Skip to content

Commit 1b4a2ba

Browse files
heiskrCopilotCopilot
authored
Harden workflow security: delete dependabot branches, fix injection patterns, add zizmor (#59769)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
1 parent bc17de8 commit 1b4a2ba

12 files changed

Lines changed: 108 additions & 24 deletions

‎.github/actions/retry-command/action.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,17 @@ runs:
1818
steps:
1919
- name: Retry command
2020
shell: bash
21+
env:
22+
INPUT_MAX_ATTEMPTS: ${{ inputs.max_attempts }}
23+
INPUT_DELAY: ${{ inputs.delay }}
24+
INPUT_COMMAND: ${{ inputs.command }}
2125
run: |
2226
# Generic retry function: configurable attempts and delay
2327
retry_command() {
24-
local max_attempts=${{ inputs.max_attempts }}
25-
local delay=${{ inputs.delay }}
28+
local max_attempts=${INPUT_MAX_ATTEMPTS}
29+
local delay=${INPUT_DELAY}
2630
local attempt=1
27-
local command="${{ inputs.command }}"
31+
local command="${INPUT_COMMAND}"
2832
2933
while [ $attempt -le $max_attempts ]; do
3034
echo "Attempt $attempt/$max_attempts: Running command..."

‎.github/actions/setup-elasticsearch/action.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,14 +34,18 @@ runs:
3434
- name: Pull Docker image
3535
shell: bash
3636
if: steps.cache-docker-layers.outputs.cache-hit != 'true'
37-
run: docker pull elasticsearch:${{ inputs.elasticsearch_version }}
37+
env:
38+
ES_VERSION: ${{ inputs.elasticsearch_version }}
39+
run: docker pull elasticsearch:${ES_VERSION}
3840

3941
- name: Save Docker image to cache
4042
shell: bash
4143
if: steps.cache-docker-layers.outputs.cache-hit != 'true'
44+
env:
45+
ES_VERSION: ${{ inputs.elasticsearch_version }}
4246
run: |
4347
mkdir -p /tmp/docker-cache
44-
docker save -o /tmp/docker-cache/elasticsearch.tar elasticsearch:${{ inputs.elasticsearch_version }}
48+
docker save -o /tmp/docker-cache/elasticsearch.tar elasticsearch:${ES_VERSION}
4549
4650
# Setups the Elasticsearch container
4751
# Derived from https://github.com/getong/elasticsearch-action

‎.github/workflows/auto-close-dependencies.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ on:
1919
- submitted
2020

2121
permissions:
22-
contents: read
22+
contents: write
2323
pull-requests: write
2424

2525
jobs:
@@ -34,12 +34,12 @@ jobs:
3434
}}
3535
runs-on: ubuntu-latest
3636
steps:
37-
- name: Close pull request
37+
- name: Close pull request and delete branch
3838
env:
3939
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
4040
PR_URL: ${{ github.event.pull_request.html_url }}
4141
run: |
42-
gh pr close "$PR_URL"
42+
gh pr close "$PR_URL" --delete-branch
4343
4444
- name: Comment on the pull request
4545
env:

‎.github/workflows/close-on-invalid-label.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,15 @@ jobs:
2727
if: ${{ github.event_name == 'issues' }}
2828
env:
2929
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
30-
run: gh issue close ${{ github.event.issue.html_url }}
30+
ISSUE_URL: ${{ github.event.issue.html_url }}
31+
run: gh issue close "$ISSUE_URL"
3132

3233
- name: Close PR
3334
if: ${{ github.event_name == 'pull_request_target' }}
3435
env:
3536
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36-
run: gh pr close ${{ github.event.pull_request.html_url }}
37+
PR_URL: ${{ github.event.pull_request.html_url }}
38+
run: gh pr close "$PR_URL"
3739

3840
- name: Check out repo
3941
if: ${{ failure() && github.event_name != 'pull_request_target' }}

‎.github/workflows/generate-code-scanning-query-lists.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,7 @@ on:
2424
- .github/actions/install-cocofix/action.yml
2525

2626
permissions:
27-
contents: write
28-
pull-requests: write
27+
contents: read
2928

3029
jobs:
3130
generate-security-query-lists:
@@ -159,6 +158,9 @@ jobs:
159158
create-pull-request:
160159
if: github.repository == 'github/docs-internal'
161160
runs-on: ubuntu-latest
161+
permissions:
162+
contents: write
163+
pull-requests: write
162164
needs: [generate-security-query-lists, generate-quality-query-lists]
163165
steps:
164166
- name: Checkout repository code

‎.github/workflows/link-check-internal.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ on:
1717

