From 46dd9257f0f3dbfabda9d74d5b66b7be1e581d12 Mon Sep 17 00:00:00 2001 From: mjohns91 Date: Fri, 24 Jul 2026 15:14:54 -0400 Subject: [PATCH 1/3] fix(ci): harden actions against pwn request vulnerabilities Upgrade actions/checkout v3->v7 and actions/setup-python v4->v7 to resolve Node 20 deprecation and enable built-in pwn request protection. Move attacker-controllable inputs from direct shell interpolation to env variables to prevent script injection. Add persist-credentials: false to prevent token leakage via .git/config. Files changed: - commit_to_pullrequest/action.yml - ansible_validate_changelog/action.yml - workflows/changelog.yml Assisted-by: Claude Opus 4.6 --- .../ansible_validate_changelog/action.yml | 13 +++++++--- .../actions/commit_to_pullrequest/action.yml | 26 ++++++++++++++----- .github/workflows/changelog.yml | 3 ++- 3 files changed, 30 insertions(+), 12 deletions(-) diff --git a/.github/actions/ansible_validate_changelog/action.yml b/.github/actions/ansible_validate_changelog/action.yml index 51a9926e..62dcd413 100644 --- a/.github/actions/ansible_validate_changelog/action.yml +++ b/.github/actions/ansible_validate_changelog/action.yml @@ -21,7 +21,7 @@ runs: using: composite steps: - name: Setup python - uses: actions/setup-python@v4 + uses: actions/setup-python@v7 with: python-version: "3.12" @@ -33,16 +33,21 @@ runs: - name: Validate changelog using custom paths run: >- python3 ${{ github.action_path }}/validate_changelog.py - --ref ${{ inputs.base_ref }} - --custom-paths ${{ inputs.custom_paths }} + --ref "$BASE_REF" + --custom-paths "$CUSTOM_PATHS" shell: bash working-directory: ${{ inputs.path }} if: inputs.custom_paths != '' + env: + BASE_REF: ${{ inputs.base_ref }} + CUSTOM_PATHS: ${{ inputs.custom_paths }} - name: Validate changelog run: >- python3 ${{ github.action_path }}/validate_changelog.py - --ref ${{ inputs.base_ref }} + --ref "$BASE_REF" shell: bash working-directory: ${{ inputs.path }} if: inputs.custom_paths == '' + env: + BASE_REF: ${{ inputs.base_ref }} diff --git a/.github/actions/commit_to_pullrequest/action.yml b/.github/actions/commit_to_pullrequest/action.yml index 000bbeab..3903c2c1 100644 --- a/.github/actions/commit_to_pullrequest/action.yml +++ b/.github/actions/commit_to_pullrequest/action.yml @@ -32,26 +32,35 @@ outputs: runs: using: composite steps: + # allow-unsafe-pr-checkout is required because this action needs to check out + # fork PR code to commit changes back. Mitigated by persist-credentials: false + # and all inputs passed via env vars (not shell-interpolated). - name: checkout fork repository - uses: actions/checkout@v3 + uses: actions/checkout@v7 with: repository: ${{ github.event.pull_request.head.repo.full_name }} ref: ${{ github.head_ref }} + persist-credentials: false + allow-unsafe-pr-checkout: true - name: Set up Python - uses: actions/setup-python@v4 + uses: actions/setup-python@v7 with: python-version: "3.12" - name: Install required python libraries - run: pip install -U ${{ inputs.python_libs }} + run: pip install -U $PYTHON_LIBS shell: bash if: inputs.python_libs != '' + env: + PYTHON_LIBS: ${{ inputs.python_libs }} - name: Download python script run: >- - curl -o /tmp/update_repository.py ${{ inputs.python_executable_url }} + curl -o /tmp/update_repository.py "$PYTHON_EXECUTABLE_URL" shell: bash + env: + PYTHON_EXECUTABLE_URL: ${{ inputs.python_executable_url }} - name: Execute python script run: >- @@ -63,9 +72,9 @@ runs: run: | if [[ -n $(git status -s) ]]; then echo -e "changes detected\n$(git status -s)" - git add -A ${{ inputs.file_pattern }} - git -c user.name="$GIT_USER_NAME" -c user.email="$GIT_USER_EMAIL" commit -m "${{ inputs.commit_message }}" --author="$GIT_AUTHOR" - git push origin ${{ github.head_ref }} + git add -A $FILE_PATTERN + git -c user.name="$GIT_USER_NAME" -c user.email="$GIT_USER_EMAIL" commit -m "$COMMIT_MESSAGE" --author="$GIT_AUTHOR" + git push origin "$HEAD_REF" echo "changes_detected=true" >> $GITHUB_OUTPUT else echo "changes_detected=false" >> $GITHUB_OUTPUT @@ -76,3 +85,6 @@ runs: GIT_USER_NAME: "github-actions[bot]" GIT_USER_EMAIL: "41898282+github-actions[bot]@users.noreply.github.com" GIT_AUTHOR: "${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>" + HEAD_REF: ${{ github.head_ref }} + COMMIT_MESSAGE: ${{ inputs.commit_message }} + FILE_PATTERN: ${{ inputs.file_pattern }} diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index 7431bab4..c93816fe 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -16,10 +16,11 @@ jobs: if: "!contains(github.event.pull_request.labels.