Skip to content

add renovate #1221

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pirosiki197 merged 2 commits into from
May 19, 2026
Merged

add renovate #1221

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
94e7d4e
add renovate
y33550336 May 11, 2026
a20871c
空行入れた
y33550336 May 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/renovate-bot.json5
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"username": "trap-renovate[bot]",
"gitAuthor": "trap-renovate <138502363+trap-renovate[bot]@users.noreply.github.com>",
"repositories": ["traPtitech/NeoShowcase"]
}
64 changes: 64 additions & 0 deletions .github/workflows/renovate.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,64 @@
name: Renovate

permissions:
contents: write

on:
# For manual dispatch
workflow_dispatch:
inputs:
dryRun:
description: Dry-Run
default: "false"
required: false
logLevel:
description: Log-Level
default: debug
required: false
# For auto-merge - should exclude non-renovate branch dispatches in job definitions below
workflow_run:
workflows:
- CI
types:
- completed
schedule:
# 5 a.m. in JST(+9)
- cron: "0 20 * * *"
# For auto-merge and rebasing
push:
branches: ["main"]

env:
LOG_LEVEL: debug
RENOVATE_DRY_RUN: false
RENOVATE_CONFIG_FILE: .github/renovate-bot.json5

jobs:
renovate:
name: Renovate
runs-on: ubuntu-latest
# Exclude dispatch from non-renovate checks
if: ${{ !(github.event_name == 'workflow_run' && !startsWith(github.event.workflow_run.head_branch, 'renovate/')) }}

@coderabbitai coderabbitai Bot May 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

GitHub Actions workflow_run secrets security best practices head_repository.full_name same repository check

💡 Result:

For GitHub Actions workflows triggered by the workflow_run event, which can access repository secrets even if the triggering workflow could not (e.g., from a fork), a key security best practice is to verify that the triggering workflow originated from the same repository before using secrets or performing sensitive actions. This prevents potential supply chain attacks where a malicious workflow in a forked repository triggers a privileged downstream workflow. Use a job-level or step-level if condition to check if the head repository (where the triggering workflow ran) matches the current repository: if: ${{ github.event.workflow_run.head_repository.full_name == github.repository }} Example workflow snippet: on: workflow_run: workflows: ["build"] # Specific triggering workflow(s) types: [completed] branches: [main] # Restrict to trusted branches [1][2][3] jobs: deploy: if: >- github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_repository.full_name == github.repository runs-on: ubuntu-latest permissions: contents: read # Use minimal permissions [4][5] steps: - uses: actions/checkout@v4 - name: Deploy run: echo "Using secrets safely" env: SECRET: ${{ secrets.MY_SECRET }} Additional best practices for secrets in workflow_run contexts [4][6][7][8][3]: - Set default workflow permissions to read-only contents: permissions: { contents: read } at workflow level. - Filter strictly: specify workflows, branches, and require success conclusion. - Use OIDC for cloud credentials instead of long-lived secrets [4][9]. - Pin actions to full SHA commits. - Audit and rotate secrets regularly [6][7]. - Avoid logging secrets; use::add-mask:: [4]. The github.event.workflow_run object mirrors the workflow_run webhook payload, which includes head_repository (the repo of the commit that triggered the upstream workflow) with full_name property, analogous to pull_request.head.repo.full_name used in PR security checks [10][11][12][13].

Citations:

🏁 Script executed:

#!/bin/bash
# Find and examine the renovate workflow file
find . -name "renovate.yaml" -o -name "renovate.yml" | head -5

Repository: traPtitech/NeoShowcase

Length of output: 100

🏁 Script executed:

#!/bin/bash
# Examine the renovate.yaml file to see the full context
cat -n .github/workflows/renovate.yaml | head -60

Repository: traPtitech/NeoShowcase

Length of output: 2165

🏁 Script executed:

#!/bin/bash
# Check the rest of the file to see what secrets are used and the full job definition
cat -n .github/workflows/renovate.yaml | tail -20

Repository: traPtitech/NeoShowcase

Length of output: 1115

workflow_run の許可条件が不十分で、シークレット利用ジョブへの権限昇格攻撃に対して脆弱です。

Line 41 の条件は head_branch の接頭辞のみで判定しており、トリガー元が同一リポジトリかを検証していません。フォークされたリポジトリからのワークフロー実行でも条件を満たし、RENOVATE_APP_ID および RENOVATE_APP_PRIVATE_KEY シークレットが露出する可能性があります。github.event.workflow_run.head_repository.full_name == github.repository を条件に追加してください。

修正例 
-    if: ${{ !(github.event_name == 'workflow_run' && !startsWith(github.event.workflow_run.head_branch, 'renovate/')) }}
+    if: ${{ github.event_name != 'workflow_run' || (
+      startsWith(github.event.workflow_run.head_branch, 'renovate/') &&
+      github.event.workflow_run.head_repository.full_name == github.repository
+    ) }}
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/renovate.yaml at line 41, The current workflow_run if
condition only checks head_branch prefix and allows runs from forks to satisfy
the guard; update the condition on that line to also require the run originated
from the same repository by adding a check that
github.event.workflow_run.head_repository.full_name == github.repository
(combine with the existing startsWith check using && inside the negated
expression) so secrets like RENOVATE_APP_ID and RENOVATE_APP_PRIVATE_KEY are
only exposed for runs from the same repo.

steps:
- name: Generate a token
id: generate-token
uses: actions/create-github-app-token@v3
with:
app-id: ${{ secrets.RENOVATE_APP_ID }}
private-key: ${{ secrets.RENOVATE_APP_PRIVATE_KEY }}
- uses: actions/checkout@v6
- name: Override default config from dispatch variables
shell: bash
env:
INPUT_DRY_RUN: ${{ github.event.inputs.dryRun }}
INPUT_LOG_LEVEL: ${{ github.event.inputs.logLevel }}
run: |
echo "RENOVATE_DRY_RUN=${INPUT_DRY_RUN:-$RENOVATE_DRY_RUN}" >> "${GITHUB_ENV}"
echo "LOG_LEVEL=${INPUT_LOG_LEVEL:-$LOG_LEVEL}" >> "${GITHUB_ENV}"
- name: Renovate
uses: renovatebot/github-action@v46.1.6
with:
renovate-image: "ghcr.io/renovatebot/renovate"
renovate-version: "latest"
configurationFile: "${{ env.RENOVATE_CONFIG_FILE }}"
token: "${{ steps.generate-token.outputs.token }}"
Loading