @${{ env.author }} -> ${{ env.title }} \n $content_body" + if [ -n "$content_body" ]; then + content="- @${PR_AUTHOR} -> ${PR_TITLE} \n $content_body" echo "Changelog content found:" echo "$content" - echo "content=$content" >> $GITHUB_OUTPUT echo "content_found=true" >> $GITHUB_OUTPUT else - echo "No changelog content found under ## Description." + echo "No changelog content found under ## Changes." echo "content_found=false" >> $GITHUB_OUTPUT fi - name: push changelog fragment @@ -42,6 +40,6 @@ jobs: uses: ./.github/workflows/shared/generate-changelog-file.yaml with: changelog_text: ${{ steps.extract-changelog.outputs.content }} - repo: ${{ github.event.pull_request.head.repo.full_name }} + repo: ${{ github.repository }} pr_number: ${{ github.event.pull_request.number }} commit_ref: ${{ github.event.pull_request.head.ref }} diff --git a/.github/workflows/dev-dependabot-handler.yml b/.github/workflows/dev-dependabot-handler.yml index 63228e2..9047b7b 100644 --- a/.github/workflows/dev-dependabot-handler.yml +++ b/.github/workflows/dev-dependabot-handler.yml @@ -6,8 +6,8 @@ on: branches: - dev # Only trigger for PRs targeting the 'dev' branch paths: - - 'go.mod' - - 'go.sum' + - "go.mod" + - "go.sum" jobs: dependabot-go-modules: @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout PR branch - uses: actions/checkout@v4 + uses: actions/checkout@900f2210b1d28bbbd0bd22d17926b9e224e8f231 # v4.2.2 with: ref: ${{ github.event.pull_request.head.sha }} repository: ${{ github.event.pull_request.head.repo.full_name }} @@ -27,7 +27,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v5 with: - go-version-file: 'go.mod' + go-version-file: "go.mod" cache: true - name: Update vendored dependencies @@ -37,9 +37,9 @@ jobs: run: | git config --global user.name 'github-actions[bot]' git config --global user.email 'github-actions[bot]@users.noreply.github.com' - + git add vendor/ - + # Check if there are any changes to commit if ! git diff --staged --quiet; then git commit -m "chore(deps): update vendored dependencies" diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 53e67b0..48fe641 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -1,11 +1,11 @@ name: Pull Request Labeler on: -- pull_request_target + - pull_request_target permissions: - contents: read - pull-requests: write + contents: read + pull-requests: write jobs: labeler: @@ -14,5 +14,5 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - - uses: actions/labeler@v5 \ No newline at end of file + - uses: actions/checkout@900f2210b1d28bbbd0bd22d17926b9e224e8f231 # v4.2.2 + - uses: actions/labeler@v5 diff --git a/.github/workflows/shared/generate-changelog-file.yaml b/.github/workflows/shared/generate-changelog-file.yaml index 0503f7c..c4cc28b 100644 --- a/.github/workflows/shared/generate-changelog-file.yaml +++ b/.github/workflows/shared/generate-changelog-file.yaml @@ -30,64 +30,63 @@ on: jobs: check_file: runs-on: ubuntu-latest + permissions: + contents: read outputs: file_exists: ${{ steps.check_file.outputs.file_exists }} + changelog_path: ${{ steps.generate_file_name.outputs.changelog_path }} steps: - - name: Checkout PR branch - uses: actions/checkout@v5 + - name: Checkout base repo only (never fork) + uses: actions/checkout@900f2210b1d28bbbd0bd22d17926b9e224e8f231 # v4.2.2 with: repository: ${{ inputs.repo }} ref: ${{ inputs.commit_ref }} - - name: generate file name + - name: Generate file name id: generate_file_name run: | - CHANGELOG_PATH="" - # Correctly check the boolean input if [[ "${{ inputs.dependabot_pr }}" == "true" ]]; then - # Note: No spaces around the '=' for variable assignment CHANGELOG_PATH="changelog/current/bump/${{ inputs.pr_number }}.md" else CHANGELOG_PATH="changelog/current/${{ inputs.pr_number }}.md" fi - - # Set the path as an output for later steps - echo "file_exists=$CHANGELOG_PATH" >> $GITHUB_OUTPUT - - name: Check if bump file exists + echo "changelog_path=$CHANGELOG_PATH" >> $GITHUB_OUTPUT + - name: Check if changelog file exists id: check_file run: | - # Check if the changelog fragment file exists - if [ -f "${{ steps.generate_file_name.outputs.changePath }}" ]; then + if [ -f "${{ steps.generate_file_name.outputs.changelog_path }}" ]; then echo "file_exists=true" >> $GITHUB_OUTPUT else echo "file_exists=false" >> $GITHUB_OUTPUT fi write-and-commit: runs-on: ubuntu-latest + permissions: + contents: write needs: check_file if: needs.check_file.outputs.file_exists == 'false' && !inputs.check_changelog_exist + env: + CHANGELOG_TEXT: ${{ inputs.changelog_text }} steps: - - name: Checkout PR branch - uses: actions/checkout@v5 + - name: Checkout base repo only (never fork) + uses: actions/checkout@900f2210b1d28bbbd0bd22d17926b9e224e8f231 # v4.2.2 with: repository: ${{ inputs.repo }} ref: ${{ inputs.commit_ref }} - name: Create changelog run: | - DIR_PATH=$(dirname "${{ needs.check_file.outputs.file_exists }}") - mkdir -p "$DIR_PATH" - - # Create the file - echo "${{ inputs.changelog_text }}" > "${{ needs.check_file.outputs.file_exists }}" + CHANGELOG_PATH="${{ needs.check_file.outputs.changelog_path }}" + mkdir -p "$(dirname "$CHANGELOG_PATH")" + # Write via env var — never interpolate untrusted input directly into shell + printf '%s\n' "$CHANGELOG_TEXT" > "$CHANGELOG_PATH" - name: Commit and push changelog fragment id: commit-changelog run: | git config --global user.name 'github-actions[bot]' git config --global user.email 'github-actions[bot]@users.noreply.github.com' - git add "${{ needs.check_file.outputs.file_exists}}" - # Check if there are any changes to commit before committing + git add "${{ needs.check_file.outputs.changelog_path }}" if ! git diff --staged --quiet; then git commit -m "docs(changelog): create/update fragment for PR #${{ inputs.pr_number }}" git push else echo "No changes to the changelog fragment file." - fi \ No newline at end of file + fi