add renovate#1221
Conversation
|
Preview (prod backend + PR dashboard) → https://1221.ns-preview.trapti.tech/ |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughウォークスルーRenovateボット統合を実装する。新しい設定ファイルがボットの認証情報とリポジトリスコープを定義し、GitHub Actionsワークフローがスケジュール・手動・CI完了・mainプッシュでRenovateを実行する。 変更内容Renovate Bot統合
推定レビュー工数🎯 2 (Simple) | ⏱️ ~10分 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/renovate.yaml:
- Line 41: The current workflow_run if condition only checks head_branch prefix
and allows runs from forks to satisfy the guard; update the condition on that
line to also require the run originated from the same repository by adding a
check that github.event.workflow_run.head_repository.full_name ==
github.repository (combine with the existing startsWith check using && inside
the negated expression) so secrets like RENOVATE_APP_ID and
RENOVATE_APP_PRIVATE_KEY are only exposed for runs from the same repo.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9f31731d-b176-4657-8acc-eda5dcc036a5
📒 Files selected for processing (2)
.github/renovate-bot.json5.github/workflows/renovate.yaml
| name: Renovate | ||
| runs-on: ubuntu-latest | ||
| # Exclude dispatch from non-renovate checks | ||
| if: ${{ !(github.event_name == 'workflow_run' && !startsWith(github.event.workflow_run.head_branch, 'renovate/')) }} |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
GitHub Actions workflow_run secrets security best practices head_repository.full_name same repository check
💡 Result:
For GitHub Actions workflows triggered by the workflow_run event, which can access repository secrets even if the triggering workflow could not (e.g., from a fork), a key security best practice is to verify that the triggering workflow originated from the same repository before using secrets or performing sensitive actions. This prevents potential supply chain attacks where a malicious workflow in a forked repository triggers a privileged downstream workflow. Use a job-level or step-level if condition to check if the head repository (where the triggering workflow ran) matches the current repository: if: ${{ github.event.workflow_run.head_repository.full_name == github.repository }} Example workflow snippet: on: workflow_run: workflows: ["build"] # Specific triggering workflow(s) types: [completed] branches: [main] # Restrict to trusted branches [1][2][3] jobs: deploy: if: >- github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_repository.full_name == github.repository runs-on: ubuntu-latest permissions: contents: read # Use minimal permissions [4][5] steps: - uses: actions/checkout@v4 - name: Deploy run: echo "Using secrets safely" env: SECRET: ${{ secrets.MY_SECRET }} Additional best practices for secrets in workflow_run contexts [4][6][7][8][3]: - Set default workflow permissions to read-only contents: permissions: { contents: read } at workflow level. - Filter strictly: specify workflows, branches, and require success conclusion. - Use OIDC for cloud credentials instead of long-lived secrets [4][9]. - Pin actions to full SHA commits. - Audit and rotate secrets regularly [6][7]. - Avoid logging secrets; use::add-mask:: [4]. The github.event.workflow_run object mirrors the workflow_run webhook payload, which includes head_repository (the repo of the commit that triggered the upstream workflow) with full_name property, analogous to pull_request.head.repo.full_name used in PR security checks [10][11][12][13].
Citations:
- 1: https://docs.github.com/en/actions/reference/events-that-trigger-workflows
- 2: https://docs.github.com/en/actions/reference/github_token-reference
- 3: https://actsense.dev/vulnerabilities/dangerous_event/
- 4: https://docs.github.com/actions/security-guides/using-secrets-in-github-actions
- 5: https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-githubs-security-features-to-secure-your-use-of-github-actions
- 6: https://docs.github.com/en/enterprise-server@3.13/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions?learn=getting_started&learnProduct=actions
- 7: https://docs.github.com/en/actions/reference/secure-use-reference
- 8: https://www.stepsecurity.io/blog/github-actions-secrets-management-best-practices
- 9: https://dev.to/devopsstart/github-actions-security-how-to-stop-secret-leaks-in-cicd-2nh5
- 10: https://docs.github.com/en/rest/actions/workflow-runs?apiVersion=2026-03-10
- 11: https://stackoverflow.com/questions/70775445/determining-the-origin-repo-of-pull-request-in-workflow-yaml
- 12: https://docs.github.com/en/actions/reference/contexts-reference
- 13: https://pygithub.readthedocs.io/en/v1.59.1/github_objects/WorkflowRun.html
🏁 Script executed:
#!/bin/bash
# Find and examine the renovate workflow file
find . -name "renovate.yaml" -o -name "renovate.yml" | head -5Repository: traPtitech/NeoShowcase
Length of output: 100
🏁 Script executed:
#!/bin/bash
# Examine the renovate.yaml file to see the full context
cat -n .github/workflows/renovate.yaml | head -60Repository: traPtitech/NeoShowcase
Length of output: 2165
🏁 Script executed:
#!/bin/bash
# Check the rest of the file to see what secrets are used and the full job definition
cat -n .github/workflows/renovate.yaml | tail -20Repository: traPtitech/NeoShowcase
Length of output: 1115
workflow_run の許可条件が不十分で、シークレット利用ジョブへの権限昇格攻撃に対して脆弱です。
Line 41 の条件は head_branch の接頭辞のみで判定しており、トリガー元が同一リポジトリかを検証していません。フォークされたリポジトリからのワークフロー実行でも条件を満たし、RENOVATE_APP_ID および RENOVATE_APP_PRIVATE_KEY シークレットが露出する可能性があります。github.event.workflow_run.head_repository.full_name == github.repository を条件に追加してください。
修正例
- if: ${{ !(github.event_name == 'workflow_run' && !startsWith(github.event.workflow_run.head_branch, 'renovate/')) }}
+ if: ${{ github.event_name != 'workflow_run' || (
+ startsWith(github.event.workflow_run.head_branch, 'renovate/') &&
+ github.event.workflow_run.head_repository.full_name == github.repository
+ ) }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/renovate.yaml at line 41, The current workflow_run if
condition only checks head_branch prefix and allows runs from forks to satisfy
the guard; update the condition on that line to also require the run originated
from the same repository by adding a check that
github.event.workflow_run.head_repository.full_name == github.repository
(combine with the existing startsWith check using && inside the negated
expression) so secrets like RENOVATE_APP_ID and RENOVATE_APP_PRIVATE_KEY are
only exposed for runs from the same repo.
3 participants
なぜやるか
renovateをとりあえず導入して動くかどうか
やったこと
おそらく動く形で導入
portalリポジトリを参照
(https://github.com/traPtitech/portal/pull/397/changes#diff-b445d5313b5628d2bf175b2af0a3c9417e131d068126930edd61266daed59e40R1-R3)
やらなかったこと
renovateのファイルは分割しなかった
資料
なし
Summary by CodeRabbit