dagecko opened a new pull request, #21555: URL: https://github.com/apache/echarts/pull/21555
## Security: Harden GitHub Actions workflows Hey, we found some CI/CD security issues in this repo's workflows using [Runner Guard](https://github.com/Vigilant-LLC/runner-guard), our open-source CI/CD security scanner at [Vigilant](https://www.vigilantdefense.com). These are the same vulnerability classes being actively exploited right now in the tj-actions, Trivy, LiteLLM supply chain attack chain. We scanned the top 50K repos on GitHub and over 20,000 have this same problem. We're trying to get fixes out to as many maintainers as possible before more repos get hit. This PR fixes what we could automatically, and flags anything else that needs a manual look. There's a real person behind this PR, we're actively checking back on comments so if you have any questions just drop them here and we'll respond. ### Fixes applied (in this PR) | Rule | Severity | File | Description | |------|----------|------|-------------| | RGS-002 | high | `.github/workflows/teardown-pr-preview.yml` | Extracted 1 unsafe expression(s) to env vars | ### Advisory: additional findings (manual review recommended) | Rule | Severity | File | Description | | RGS-004 | high | `.github/workflows/pr-preview.yml` | Comment-Triggered Workflow Without Author Authorization Check | | RGS-004 | high | `.github/workflows/pr-preview.yml` | Comment-Triggered Workflow Without Author Authorization Check | | RGS-004 | high | `.github/workflows/pr-preview.yml` | Comment-Triggered Workflow Without Author Authorization Check | | RGS-004 | high | `.github/workflows/pr-preview.yml` | Comment-Triggered Workflow Without Author Authorization Check | | RGS-004 | high | `.github/workflows/pr-preview.yml` | Comment-Triggered Workflow Without Author Authorization Check | ### Why this matters GitHub Actions workflows that use untrusted input in `run:` blocks, expose secrets inline, or use unpinned third-party actions are vulnerable to code injection, credential theft, and supply chain attacks. These are the same vulnerability classes exploited in the [tj-actions/changed-files incident](https://www.vigilantdefense.com/resources/runner-guard) and subsequent supply chain attacks, which compromised CI secrets across thousands of repositories. ### How to verify Review the diff — each change is mechanical and preserves workflow behavior: - **Expression extraction** (RGS-002/008/014): Moves `${{ }}` expressions from `run:` blocks into `env:` mappings, preventing shell injection Run `brew install Vigilant-LLC/tap/runner-guard && runner-guard scan .` or install from the [repo](https://github.com/Vigilant-LLC/runner-guard) to verify. --- Found by [Runner Guard](https://github.com/Vigilant-LLC/runner-guard) | Built by [Vigilant Cyber Security](https://www.vigilantdefense.com) | [Learn more](https://www.vigilantdefense.com/resources/runner-guard) If this PR is not welcome, just close it -- we won't send another. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
