Repository navigation
[bot] Merge master/2d8daa30 into rel/dev - #1921
Merged
Merged
Conversation
PSDK-235: the Staging tests workflow ran on any '/test-staging' PR comment without checking the commenter, checked out the PR head (including forks) and executed it with PYTHON_SDK_STG_API_KEY on self-hosted runners. Any GitHub user could open a fork PR and run arbitrary code with the staging key inside our runner infrastructure. - Before checkout, verify via the collaborator permission API that the commenter has write/maintain/admin access. author_association is not used because private org members appear as CONTRIBUTOR. - Refuse PRs whose head is in a fork. Otherwise an outsider could push new commits after a maintainer comments and get them executed; in-repo branches can only be pushed by users with write access. - Only react to comments on open PRs. - Default-deny workflow permissions (job gets contents/pull-requests read) and stop persisting the checkout token. - Pass workflow_dispatch inputs through env instead of interpolating them into the shell script to prevent script injection.
fix(ci): require write access and in-repo branch for /test-staging
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚀 Automated PR to perform merge from master into rel/dev with changes up to 2d8daa3 (created by https://github.com/gooddata/gooddata-python-sdk/actions/runs/41832927861).