1818
permissions:
1919
contents: read
20-
issues: write
2120

2221
jobs:
2322
# Determine which version/language combos to run
@@ -35,14 +34,18 @@ jobs:
3534
- name: Set matrix
3635
id: set-matrix
3736
run: |
38-
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
37+
if [[ "${EVENT_NAME}" == "workflow_dispatch" ]]; then
3938
# Manual run: use the provided version and language
40-
echo 'matrix={"include":[{"version":"${{ inputs.version }}","language":"${{ inputs.language }}"}]}' >> $GITHUB_OUTPUT
39+
echo "matrix={\"include\":[{\"version\":\"${INPUT_VERSION}\",\"language\":\"${INPUT_LANGUAGE}\"}]}" >> $GITHUB_OUTPUT
4140
else
4241
# Scheduled run: English free-pro-team + English latest enterprise-server
4342
LATEST_GHES=$(npx tsx -e "import { latest } from './src/versions/lib/enterprise-server-releases'; console.log(latest)")
4443
echo "matrix={\"include\":[{\"version\":\"free-pro-team@latest\",\"language\":\"en\"},{\"version\":\"enterprise-server@${LATEST_GHES}\",\"language\":\"en\"}]}" >> $GITHUB_OUTPUT
4544
fi
45+
env:
46+
EVENT_NAME: ${{ github.event_name }}
47+
INPUT_VERSION: ${{ inputs.version }}
48+
INPUT_LANGUAGE: ${{ inputs.language }}
4649

4750
- uses: ./.github/actions/slack-alert
4851
if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
@@ -104,6 +107,8 @@ jobs:
104107
if: always() && github.repository == 'github/docs-internal'
105108
needs: [setup-matrix, check-internal-links]
106109
runs-on: ubuntu-latest
110+
permissions:
111+
issues: write
107112
steps:
108113
- name: Checkout
109114
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

‎.github/workflows/needs-sme-workflow.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,13 @@ on:
1313

1414
permissions:
1515
contents: read
16-
issues: write
17-
pull-requests: write
1816

1917
jobs:
2018
add-issue-comment:
2119
if: ${{ github.repository == 'github/docs' && (github.event.label.name == 'needs SME' && github.event_name == 'issues') }}
2220
runs-on: ubuntu-latest
21+
permissions:
22+
issues: write
2323
steps:
2424
- name: Check out repo
2525
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
@@ -39,6 +39,8 @@ jobs:
3939
add-pr-comment:
4040
if: ${{ github.repository == 'github/docs' && (github.event.label.name == 'needs SME' && github.event_name == 'pull_request_target') }}
4141
runs-on: ubuntu-latest
42+
permissions:
43+
pull-requests: write
4244
steps:
4345
- name: Check out repo
4446
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

‎.github/workflows/ready-for-doc-review.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,15 @@ jobs:
3737

3838
- name: Set AUTHOR_LOGIN
3939
run: |
40-
if [[ "${{ github.event.pull_request.assignee.login && github.event.pull_request.user.login == 'docs-bot' }}" ]]; then
41-
echo "AUTHOR_LOGIN=${{ github.event.pull_request.assignee.login }}" >> $GITHUB_ENV
40+
if [[ "${IS_DOCS_BOT_ASSIGNEE}" == "true" ]]; then
41+
echo "AUTHOR_LOGIN=${ASSIGNEE_LOGIN}" >> $GITHUB_ENV
4242
else
43-
echo "AUTHOR_LOGIN=${{ github.event.pull_request.user.login }}" >> $GITHUB_ENV
43+
echo "AUTHOR_LOGIN=${USER_LOGIN}" >> $GITHUB_ENV
4444
fi
45+
env:
46+
IS_DOCS_BOT_ASSIGNEE: ${{ github.event.pull_request.assignee.login && github.event.pull_request.user.login == 'docs-bot' }}
47+
ASSIGNEE_LOGIN: ${{ github.event.pull_request.assignee.login }}
48+
USER_LOGIN: ${{ github.event.pull_request.user.login }}
4549

4650
- name: Run script
4751
run: |

‎.github/workflows/sync-graphql.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,15 @@ on:
1010
- cron: '20 16 * * 1-5' # Run Mon-Fri at 16:20 UTC / 8:20 PST
1111

1212
permissions:
13-
contents: write
14-
pull-requests: write
13+
contents: read
1514

1615
jobs:
1716
update_graphql_files:
1817
if: github.repository == 'github/docs-internal'
1918
runs-on: ubuntu-latest
19+
permissions:
20+
contents: write
21+
pull-requests: write
2022
outputs:
2123
ignored-changes: ${{ steps.sync.outputs.ignored-changes }}
2224
ignored-count: ${{ steps.sync.outputs.ignored-count }}

‎.github/workflows/triage-stale-check.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,15 @@ on:
1010

1111
permissions:
1212
contents: read
13-
issues: write
14-
pull-requests: write
1513

1614
jobs:
1715
stale_contributor:
1816
name: Identify and close stale issues and PRs
1917
if: github.repository == 'github/docs'
2018
runs-on: ubuntu-latest
19+
permissions:
20+
issues: write
21+
pull-requests: write
2122

2223
steps:
2324
- uses: actions/stale@3a9db7e6a41a89f618792c92c0e97cc736e1b13f # v10.0.0
@@ -55,6 +56,9 @@ jobs:
5556
name: Remind staff about PRs waiting for review
5657
if: github.repository == 'github/docs'
5758
runs-on: ubuntu-latest
59+
permissions:
60+
issues: write
61+
pull-requests: write
5862
steps:
5963
- uses: actions/stale@3a9db7e6a41a89f618792c92c0e97cc736e1b13f # v10.0.0
6064
with:

0 commit comments

Comments
 (0)