ci: restore fork builds with checkout v6.1 #7474
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -41,6 +41,8 @@ jobs: | |
| uses: actions/checkout@v6 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| allow-unsafe-pr-checkout: true | ||
| persist-credentials: false | ||
|
Comment on lines
43
to
+45
There was a problem hiding this comment. 🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
for f in .github/workflows/build-container.yml .github/workflows/build-depends.yml .github/workflows/build-src.yml .github/workflows/cache-depends-sources.yml .github/workflows/guix-build.yml .github/workflows/lint.yml .github/workflows/test-src.yml; do
echo "===== $f ====="
echo "--- triggers ---"
sed -n '1,120p' "$f" | sed -n '/^on:/,/^[^[:space:]-]/p'
echo "--- cited regions ---"
case "$f" in
.github/workflows/build-container.yml)
sed -n '1,180p' "$f" | nl -ba | sed -n '35,50p;80,95p;128,142p'
;;
.github/workflows/build-depends.yml)
sed -n '1,220p' "$f" | nl -ba | sed -n '48,62p;132,146p'
;;
.github/workflows/build-src.yml)
sed -n '1,140p' "$f" | nl -ba | sed -n '52,68p'
;;
.github/workflows/cache-depends-sources.yml)
sed -n '1,90p' "$f" | nl -ba | sed -n '18,32p'
;;
.github/workflows/guix-build.yml)
sed -n '1,170p' "$f" | nl -ba | sed -n '24,38p;85,99p'
;;
.github/workflows/lint.yml)
sed -n '1,90p' "$f" | nl -ba | sed -n '20,34p'
;;
.github/workflows/test-src.yml)
sed -n '1,110p' "$f" | nl -ba | sed -n '32,44p'
;;
esac
echo
doneRepository: dashpay/dash Length of output: 1057 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Show each workflow trigger and the job steps around the referenced checkout blocks.
for f in .github/workflows/build-container.yml .github/workflows/build-depends.yml .github/workflows/build-src.yml .github/workflows/cache-depends-sources.yml .github/workflows/guix-build.yml .github/workflows/lint.yml .github/workflows/test-src.yml; do
echo "===== $f ====="
echo "--- trigger and job names ---"
python3 - <<'PY' "$f"
import sys, yaml, pathlib
path = pathlib.Path(sys.argv[1])
data = yaml.safe_load(path.read_text())
print(data.get("on"))
print("jobs:", list(data.get("jobs", {}).keys()))
PY
echo "--- cited regions ---"
case "$f" in
.github/workflows/build-container.yml)
nl -ba "$f" | sed -n '35,50p;80,95p;128,142p'
;;
.github/workflows/build-depends.yml)
nl -ba "$f" | sed -n '48,62p;132,146p'
;;
.github/workflows/build-src.yml)
nl -ba "$f" | sed -n '52,68p'
;;
.github/workflows/cache-depends-sources.yml)
nl -ba "$f" | sed -n '18,32p'
;;
.github/workflows/guix-build.yml)
nl -ba "$f" | sed -n '24,38p;85,99p'
;;
.github/workflows/lint.yml)
nl -ba "$f" | sed -n '20,34p'
;;
.github/workflows/test-src.yml)
nl -ba "$f" | sed -n '32,44p'
;;
esac
echo
doneRepository: dashpay/dash Length of output: 354 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Read the workflow sections directly in case Python YAML isn't available.
