Strip write capability from the untrusted-triggered claude.yml run - #27
Open
Jartans-Familiar wants to merge 1 commit into
Open
Strip write capability from the untrusted-triggered claude.yml run#27Jartans-Familiar wants to merge 1 commit into
Jartans-Familiar wants to merge 1 commit into
Conversation
issues, issue_comment, pull_request_review and pull_request_review_comment carry content any GitHub account can author, and the trigger gate is the literal @claude string with no membership check at all — Row B, JAR-681. Mint the App token with explicit read-only permission-contents/issues/ pull-requests instead of inheriting the App installation's full grant, drop the matching job-level write scopes, remove --dangerously-skip-permissions, and pin checkout to github.ref_name so a pull_request_review* event never resolves to a fork PR head under the token. JAR-687 Co-authored-by: multica-agent <github@multica.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
issues,issue_comment,pull_request_reviewandpull_request_review_commentcarry content any GitHub account can author, and this repo's trigger gate was the literal@claudestring with no membership check at all — Row B of the Security finding, JAR-681. Any GitHub user opening an issue containing@claudegot a write-scoped App token and--dangerously-skip-permissions.permission-contents/issues/pull-requests: readexplicitly, instead of inheriting the App installation's full grant.permissions:block to read-only.--dangerously-skip-permissions.github.ref_name(wasgithub.head_ref || github.ref_name) so apull_request_review*event can never resolve to a fork PR head under the token.Reproduction test
tests/test_claude_workflow_security.pyreads the shipped.github/workflows/claude.ymland asserts no write scope is minted and permission checks aren't skipped. Verified fail-before / pass-after against base revisionc285befdd2e60de912736943c57d940e2057f57a:test_untrusted_trigger_mints_no_write_scopefails on the job-levelcontents: writegrant;test_permission_checks_are_not_skippedfails on--dangerously-skip-permissions.ruff check,ruff format --check,pytest) is green.Test plan
ruff check .ruff format --check .pytest(125 passed, including the new regression test)JAR-687