twenty

Files

T

Félix MalfaitandGitHub fc6b136c2f fix: resolve GitHub Actions security vulnerabilities (#16174 )

## 🔒 Security Fixes

This PR addresses security vulnerabilities identified by GitHub CodeQL
security scanning.

### Changes

#### 1. Fix Shell Command Injection (High Severity)
**File:** `.github/workflows/docs-i18n-pull.yaml`

**Issue:** Direct interpolation of `${{ github.head_ref }}` in shell
command was susceptible to command injection attacks.

**Fix:** Assign GitHub context variable to environment variable first:
```yaml
run: |
  git push origin "HEAD:$HEAD_REF"
env:
  HEAD_REF: ${{ github.head_ref }}
```

This prevents malicious input from being executed as shell commands.

#### 2. Add Missing Workflow Permissions (Medium Severity)
**File:** `.github/workflows/ci-test-docker-compose.yaml`

**Issue:** Workflow did not explicitly define GITHUB_TOKEN permissions,
running with overly broad defaults.

**Fix:** Added explicit minimal permissions:
```yaml
permissions:
  contents: read
```

This applies to all 3 jobs in the workflow:
- `changed-files-check`
- `test`
- `ci-test-docker-compose-status-check`

### Security Impact

- ✅ Prevents potential shell injection attacks via pull request branch
names
- ✅ Follows principle of least privilege for GitHub Actions tokens
- ✅ Aligns with GitHub Actions security best practices
- ✅ Resolves all CodeQL security alerts for these workflows

### References

- [GitHub Actions: Security hardening for GitHub
Actions](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions)
- [GitHub Actions: Permissions for the
GITHUB_TOKEN](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)
- Related attacks: 2025 Nx supply chain attack, 2024 ultralytics/actions
attack

2025-11-28 13:15:33 +01:00

actions

Fix storybook build cache and logs (#14130 )

2025-08-28 14:46:43 +02:00

cd-deploy-main.yaml

chore(workflows): update permissions across GitHub Actions workflows … (#14919 )

2025-10-06 17:36:41 +02:00

cd-deploy-tag.yaml

chore(workflows): update permissions across GitHub Actions workflows … (#14919 )

2025-10-06 17:36:41 +02:00

changed-files.yaml

chore(workflows): update permissions across GitHub Actions workflows … (#14919 )