for f in .github/workflows/build-container.yml .github/workflows/build-depends.yml .github/workflows/build-src.yml .github/workflows/cache-depends-sources.yml .github/workflows/guix-build.yml .github/workflows/lint.yml .github/workflows/test-src.yml; do
echo "===== $f ====="
echo "--- first 80 lines ---"
nl -ba "$f" | sed -n '1,80p'
echo "--- around cited lines ---"
case "$f" in
.github/workflows/build-container.yml)
nl -ba "$f" | sed -n '35,50p;80,95p;128,142p'
;;
.github/workflows/build-depends.yml)
nl -ba "$f" | sed -n '48,62p;132,146p'
;;
.github/workflows/build-src.yml)
nl -ba "$f" | sed -n '52,68p'
;;
.github/workflows/cache-depends-sources.yml)
nl -ba "$f" | sed -n '18,32p'
;;
.github/workflows/guix-build.yml)
nl -ba "$f" | sed -n '24,38p;85,99p'
;;
.github/workflows/lint.yml)
nl -ba "$f" | sed -n '20,34p'
;;
.github/workflows/test-src.yml)
nl -ba "$f" | sed -n '32,44p'
;;
esac
echo
doneRepository: dashpay/dash Length of output: 263 🏁 Script executed: #!/bin/bash
set -euo pipefail
for f in .github/workflows/build-container.yml .github/workflows/build-depends.yml .github/workflows/build-src.yml .github/workflows/cache-depends-sources.yml .github/workflows/guix-build.yml .github/workflows/lint.yml .github/workflows/test-src.yml; do
echo "FILE: $f"
grep -nE '^(on:| pull_request_target:| pull_request:| workflow_dispatch:|jobs:| - uses: actions/checkout@| ref:| allow-unsafe-pr-checkout:| persist-credentials:| - run:| - name: )' "$f" | sed -n '1,120p'
echo
doneRepository: dashpay/dash Length of output: 3401 🏁 Script executed: #!/bin/bash
set -euo pipefail
rg -n "allow-unsafe-pr-checkout|pull_request_target|actions/checkout@" .github/workflowsRepository: dashpay/dash Length of output: 3577 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== callers of workflow_call files ==="
rg -n "uses:\s*\./\.github/workflows/(build-container|build-depends|build-src|cache-depends-sources|guix-build|lint|test-src)\.yml" .github/workflows
echo
echo "=== build.yml trigger + relevant jobs ==="
sed -n '1,220p' .github/workflows/build.yml | awk 'NR>=1 && NR<=220 {print NR ":" $0}'
echo
echo "=== workflow_call declarations for the reviewed files ==="
for f in .github/workflows/build-container.yml .github/workflows/build-depends.yml .github/workflows/build-src.yml .github/workflows/cache-depends-sources.yml .github/workflows/guix-build.yml .github/workflows/lint.yml .github/workflows/test-src.yml; do
echo "--- $f ---"
rg -n "^(on:| workflow_call:| pull_request_target:| pull_request:|permissions:|jobs:)" "$f"
doneRepository: dashpay/dash Length of output: 12381 🏁 Script executed: #!/bin/bash
set -euo pipefail
for f in .github/workflows/build-container.yml .github/workflows/build-depends.yml .github/workflows/build-src.yml .github/workflows/cache-depends-sources.yml .github/workflows/guix-build.yml .github/workflows/lint.yml .github/workflows/test-src.yml; do
echo "===== $f ====="
case "$f" in
.github/workflows/build-container.yml)
sed -n '36,50p;84,95p;128,141p' "$f" | awk '{print NR ":" $0}'
;;
.github/workflows/build-depends.yml)
sed -n '48,60p;134,183p' "$f" | awk '{print NR ":" $0}'
;;
.github/workflows/build-src.yml)
sed -n '54,66p;120,180p' "$f" | awk '{print NR ":" $0}'
;;
.github/workflows/cache-depends-sources.yml)
sed -n '20,40p' "$f" | awk '{print NR ":" $0}'
;;
.github/workflows/guix-build.yml)
sed -n '22,40p;86,125p' "$f" | awk '{print NR ":" $0}'
;;
.github/workflows/lint.yml)
sed -n '22,46p' "$f" | awk '{print NR ":" $0}'
;;
.github/workflows/test-src.yml)
sed -n '34,60p' "$f" | awk '{print NR ":" $0}'
;;
esac
echo
doneRepository: dashpay/dash Length of output: 11992 Do not run fork PR heads in privileged CI jobs. These reusable workflows are called from
🧰 Tools🪛 actionlint (1.7.12)[error] 44-44: input "allow-unsafe-pr-checkout" is not defined in action "actions/checkout@v6". available inputs are "clean", "fetch-depth", "fetch-tags", "filter", "github-server-url", "lfs", "path", "persist-credentials", "ref", "repository", "set-safe-directory", "show-progress", "sparse-checkout", "sparse-checkout-cone-mode", "ssh-key", "ssh-known-hosts", "ssh-strict", "ssh-user", "submodules", "token" (action) 📍 Affects 7 files
🤖 Prompt for AI Agents
Member
There was a problem hiding this comment. Show an actual exploit / problem, and we can try to make it happen. But we currently need this for our builds.
