ci: harden workflows for public repo - #12
Merged
Merged
Conversation
Hardening pass now that the repo is public. Three workflows (codex-parity, validate-codex-plugin, validate-cursor-plugin) trigger on pull_request and execute scripts from the PR's own tree. On a public repo with forking enabled that means any fork author could get code execution on a persistent, shared self-hosted runner — the same fleet that runs the jobs holding FASTEDGE_APP_PRIVATE_KEY, ANTHROPIC_API_KEY and OPENAI_API_KEY. All five workflows now run on ubuntu-latest. External actions are pinned to commit SHAs; create-github-app-token@v1 was a mutable major tag with access to the GitHub App private key. Each pin resolves to the commit its tag already pointed at, so no version change: checkout v6.1.0, setup-node v6.5.0, create-github-app-token v1.12.0. The three pull_request checkouts also set persist-credentials: false so untrusted PR code cannot read the token out of .git/config.
ANTHROPIC_API_KEY and OPENAI_API_KEY were set at workflow level, putting them in the environment of every step — including actions/checkout, create-github-app-token and the composite setup-node action. They are only read by invoke-agent.sh, so they now live on the Sync reference docs step. The App token was written to $GITHUB_ENV, which persists it into every later step's environment for the rest of the job. It is now passed per step to the three that actually use it: Validate sources.json (validate-sources.sh calls gh api), Configure git credentials (gh auth setup-git), and Sync reference docs (fetch-repo.sh, manage-pr.sh and the git push via the gh credential helper). Checkout, token generation, Setup Node.js and Install Claude CLI now run with no secrets in scope.
demetristsadiotis
changed the title
godronus
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three workflows (codex-parity, validate-codex-plugin, validate-cursor-plugin) trigger on pull_request and execute scripts from the PR's own tree. On a public repo with forking enabled that means any fork author could get code execution on a persistent, shared self-hosted runner. the same fleet that runs the jobs holding tokens. All five workflows now run on ubuntu-latest.
External actions are pinned to commit SHAs; create-github-app-token@v1 was a mutable major tag with access to the GitHub App private key. Each pin resolves to the commit its tag already pointed at, so no version change: checkout v6.1.0, setup-node v6.5.0, create-github-app-token v1.12.0.
The three pull_request checkouts also set persist-credentials: false so untrusted PR code cannot read the token out of .git/config.
Secret scoping in
sync-reference-docs.yaml(second commit)ANTHROPIC_API_KEYandOPENAI_API_KEYwere declared at workflow level, so they sat in the environment of every step — includingactions/checkout,create-github-app-tokenand the compositesetup-nodeaction. Onlyinvoke-agent.shreads them; they now live on theSync reference docsstep alone.The GitHub App token was written to
$GITHUB_ENV, which persists it into every later step for the rest of the job. It is now passed per step to the three that actually need it:validate-sources.sh:50callsgh apigh auth setup-gitfetch-repo.sh,manage-pr.sh, and thegit pushvia the gh credential helperCheckout, token generation, Setup Node.js and Install Claude CLI now run with no secrets in scope.