Skip to content

fix(ci): scope and revoke E2E GitHub App tokens#1798

Merged
notgitika merged 1 commit into
mainfrom
security/address-appsec-highs
Jul 23, 2026
Merged

fix(ci): scope and revoke E2E GitHub App tokens#1798
notgitika merged 1 commit into
mainfrom
security/address-appsec-highs

Conversation

@notgitika

Copy link
Copy Markdown
Contributor

Summary

  • scope E2E GitHub App installation tokens to the configured private CDK repository with contents-read permission
  • remove the credential-bearing Git remote and revoke each token immediately after clone, including clone-failure paths
  • grant OIDC only to jobs that actually assume the E2E AWS role

Validation

  • parsed both workflow files as YAML
  • Prettier check passed for both workflow files
  • git diff --check passed

@notgitika
notgitika requested a review from a team July 20, 2026 21:19
@github-actions github-actions Bot added the size/s PR size: S label Jul 20, 2026
@github-actions github-actions Bot added agentcore-harness-reviewing AgentCore Harness review in progress and removed agentcore-harness-reviewing AgentCore Harness review in progress labels Jul 20, 2026
@agentcore-devx-automation agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Jul 20, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Package Tarball

aws-agentcore-0.24.1.tgz

How to install

gh release download pr-1798-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.24.1.tgz

@agentcore-devx-automation

Copy link
Copy Markdown
Contributor

Claude Security Review: no high-confidence findings. (run)

@agentcore-devx-automation agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Jul 20, 2026
@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Coverage Report

Status Category Percentage Covered / Total
🔵 Lines 40.3% 15047 / 37333
🔵 Statements 39.56% 16037 / 40535
🔵 Functions 34.42% 2567 / 7457
🔵 Branches 33.71% 10016 / 29710
Generated in workflow #4192 for commit 5b001ad by the Vitest Coverage Report Action

@notgitika
notgitika force-pushed the security/address-appsec-highs branch from 7fd7cbe to 5b001ad Compare July 23, 2026 21:04
@github-actions github-actions Bot added size/s PR size: S and removed size/s PR size: S labels Jul 23, 2026
@agentcore-devx-automation agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Jul 23, 2026
@agentcore-devx-automation

Copy link
Copy Markdown
Contributor

Claude Security Review: no high-confidence findings. (run)

@agentcore-devx-automation agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Jul 23, 2026
@notgitika
notgitika merged commit 0053ba6 into main Jul 23, 2026
33 checks passed
@notgitika
notgitika deleted the security/address-appsec-highs branch July 23, 2026 21:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/s PR size: S

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants