-
Notifications
You must be signed in to change notification settings - Fork 0
chore(deps): update Go dependencies and GitHub Actions to latest #27
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: thedavidweng/money
Length of output: 6505
🌐 Web query:
GitHub Actions pull_request fork GITHUB_TOKEN read-only permissions persist-credentials actions/checkout security💡 Result:
When a GitHub Actions workflow is triggered by a pull request from a fork using the pull_request event, GitHub automatically restricts the GITHUB_TOKEN to read-only permissions by design [1][2][3][4]. This security boundary prevents untrusted code within the fork's pull request from performing unauthorized write operations on the base repository [3][5]. This restriction applies regardless of the permissions configured in your workflow file [3][4]. If you attempt to use the GITHUB_TOKEN to perform write operations (such as pushing code, commenting, or adding labels) in a workflow triggered by a fork pull request, the operation will fail with a 403 error [3][6][5]. To handle write operations safely, follow these recommended practices: 1. Use workflow_run: This event triggers a new workflow after the initial, untrusted workflow completes [3][5]. The workflow_run workflow executes in the context of the base repository, has access to write permissions and secrets, and is not running code from the untrusted fork [3][5]. 2. Use pull_request_target with extreme caution: The pull_request_target event runs in the context of the base repository's default branch [1]. It receives write-capable tokens and secrets, but it does not automatically check out the untrusted fork code [1][7]. If you use this, ensure you do not inadvertently check out the fork's code without strict security measures (such as manual approval or specific environment gates) [1][7][8]. 3. Manage persist-credentials: The actions/checkout action, by default, persists the GITHUB_TOKEN into the local.git/config file to enable authenticated git commands [7][9]. If your workflow runs untrusted code (such as build scripts or dependencies from a fork) and has persist-credentials set to true, that untrusted code could potentially access the persisted token [10][8]. When working with fork pull requests, it is a best practice to set persist-credentials: false in your checkout step to prevent the untrusted code from accessing credentials, especially if the job has been granted elevated permissions [10][8]. In summary, do not attempt to bypass the read-only GITHUB_TOKEN restriction on fork pull_request events. Instead, decouple your CI process into untrusted jobs (for testing/building) and trusted jobs (for actions requiring write access) using safe triggers like workflow_run [3][5].
Citations:
Sensitive Data Exposure (CWE-522): Insufficiently Protected Credentials
Reachability: External · Exploitability: Moderate
在 CodeQL checkout 步骤中禁用凭据持久化。
codeql.yml处理pull_request代码，并在 checkout 后执行自动构建。请添加persist-credentials: false。Fork PR 的GITHUB_TOKEN为只读，但仍不应让不受信任的构建步骤读取该令牌。release-please.yml仅由main分支 push 触发，无需因该问题修改。🧰 Tools
🪛 zizmor (1.29.0)
[warning] 29-30: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 1-46: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
📍 Affects 2 files
.github/workflows/codeql.yml#L30-L30(this comment).github/workflows/release-please.yml#L16-L16🤖 Prompt for AI Agents
Sources: MCP tools, Linters/SAST tools