Félix MalfaitandGitHub
0223975bbd
## Summary - Fix expression injection vulnerabilities in composite actions (`restore-cache`, `nx-affected`) and workflow files (`claude.yml`) - Reduce overly broad permissions in `ci-utils.yaml` (Danger.js) and `ci-breaking-changes.yaml` - Restructure `preview-env-dispatch.yaml`: auto-trigger for members, opt-in for contributor PRs via `preview-app` label (safe because keepalive has no write tokens) - Isolate all write-access operations (PR comments, cross-repo posting) to a new dedicated [`twentyhq/ci-privileged`](https://github.com/twentyhq/ci-privileged) repo via `repository_dispatch`, so that workflows in twenty that execute contributor code never have write tokens - Create `post-ci-comments.yaml` (`workflow_run` bridge) to dispatch breaking changes results to ci-privileged, solving the [fork PR comment issue](https://github.com/twentyhq/twenty/pull/13713#issuecomment-3168999083) - Delete 5 unused secrets and broken `i18n-qa-report` workflow - Remove `TWENTY_DISPATCH_TOKEN` from twenty (moved to ci-privileged as `CORE_TEAM_ISSUES_COMMENT_TOKEN`) - Use `toJSON()` for all `client-payload` values to prevent JSON injection ## Security model after this PR | Workflow | Executes fork code? | Write tokens available? | |----------|---------------------|------------------------| | preview-env-keepalive | Yes | None (contents: read only) | | preview-env-dispatch | No (base branch) | CI_PRIVILEGED_DISPATCH_TOKEN only | | ci-breaking-changes | Yes | None (contents: read only) | | post-ci-comments (workflow_run) | No (default branch) | CI_PRIVILEGED_DISPATCH_TOKEN only | | claude.yml | No (base branch) | CI_PRIVILEGED_DISPATCH_TOKEN, CLAUDE_CODE_OAUTH_TOKEN | | ci-utils (Danger.js) | No (base branch) | GITHUB_TOKEN (scoped) | All actual write tokens (`TWENTY_PR_COMMENT_TOKEN`, `CORE_TEAM_ISSUES_COMMENT_TOKEN`) live in `twentyhq/ci-privileged` with strict CODEOWNERS review and branch protection. ## Test plan - [ ] Verify preview environment comments still appear on member PRs - [ ] Verify adding `preview-app` label triggers preview for contributor PRs - [ ] Verify breaking changes reports still post on PRs (including fork PRs) - [ ] Verify Claude cross-repo responses still post on core-team-issues - [ ] Confirm ci-privileged branch protection is enforced
48 lines
1.5 KiB
YAML
48 lines
1.5 KiB
YAML
name: CI Utils
|
|
|
|
on:
|
|
# it's usually not recommended to use pull_request_target
|
|
# but we consider it's safe here if we keep the same steps
|
|
# see: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
|
|
# and: https://github.com/facebook/react-native/pull/34370/files
|
|
pull_request_target:
|
|
types: [opened, synchronize, reopened, closed]
|
|
|
|
permissions:
|
|
checks: write
|
|
pull-requests: write
|
|
statuses: write
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
# We don't cancel in-progress because this workflow is triggered on
|
|
# pull_request_target, which means the ref can be the same accross two PRs.
|
|
# cancel-in-progress: true
|
|
|
|
jobs:
|
|
danger-js:
|
|
timeout-minutes: 5
|
|
runs-on: depot-ubuntu-24.04
|
|
if: github.event.action != 'closed'
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install dependencies
|
|
uses: ./.github/actions/yarn-install
|
|
- name: Utils / Run Danger.js
|
|
run: cd packages/twenty-utils && npx nx danger:ci
|
|
env:
|
|
DANGER_GITHUB_API_TOKEN: ${{ github.token }}
|
|
|
|
congratulate:
|
|
timeout-minutes: 3
|
|
runs-on: depot-ubuntu-24.04
|
|
if: github.event.action == 'closed' && github.event.pull_request.merged == true
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install dependencies
|
|
uses: ./.github/actions/yarn-install
|
|
- name: Run congratulate-dangerfile.js
|
|
run: cd packages/twenty-utils && npx nx danger:congratulate
|
|
env:
|
|
DANGER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|