this is only used for ci artifacts. If we can make improvements without breakage, I'm happy to minimize permissions we give tokens etc. There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== reusable workflow callers and permissions ==='
rg -n -C 8 \
'pull_request_target:|permissions:|uses:\s*\./\.github/workflows/build-container\.yml|packages:\s*(write|read)|contents:\s*(write|read)' \
.github/workflows
echo
echo '=== build-container call sites (full job context) ==='
rg -n -C 16 'uses:\s*\./\.github/workflows/build-container\.yml' .github/workflows
echo
echo '=== GHCR image/tag references and build-container inputs ==='
rg -n -C 4 \
'ghcr\.io/|build-container\.yml|container_name:|name:.*container|context:|file:' \
.github/workflows .github Dockerfile* 2>/dev/null || true
echo
echo '=== workflow file inventory ==='
fd -t f -e yml -e yaml .github/workflows | sortLength of output: 34527 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== CI workflow: container outputs and downstream consumers ==='
sed -n '1,260p' .github/workflows/build.yml | nl -ba
echo
echo '=== container-path consumers and container image declarations ==='
rg -n -C 10 \
'container-path|container:\s|image:\s*\$\{\{|ghcr\.io/\$\{\{.*dashcore-ci|dashcore-ci-(runner|slim)' \
.github/workflows
echo
echo '=== relevant reusable-workflow execution and checkout sections ==='
for f in \
.github/workflows/build-depends.yml \
.github/workflows/build-src.yml \
.github/workflows/test-src.yml \
.github/workflows/lint.yml; do
echo "--- $f ---"
rg -n -C 8 'container-path|container:|image:|actions/checkout@v6|run:' "$f"
doneLength of output: 1120 🤖 web_search executed:
Length of output: 18827 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== CI workflow (downstream jobs after reusable container calls) ==='
sed -n '90,260p' .github/workflows/build.yml
echo
echo '=== container-path/image consumers ==='
rg -n -C 12 \
'container-path|container:\s|image:\s*\$\{\{|dashcore-ci-(runner|slim)|ghcr\.io/' \
.github/workflows
echo
echo '=== reusable workflow container declarations ==='
for f in \
.github/workflows/build-depends.yml \
.github/workflows/build-src.yml \
.github/workflows/test-src.yml \
.github/workflows/lint.yml; do
echo "--- $f ---"
rg -n -C 8 'container-path|container:|image:|actions/checkout@v6|run:' "$f" || true
doneLength of output: 68343
A fork PR can:
This is not limited to an isolated artifact: the image output is passed directly to the subsequent CI jobs. Additionally, I would not run a live token-exfiltration proof of concept against the project. GitHub explicitly documents this checkout-and-execute pattern as insecure: https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target. Their A minimally disruptive direction is:
That preserves fork CI, but removes the fork → upstream package → privileged execution chain. The existing |
||
|
|
||
| - name: Prepare variables | ||
| id: prepare | ||
|
|
@@ -85,6 +87,8 @@ jobs: | |
| uses: actions/checkout@v6 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| allow-unsafe-pr-checkout: true | ||
| persist-credentials: false | ||
|
|
||
| - name: Prepare variables | ||
| id: prepare | ||
|
|
@@ -128,6 +132,8 @@ jobs: | |
| uses: actions/checkout@v6 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| allow-unsafe-pr-checkout: true | ||
| persist-credentials: false | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v4 | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For fork PRs,
build.ymlinvokes this reusable workflow frompull_request_targetwhile grantingpackages: write; this opt-in now permits the fork-controlled commit to modify the CI Dockerfile and havedocker/build-push-actionpublish the resulting arbitrary image to the repository's GHCR package.persist-credentials: falseonly removes Git's persisted credential and does not prevent the laterdocker/login-actionfrom supplyingGITHUB_TOKENfor the push. This turns any opened fork PR into a package-publication path; run untrusted heads in a read-onlypull_requestworkflow, or keep the privileged workflow checked out at the trusted base revision.Useful? React with 👍 / 👎.