fix: recognize github.workflow_sha / github.sha as trusted refs (FG-001/016)#26
Merged
Merged
Conversation
…01/016) isTrustedRef knew main/master/base_ref/pull_request.base.* but not github.workflow_sha or github.sha, both of which check out trusted base/workflow code on pull_request_target (unlike ...head.sha, the fork). Workflows that isolate fork code to a subdir and load actions/scripts from a separate checkout at github.workflow_sha (e.g. mathlib4's PR_summary.yml) were false-flagged. - Add github.workflow_sha / github.sha to isTrustedRef (safe: "github.sha" is not a substring of "...head.sha"). - FG-016: new localActionUnderTrustedCheckout() — a `uses: ./<dir>/...` action whose <dir> was populated by a trusted-ref checkout is not attacker-controlled (the prior fix only credited a trusted checkout at root; this handles a trusted checkout into a subdir). Verified: leanprover-community/mathlib4 PR_summary.yml goes from FG-001 critical + FG-016 critical to zero critical/high. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Surfaced by triaging an AI-bot hunt hit:
leanprover-community/mathlib4'sPR_summary.ymlwas false-flagged FG-001 + FG-016 critical, but it's a deliberately hardenedpull_request_targetworkflow — fork code isolated topr-branch/, local actions and scripts loaded from a separate checkout atgithub.workflow_sha, fork files processed only as data. The scanner just didn't knowgithub.workflow_shais a trusted ref.isTrustedRefnow acceptsgithub.workflow_shaandgithub.sha(both check out trusted base/workflow code onpull_request_target, unlike...head.sha). Safe substring:github.shadoesn't appear inside...head.sha.localActionUnderTrustedCheckout()— auses: ./<dir>/...action whose<dir>was populated by a trusted-ref checkout isn't attacker-controlled. (The earlier trusted-ref fix only credited a trusted checkout at root; this handles one into a subdir, which is the mathlib4 shape.)Verified
leanprover-community/mathlib4PR_summary.yml: FG-001 critical + FG-016 critical → zero critical/high. Tests added (isTrustedRef unit test incl. head.sha regression guard; FG-016 workflow_sha-dir fixture). Full suite, gofmt, vet, self-scan clean.🤖 Generated with Claude Code