*.name, 'skip-changelog')" steps: - name: Checkout the collection repository - uses: actions/checkout@v3 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha }} fetch-depth: "0" + persist-credentials: false - name: Validate changelog uses: ansible-network/github_actions/.github/actions/ansible_validate_changelog@main From 1ed6878da9f572133a2087aed1215968bac18f72 Mon Sep 17 00:00:00 2001 From: mjohns91 Date: Fri, 24 Jul 2026 15:23:54 -0400 Subject: [PATCH 2/3] fix(ci): pin actions to commit SHAs for supply-chain safety Pin actions/checkout and actions/setup-python to their v7.0.0 commit SHAs to prevent supply-chain attacks via tag mutation. Assisted-by: Claude Opus 4.6 --- .github/actions/ansible_validate_changelog/action.yml | 2 +- .github/actions/commit_to_pullrequest/action.yml | 4 ++-- .github/workflows/changelog.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/actions/ansible_validate_changelog/action.yml b/.github/actions/ansible_validate_changelog/action.yml index 62dcd413..b7a25b2b 100644 --- a/.github/actions/ansible_validate_changelog/action.yml +++ b/.github/actions/ansible_validate_changelog/action.yml @@ -21,7 +21,7 @@ runs: using: composite steps: - name: Setup python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" diff --git a/.github/actions/commit_to_pullrequest/action.yml b/.github/actions/commit_to_pullrequest/action.yml index 3903c2c1..d731716e 100644 --- a/.github/actions/commit_to_pullrequest/action.yml +++ b/.github/actions/commit_to_pullrequest/action.yml @@ -36,7 +36,7 @@ runs: # fork PR code to commit changes back. Mitigated by persist-credentials: false # and all inputs passed via env vars (not shell-interpolated). - name: checkout fork repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: ${{ github.event.pull_request.head.repo.full_name }} ref: ${{ github.head_ref }} @@ -44,7 +44,7 @@ runs: allow-unsafe-pr-checkout: true - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index c93816fe..7362ced2 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -16,7 +16,7 @@ jobs: if: "!contains(github.event.pull_request.labels.*.name, 'skip-changelog')" steps: - name: Checkout the collection repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ github.event.pull_request.head.sha }} fetch-depth: "0" From 8bc39ede0063720a7fc61f3cb3d6e6f03ac25e55 Mon Sep 17 00:00:00 2001 From: mjohns91 Date: Mon, 27 Jul 2026 12:56:25 -0400 Subject: [PATCH 3/3] fix(ci): add token to checkout and gh auth for push Address PR review: pass inputs.token to checkout for private fork access, and authenticate via gh CLI before push since persist-credentials: false removes stored git credentials. Assisted-by: Claude Opus 4.6 --- .github/actions/commit_to_pullrequest/action.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/actions/commit_to_pullrequest/action.yml b/.github/actions/commit_to_pullrequest/action.yml index d731716e..f14c5d30 100644 --- a/.github/actions/commit_to_pullrequest/action.yml +++ b/.github/actions/commit_to_pullrequest/action.yml @@ -40,6 +40,7 @@ runs: with: repository: ${{ github.event.pull_request.head.repo.full_name }} ref: ${{ github.head_ref }} + token: ${{ inputs.token }} persist-credentials: false allow-unsafe-pr-checkout: true @@ -74,6 +75,8 @@ runs: echo -e "changes detected\n$(git status -s)" git add -A $FILE_PATTERN git -c user.name="$GIT_USER_NAME" -c user.email="$GIT_USER_EMAIL" commit -m "$COMMIT_MESSAGE" --author="$GIT_AUTHOR" + echo "$GITHUB_TOKEN" | gh auth login --with-token + gh auth setup-git git push origin "$HEAD_REF" echo "changes_detected=true" >> $GITHUB_OUTPUT else