Closed
Conversation
Contributor
📝 WalkthroughWalkthroughA GitHub Actions workflow trigger is modified from Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs). Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/claude-code-review.yml:
- Line 4: The workflow uses pull_request_target which, combined with
actions/checkout without a ref and the CLAUDE_CODE_OAUTH_TOKEN plus
pull-requests: write permission, allows untrusted PR code to run with repo
secrets; either change the event from pull_request_target to pull_request, or if
pull_request_target is required: modify the checkout step in the workflow to
check out the base SHA only (set the ref to the base commit and add
persist-credentials: false), pin any third-party action usages (replace mutable
tags like `@beta` with commit SHAs), and tighten GITHUB_TOKEN permissions (remove
or reduce pull-requests: write) to eliminate the secret exfiltration path.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 82fada63-05c1-4298-a807-1136bd56783c
📒 Files selected for processing (1)
.github/workflows/claude-code-review.yml
|
|
||
| on: | ||
| pull_request: | ||
| pull_request_target: |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/claude-code-review.ymlRepository: zenstackhq/zenstack
Length of output: 3984
🌐 Web query:
GitHub Actions pull_request_target security risks forked pull requests secrets write permissions
💡 Result:
Why pull_request_target is risky with forked PRs
- It runs with the base repository trust/permissions, not the fork’s. That means the workflow can get repository secrets (and can also access “trusted” secret stores in cases where
pull_requestwould be blocked). (docs.github.com) - If your workflow checks out and executes PR code (e.g.,
actions/checkoutatgithub.event.pull_request.head.shaor otherwise runs code from the fork), you can end up running attacker-controlled code with secrets available, enabling secret exfiltration (“pwn request”) and follow-on compromise. (securitylab.github.com) - The built-in
GITHUB_TOKENmay have write capabilities unless you explicitly restrict it, so a compromised run can potentially push commits/tags, open/modify PRs, create releases, edit issues, etc. (depending on granted permissions). (synacktiv.com)
The common “fork PR + secrets + write” failure mode
- Attacker opens a PR from a fork.
- A
pull_request_targetworkflow triggers (base repo context). - The workflow fetches/runs the PR’s code (tests/build scripts, custom actions from the PR, etc.).
- The PR code prints/exfiltrates secrets or uses a write-capable
GITHUB_TOKENto persist changes (e.g., push to the repo, poison artifacts). (securitylab.github.com)
Key mitigations (safe patterns)
- Prefer
pull_requestfor CI on code from forks (GitHub’s default safety model: no secrets + read-only token). (github.blog) - If you must use
pull_request_target(e.g., to comment/label):- Do not check out / run PR code in that workflow. (docs.github.com)
- Set explicit minimal
permissions:forGITHUB_TOKEN(avoid broad write). (github.blog) - Gate any privileged behavior behind maintainer approval/labels and keep the privileged job operating only on trusted refs. (securitylab.github.com)
Recent platform change to be aware of
- GitHub announced changes (Nov 7, 2025) to reduce edge cases by ensuring the default branch is the workflow source for
pull_request_target-related evaluation, but GitHub still emphasizes that usingpull_request_targetwith fork PRs remains inherently higher risk because it executes based on user-supplied PRs and can access secrets. (github.blog)
Citations:
- 1: https://docs.github.com/en/enterprise-server%40latest/actions/security-guides/security-hardening-for-github-actions?utm_source=openai
- 2: https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/?utm_source=openai
- 3: https://www.synacktiv.com/publications/github-actions-exploitation-introduction?utm_source=openai
- 4: https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/?utm_source=openai
- 5: https://github.blog/security/supply-chain-security/four-tips-to-keep-your-github-actions-workflows-secure/?utm_source=openai
- 6: https://docs.github.com/en/enterprise-server%40latest/actions/security-guides/security-hardening-for-github-actions?utm_source=openai
- 7: https://github.blog/security/vulnerability-research/how-to-catch-github-actions-workflow-injections-before-attackers-do/?utm_source=openai
- 8: https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/?utm_source=openai
- 9: https://github.blog/changelog/2025-11-07-actions-pull_request_target-and-environment-branch-protections-changes?utm_source=openai
pull_request_target with untrusted PR checkout creates secret exfiltration risk
Line 4 enables pull_request_target, which runs this workflow with base-repository secrets and permissions. However, the actions/checkout@v4 call (lines 30–32) does not specify a ref, causing it to check out the PR's head code (attacker-controlled). Combined with the available CLAUDE_CODE_OAUTH_TOKEN secret and pull-requests: write permission, this creates a direct path for secret exfiltration: a malicious PR could extract the token or abuse the write scope during the action's execution.
Either switch to pull_request (revokes secrets, read-only token) or apply all three mitigations if pull_request_target is mandatory:
- Checkout base SHA only with
persist-credentials: falseto prevent untrusted code execution with secrets in scope. - Pin the third-party action by commit SHA instead of the
@betatag. - Restrict
GITHUB_TOKENpermissions further if possible.
Hardening diff
- name: Checkout repository
uses: actions/checkout@v4
with:
+ ref: ${{ github.event.pull_request.base.sha }}
fetch-depth: 1
+ persist-credentials: false
- name: Run Claude Code Review
id: claude-review
- uses: anthropics/claude-code-action@beta
+ uses: anthropics/claude-code-action@<commit-sha>
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/claude-code-review.yml at line 4, The workflow uses
pull_request_target which, combined with actions/checkout without a ref and the
CLAUDE_CODE_OAUTH_TOKEN plus pull-requests: write permission, allows untrusted
PR code to run with repo secrets; either change the event from
pull_request_target to pull_request, or if pull_request_target is required:
modify the checkout step in the workflow to check out the base SHA only (set the
ref to the base commit and add persist-credentials: false), pin any third-party
action usages (replace mutable tags like `@beta` with commit SHAs), and tighten
GITHUB_TOKEN permissions (remove or reduce pull-requests: write) to eliminate
the secret exfiltration path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Note: This release contains no user-facing changes. The update addresses internal development infrastructure and does not impact your experience with the application.