Repository navigation
feat(embed): pin OIDC job_workflow_ref + scope discovery to user - #39
Merged
Merged
Conversation
Two hardening changes that close the last open trust boundaries on the project-embed pipeline: 1. **OIDC job_workflow_ref pin** (src/lib/github-oidc.ts): authorizeForEmbedUpload now requires job_workflow_ref to start with 'baladithyab/web-embed-workflows/.github/workflows/static-passthrough.yml@'. Previously, any caller workflow under repository_owner === 'baladithyab' with id-token: write could mint a valid OIDC token and upload to any slug. Now ONLY our reviewed reusable workflow can — even if some unrelated workflow in one of our repos later sets id-token: write. Six new tests cover: missing claim, wrong workflow file, wrong repo, ref-as-SHA, ref-as-tag, prefix-substring forgery. 2. **Discovery scope to ALLOWED_OWNER** (src/scripts/sync-project-manifests.ts): GitHub search query is now 'topic:codeseys-embed user:baladithyab'. Strangers adding the topic no longer leak into /projects. Defense-in-depth: validate() now also rejects manifests whose source owner doesn't match. 184 / 184 tests passing (was 178; +6 OIDC pin tests). Astro check clean.
🚀 Preview deployedURL: https://1a780c79-codeseys-personal-website.codeseys.workers.dev Updated on every push to this PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two follow-up hardening changes from yesterday's TODO list.
1. Pin OIDC
job_workflow_refin the WorkerauthorizeForEmbedUploadnow requires the OIDC token'sjob_workflow_refclaim to start withbaladithyab/web-embed-workflows/.github/workflows/static-passthrough.yml@. Closes the last open path: previously any caller workflow under our owner withid-token: writecould upload, even one we'd never reviewed. Now ONLY our audited reusable workflow can.2. Scope discovery to
+user:baladithyabGH search query now scopes to our user. Defense-in-depth:
validate()also rejects manifests whose source owner doesn't match. Strangers adding thecodeseys-embedtopic stop leaking into/projects.Tests
184 / 184 (was 178; +6 OIDC pin tests covering missing claim, wrong workflow file, wrong repo, ref-as-SHA, ref-as-tag, prefix-substring forgery).
🤖 Generated with the help of Claude