fix: pin 35 unpinned action(s),extract 22 unsafe expression(s) to env vars#8605
Closed
dagecko wants to merge 1 commit intoAppFlowy-IO:mainfrom
Closed
fix: pin 35 unpinned action(s),extract 22 unsafe expression(s) to env vars#8605dagecko wants to merge 1 commit intoAppFlowy-IO:mainfrom
dagecko wants to merge 1 commit intoAppFlowy-IO:mainfrom
Conversation
… vars Automated security fixes applied by Runner Guard (https://github.com/Vigilant-LLC/runner-guard). Changes: .github/workflows/build_command.yml | 5 +- .github/workflows/commit_lint.yml | 2 +- .github/workflows/docker_ci.yml | 4 +- .github/workflows/flutter_ci.yaml | 12 ++-- .github/workflows/ios_ci.yaml | 8 +-- .github/workflows/mobile_ci.yml | 2 +- .github/workflows/ninja_i18n.yml | 2 +- .github/workflows/release.yml | 98 +++++++++++++++++++++----------- .github/workflows/rust_ci.yaml | 6 +- .github/workflows/rust_coverage.yml | 6 +- .github/workflows/translation_notify.yml | 2 +- 11 files changed, 92 insertions(+), 55 deletions(-)
Contributor
Reviewer's GuideHardens multiple GitHub Actions workflows by pinning third-party actions to specific commit SHAs and moving inline GitHub/secret expressions out of shell commands into env variables to reduce injection and supply-chain risk, while preserving existing CI/CD behavior. Sequence diagram for the hardened release workflow using env vars and pinned actionssequenceDiagram
actor Developer
participant GitHub
participant ReleaseWorkflow
participant FlutterAction as subosito_flutter_action_pinned
participant RustToolchain as actions_rs_toolchain_pinned
participant DockerBuildx as docker_setup_buildx_pinned
participant DockerBuildPush as docker_build_push_pinned
participant MacSigner as macos_codesign_tools
participant AppleNotary as apple_notary_service
participant Discord as discord_api
Developer->>GitHub: Push tag ref (release version)
GitHub->>ReleaseWorkflow: Trigger release_yml on tag
Note over ReleaseWorkflow: Initialize env REF_NAME from github_ref_name
ReleaseWorkflow->>ReleaseWorkflow: Build release notes using ${REF_NAME}
ReleaseWorkflow->>FlutterAction: Setup Flutter (pinned SHA)
FlutterAction-->>ReleaseWorkflow: Flutter available
ReleaseWorkflow->>RustToolchain: Install Rust toolchain (pinned SHA)
RustToolchain-->>ReleaseWorkflow: Rust toolchain ready
Note over ReleaseWorkflow: Use env REF_NAME in flutter and cargo build commands
ReleaseWorkflow->>MacSigner: Decode MACOS_CERTIFICATE env and import key
MacSigner-->>ReleaseWorkflow: Signing identities configured
ReleaseWorkflow->>MacSigner: Codesign AppFlowy using MACOS_CODESIGN_ID env
MacSigner-->>ReleaseWorkflow: Signed macOS app
ReleaseWorkflow->>AppleNotary: Notarize dmg with MACOS_NOTARY_USER, MACOS_TEAM_ID, MACOS_NOTARY_PWD env
AppleNotary-->>ReleaseWorkflow: Notarization success
ReleaseWorkflow->>DockerBuildx: Setup Buildx (pinned SHA)
DockerBuildx-->>ReleaseWorkflow: Builder ready
ReleaseWorkflow->>DockerBuildPush: Build and push Docker image (pinned SHA)
DockerBuildPush-->>ReleaseWorkflow: Image pushed
Note over ReleaseWorkflow: Prepare DISCORD env from secret
ReleaseWorkflow->>Discord: POST webhook using ${DISCORD} env
Discord-->>ReleaseWorkflow: Notification accepted
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- There are several places where you duplicate
REF_NAME: ${{ github.ref_name }}env blocks on multiple steps inrelease.yml; consider definingREF_NAMEat the job level to reduce repetition and keep the value consistent across all steps. - In the final Discord notification step in
release.yml, you still interpolate${{ github.ref_name }}directly inside the JSON string; for consistency and easier editing, you might move this into an env var (e.g.REF_NAME) and reference it in thecurlpayload instead. - For
opral/ninja-i18n-actionyou pinned to a raw commit with a# maincomment; if the action exposes version tags, consider pinning to a commit hash that corresponds to a released tag and reflecting that in the comment (e.g.# vX.Y.Z) to make future upgrades clearer.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- There are several places where you duplicate `REF_NAME: ${{ github.ref_name }}` env blocks on multiple steps in `release.yml`; consider defining `REF_NAME` at the job level to reduce repetition and keep the value consistent across all steps.
