andygrove opened a new issue, #7320: URL: https://github.com/apache/datafusion-comet/issues/7320
## What is the problem? The `docs` job in `ci.yml` calls `docs.yaml` with `contents: write`, so the site can be pushed to `asf-site`. Inside `docs.yaml` the single `build-docs` job holds that write access for the whole run: - Both `actions/checkout` steps use the default `persist-credentials: true`, which leaves the job's `GITHUB_TOKEN` in the checkout's git config. - The job then runs everything that builds the site: `npm install` for mermaid-cli, `pip install -r docs/requirements.txt`, Sphinx, and `docs/build.sh`, which builds four Spark profiles with Maven. - Only the last step, "Copy & push the generated HTML", needs to write. So a compromised dependency of any of those tools runs in the same job as a token that can push to `asf-site`. The job only runs on push to `main` (and a dispatch of `main`), so a pull request cannot reach it. The weakness is the dependency chain of an authorized build. This is hardening, not a known compromise. ## Proposal Split it in two: 1. A build job with `contents: read` and `persist-credentials: false` on both checkouts, which installs, builds, runs the mermaid checks, and uploads `docs/build/html` as an artifact. 2. A small deploy job with `contents: write` that downloads the artifact, checks out `asf-site`, and does the `rsync` and push. This separates the credential from the code that builds. It does not make the built output trustworthy: a compromised builder can still produce malicious pages. It only stops the builder from using the repository's write access directly. Raised in review of #7311, which does not touch this file. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
