dagecko opened a new pull request, #21556: URL: https://github.com/apache/echarts/pull/21556
> This is a re-submission of #21555, which was closed due to a branch issue on my end. Same fixes, apologies for the noise. ## Security: Harden GitHub Actions workflows Hey, I found some CI/CD security issues in this repo's GitHub Actions workflows. These are the same vulnerability classes that were exploited in the tj-actions/changed-files supply chain attack. I've been reviewing repos that are affected and submitting fixes where I can. This PR applies mechanical fixes and flags anything else that needs a manual look. Happy to answer any questions. ### Fixes applied | Rule | Severity | File | Description | |------|----------|------|-------------| | RGS-002 | high | `.github/workflows/teardown-pr-preview.yml` | Extracted 1 unsafe expression(s) to env vars | ### Additional findings (manual review recommended) | Rule | Severity | File | Description | | RGS-004 | high | `.github/workflows/pr-preview.yml` | Comment-Triggered Workflow Without Author Authorization Check | | RGS-004 | high | `.github/workflows/pr-preview.yml` | Comment-Triggered Workflow Without Author Authorization Check | | RGS-004 | high | `.github/workflows/pr-preview.yml` | Comment-Triggered Workflow Without Author Authorization Check | | RGS-004 | high | `.github/workflows/pr-preview.yml` | Comment-Triggered Workflow Without Author Authorization Check | | RGS-004 | high | `.github/workflows/pr-preview.yml` | Comment-Triggered Workflow Without Author Authorization Check | ### Why this matters GitHub Actions workflows that use untrusted input in `run:` blocks or reference unpinned third-party actions are vulnerable to code injection and supply chain attacks. These are the same vulnerability classes exploited in the [tj-actions/changed-files incident](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-attack-and-its-impact) which compromised CI secrets across thousands of repositories. ### How to verify Review the diff, each change is mechanical and preserves workflow behavior: - **Expression extraction**: Moves `${{ }}` expressions from `run:` blocks into `env:` mappings, preventing shell injection --- If this PR is not welcome, just close it and I won't send another. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
