Skip to content

[GSoC-273] Fix: Vulnerability in the action beam_infrastructure_users_permission - #39811

Open
HansMarcus01 wants to merge 11 commits into
apache:masterfrom
HansMarcus01:fix-infra-user-roles-action
Open

[GSoC-273] Fix: Vulnerability in the action beam_infrastructure_users_permission #39811
HansMarcus01 wants to merge 11 commits into
apache:masterfrom
HansMarcus01:fix-infra-user-roles-action

Conversation

@HansMarcus01

@HansMarcus01 HansMarcus01 commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Summary of changes

This PR completely refactors the checkout strategy in .github/workflows/beam_UserRoles.yml to resolve a critical "pwn request" security vulnerability and unblock Terraform deployments from forks.

The problem

The previous workflow attempted a full checkout of untrusted fork code within a highly privileged pull_request_target context. This exposed GCP credentials and secrets to potential malicious scripts. Consequently, GitHub Actions securely blocked the checkout, breaking the IAM CI/CD pipeline.

The Solution: Dual Secure Checkout

We implemented a safe, two-step checkout process utilizing Git's sparse-checkout:

  • Secure Code Checkout: Checks out the trusted, reviewed Terraform configurations and executable scripts directly from the base branch (master).
  • Isolated Data Checkout: Uses sparse-checkout to surgically fetch only the modified infra/iam/users.yml data file from the incoming PR.
  • Safe Integration: Overwrites the base users.yml with the PR's dataset before running Terraform.

Key Benefits

  • Zero Security Risk: Only trusted executable code from master is run, making malicious script injection impossible.
  • Restored Validation: Terraform plan works perfectly against the new data, correctly posting the comparison in PR comments.

Test & Validations

# Checkout secure master code
Run actions/checkout@v7
Syncing repository: HansMarcus01/beam
Getting Git version info
Temporarily overriding HOME='/home/runner/work/_temp/64af2962-f7a6-481a-876e-149529d908e4' before making global git config changes
Adding repository directory to the temporary git global config as a safe directory
/usr/bin/git config --global --add safe.directory /home/runner/work/beam/beam
Deleting the contents of '/home/runner/work/beam/beam'
Determining repository object format
Initializing the repository
Disabling automatic garbage collection
Setting up auth
Fetching the repository
Determining the checkout info
/usr/bin/git sparse-checkout disable
/usr/bin/git config --local --unset-all extensions.worktreeConfig
Checking out the ref
/usr/bin/git log -1 --format=%H
7e4be7865b7b309b89a8a0f02f0fcff3eb9d2b4a
Removing auth
# Download users.yml directly from PR fork
Run echo "[DevSecOps] Downloading users.yml directly from the Pull Request fork..."
[DevSecOps] Downloading users.yml directly from the Pull Request fork...

Test performed from my personal fork, verifying that the action downloads the code from the secure master branch, thereby avoiding potential vulnerability issues associated with downloading the entire codebase from the fork.
@HansMarcus01#4

@github-actions github-actions Bot added the build label Aug 19, 2026
Comment thread .github/workflows/beam_Infrastructure_UsersPermissions.yml Fixed
@github-actions

Copy link
Copy Markdown
Contributor

Checks are failing. Will not request review until checks are succeeding. If you'd like to override that behavior, comment assign set of reviewers

Comment thread .github/workflows/beam_Infrastructure_UsersPermissions.yml Fixed
@github-actions

Copy link
Copy Markdown
Contributor

Assigning reviewers:

R: @liferoad for label build.

Note: If you would like to opt out of this review, comment assign to next reviewer.

Available commands:

  • stop reviewer notifications - opt out of the automated review tooling
  • remind me after tests pass - tag the comment author after tests pass
  • waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).

Comment thread .github/workflows/beam_Infrastructure_UsersPermissions.yml Outdated
@pabloem

pabloem commented Aug 19, 2026

Copy link
Copy Markdown
Member

please add a sample test where you modify users.yml so we can see it working

… -m "Adds a dummy test user 'finops_test_user' to trigger and validate the new secure dual-checkout GitHub Actions workflow in the PR plan.
Returning the script to a production state after completing testing.
…evention)

The beam_Infrastructure_UsersPermissions workflow was failing on PRs from forks due to the 'actions/checkout' step blocking untrusted code execution in a 'pull_request_target' context.

This commit resolves the security warning without exposing the runner to malicious code:
1. Checked out the trusted base repository code (`github.base_ref`) instead of the untrusted PR head.
2. Added a specific step to fetch ONLY the untrusted data file (`users.yml`) from the PR if it's not yet merged.
3. This allows `terraform plan` to safely evaluate the user's requested changes using trusted Terraform files (`.tf`).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants