ci: check out trusted base in pr-comment, not the fork head_sha#140
Open
atassis wants to merge 1 commit into
Open
ci: check out trusted base in pr-comment, not the fork head_sha#140atassis wants to merge 1 commit into
atassis wants to merge 1 commit into
Conversation
The "Comment on PR with Test Results" workflow runs from workflow_run, so it executes in the base repo context with a write-scoped GITHUB_TOKEN and secrets. Its checkout step used ref: github.event.workflow_run.head_sha, which for a fork PR points at the fork's commit. actions/checkout now refuses that: it fails the step with "Refusing to check out fork pull request code from a 'workflow_run' workflow", so the comment job goes red on every fork PR even when the test suites passed. Beyond the false failure, the old behavior is a pwn-request vector. The job's only use of the working tree is running ci/scripts/pretty_aggregate.py; artifacts and PR metadata come from the API. Checking out head_sha meant running the fork author's copy of that script under a token that can write to the repo. A malicious fork could edit the script to exfiltrate the token or push to the base repo. Drop the ref so checkout takes the default branch, i.e. the trusted base copy of the aggregation script. Legitimate PRs get the same comment; the untrusted code no longer runs under the write token. This is the correct fix rather than allow-unsafe-pr-checkout: true, which would keep the hole open.
atassis
force-pushed
the
fix/pr-comment-checkout-trusted-base
branch
from
July 24, 2026 16:56
ba4ecd1 to
e2af73a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The "Comment on PR with Test Results" workflow (
.github/workflows/pr-comment.yml) fails its checkout step on every fork PR. For example, run 30051409584 aborts with:The step uses
ref: ${{ github.event.workflow_run.head_sha }}. For a fork PR that head_sha is the fork's commit, and recentactions/checkoutrefuses to check out fork code inside aworkflow_runjob. So the comment job goes red even when the Krackan/Phoenix suites all passed, which trains people to ignore failures on this check.There are two problems, and both are fixed the same way:
workflow_runwith a write-scopedGITHUB_TOKENand secrets. Its only use of the working tree is runningci/scripts/pretty_aggregate.py; artifacts and PR metadata come from the API. Checking out head_sha means running the fork author's copy of that script under a token that can write to the repo, so a malicious fork could edit the script to exfiltrate the token or push to the base.Fix: drop the
refso checkout takes the default branch, i.e. the trusted base copy of the aggregation script. Legitimate PRs get the same comment; untrusted code no longer runs under the write token. I chose this overallow-unsafe-pr-checkout: true, which would silence the error while leaving the hole open.