- In the final Discord notification step in `release.yml`, you still interpolate `${{ github.ref_name }}` directly inside the JSON string; for consistency and easier editing, you might move this into an env var (e.g. `REF_NAME`) and reference it in the `curl` payload instead.
- For `opral/ninja-i18n-action` you pinned to a raw commit with a `# main` comment; if the action exposes version tags, consider pinning to a commit hash that corresponds to a released tag and reflecting that in the comment (e.g. `# vX.Y.Z`) to make future upgrades clearer.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security: Harden GitHub Actions workflows
Hey, we found some CI/CD security issues in this repo's workflows using Runner Guard, our open-source CI/CD security scanner at Vigilant. These are the same vulnerability classes being actively exploited right now in the tj-actions, Trivy, LiteLLM supply chain attack chain. We scanned the top 50K repos on GitHub and over 20,000 have this same problem. We're trying to get fixes out to as many maintainers as possible before more repos get hit.
This PR fixes what we could automatically, and flags anything else that needs a manual look. There's a real person behind this PR, we're actively checking back on comments so if you have any questions just drop them here and we'll respond.
Fixes applied (in this PR)
.github/workflows/build_command.yml.github/workflows/commit_lint.yml.github/workflows/docker_ci.yml.github/workflows/flutter_ci.yaml.github/workflows/ios_ci.yaml.github/workflows/mobile_ci.yml.github/workflows/ninja_i18n.yml.github/workflows/release.yml.github/workflows/release.yml.github/workflows/rust_ci.yaml.github/workflows/rust_coverage.yml.github/workflows/translation_notify.ymlAdvisory: additional findings (manual review recommended)
| Rule | Severity | File | Description |
| RGS-002 | critical |
.github/workflows/release.yml| Expression Injection via Branch Name or Untrusted Input || RGS-014 | high |
.github/workflows/mobile_ci.yml| Expression Injection via workflow_dispatch Input || RGS-012 | high |
.github/workflows/mobile_ci.yml| Secret Exfiltration via Outbound HTTP Request || RGS-012 | high |
.github/workflows/mobile_ci.yml| Secret Exfiltration via Outbound HTTP Request || RGS-012 | high |
.github/workflows/release.yml| Secret Exfiltration via Outbound HTTP Request || RGS-012 | high |
.github/workflows/release.yml| Secret Exfiltration via Outbound HTTP Request |Why this matters
GitHub Actions workflows that use untrusted input in
run:blocks, exposesecrets inline, or use unpinned third-party actions are vulnerable to
code injection, credential theft, and supply chain attacks. These are the same
vulnerability classes exploited in the tj-actions/changed-files incident
and subsequent supply chain attacks, which compromised CI secrets across
thousands of repositories.
How to verify
Review the diff — each change is mechanical and preserves workflow behavior:
${{ }}expressions fromrun:blocks intoenv:mappings, preventing shell injection(original version tag preserved as comment)
Run
brew install Vigilant-LLC/tap/runner-guard && runner-guard scan .or install from therepo to verify.
Found by Runner Guard | Built by Vigilant Cyber Security | Learn more
If this PR is not welcome, just close it -- we won't send another.
Summary by Sourcery
Harden GitHub Actions workflows by pinning third-party actions to specific commit SHAs and isolating GitHub context and secrets usage via environment variables to reduce injection and supply-chain risk.
CI: