Skip to content

Commit 9ca4fac

Browse files
KevinZhaoKevinZhao
committed
ci: harden lint workflows against credential exposure in fork PRs
Split the single lint job into two separate jobs to follow the principle of least privilege: - remove-label: runs with write permissions but does NOT check out or execute any PR code - lint: checks out and executes PR code but only has read permissions Also add persist-credentials: false to the checkout step to prevent the GITHUB_TOKEN from being stored in git credentials where it could be read by subsequent steps. This follows the same pattern applied to googleapis/genai-toolbox in commits 949e8242 and 3f83c497. Reference: https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
1 parent f5fdc6c commit 9ca4fac

4 files changed

Lines changed: 72 additions & 52 deletions

File tree

‎.github/workflows/lint-toolbox-adk.yaml‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -25,23 +25,14 @@ on:
2525
permissions: read-all
2626

2727
jobs:
28-
lint:
29-
if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' }}"
30-
name: lint
28+
remove-label:
29+
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
3130
runs-on: ubuntu-latest
32-
concurrency:
33-
group: ${{ github.workflow }}-${{ github.ref }}
34-
cancel-in-progress: true
35-
defaults:
36-
run:
37-
working-directory: ./packages/toolbox-adk
3831
permissions:
39-
contents: 'read'
4032
issues: 'write'
4133
pull-requests: 'write'
4234
steps:
4335
- name: Remove PR Label
44-
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
4536
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
4637
with:
4738
github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -56,12 +47,26 @@ jobs:
5647
} catch (e) {
5748
console.log('Failed to remove label. Another job may have already removed it!');
5849
}
50+
51+
lint:
52+
if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' }}"
53+
name: lint
54+
runs-on: ubuntu-latest
55+
concurrency:
56+
group: ${{ github.workflow }}-${{ github.ref }}
57+
cancel-in-progress: true
58+
defaults:
59+
run:
60+
working-directory: ./packages/toolbox-adk
61+
permissions:
62+
contents: 'read'
63+
steps:
5964
- name: Checkout code
6065
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6166
with:
6267
ref: ${{ github.event.pull_request.head.sha }}
6368
repository: ${{ github.event.pull_request.head.repo.full_name }}
64-
token: ${{ secrets.GITHUB_TOKEN }}
69+
persist-credentials: false
6570
- name: Setup Python
6671
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
6772
with:
@@ -81,4 +86,4 @@ jobs:
8186
- name: Run type-check
8287
env:
8388
MYPYPATH: './src'
84-
run: mypy --install-types --non-interactive --cache-dir=.mypy_cache/ -p toolbox_adk
89+
run: mypy --install-types --non-interactive --cache-dir=.mypy_cache/ -p toolbox_adk

‎.github/workflows/lint-toolbox-core.yaml‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -25,23 +25,14 @@ on:
2525
permissions: read-all
2626

2727
jobs:
28-
lint:
29-
if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' }}"
30-
name: lint
28+
remove-label:
29+
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
3130
runs-on: ubuntu-latest
32-
concurrency:
33-
group: ${{ github.workflow }}-${{ github.ref }}
34-
cancel-in-progress: true
35-
defaults:
36-
run:
37-
working-directory: ./packages/toolbox-core
3831
permissions:
39-
contents: 'read'
4032
issues: 'write'
4133
pull-requests: 'write'
4234
steps:
4335
- name: Remove PR Label
44-
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
4536
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
4637
with:
4738
github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -56,12 +47,26 @@ jobs:
5647
} catch (e) {
5748
console.log('Failed to remove label. Another job may have already removed it!');
5849
}
50+
51+
lint:
52+
if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' }}"
53+
name: lint
54+
runs-on: ubuntu-latest
55+
concurrency:
56+
group: ${{ github.workflow }}-${{ github.ref }}
57+
cancel-in-progress: true
58+
defaults:
59+
run:
60+
working-directory: ./packages/toolbox-core
61+
permissions:
62+
contents: 'read'
63+
steps:
5964
- name: Checkout code
6065
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6166
with:
6267
ref: ${{ github.event.pull_request.head.sha }}
6368
repository: ${{ github.event.pull_request.head.repo.full_name }}
64-
token: ${{ secrets.GITHUB_TOKEN }}
69+
persist-credentials: false
6570
- name: Setup Python
6671
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
6772
with:
@@ -81,4 +86,4 @@ jobs:
8186
- name: Run type-check
8287
env:
8388
MYPYPATH: './src'
84-
run: mypy --install-types --non-interactive --cache-dir=.mypy_cache/ -p toolbox_core
89+
run: mypy --install-types --non-interactive --cache-dir=.mypy_cache/ -p toolbox_core

‎.github/workflows/lint-toolbox-langchain.yaml‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -25,23 +25,14 @@ on:
2525
permissions: read-all
2626

2727
jobs:
28-
lint:
29-
if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' }}"
30-
name: lint
28+
remove-label:
29+
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
3130
runs-on: ubuntu-latest
32-
concurrency:
33-
group: ${{ github.workflow }}-${{ github.ref }}
34-
cancel-in-progress: true
35-
defaults:
36-
run:
37-
working-directory: ./packages/toolbox-langchain
3831
permissions:
39-
contents: 'read'
4032
issues: 'write'
4133
pull-requests: 'write'
4234
steps:
4335
- name: Remove PR Label
44-
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
4536
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
4637
with:
4738
github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -56,12 +47,26 @@ jobs:
5647
} catch (e) {
5748
console.log('Failed to remove label. Another job may have already removed it!');
5849
}
50+
51+
lint:
52+
if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' }}"
53+
name: lint
54+
runs-on: ubuntu-latest
55+
concurrency:
56+
group: ${{ github.workflow }}-${{ github.ref }}
57+
cancel-in-progress: true
58+
defaults:
59+
run:
60+
working-directory: ./packages/toolbox-langchain
61+
permissions:
62+
contents: 'read'
63+
steps:
5964
- name: Checkout code
6065
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6166
with:
6267
ref: ${{ github.event.pull_request.head.sha }}
6368
repository: ${{ github.event.pull_request.head.repo.full_name }}
64-
token: ${{ secrets.GITHUB_TOKEN }}
69+
persist-credentials: false
6570
- name: Setup Python
6671
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
6772
with:
@@ -81,4 +86,4 @@ jobs:
8186
- name: Run type-check
8287
env:
8388
MYPYPATH: './src'
84-
run: mypy --install-types --non-interactive --cache-dir=.mypy_cache/ -p toolbox_langchain
89+
run: mypy --install-types --non-interactive --cache-dir=.mypy_cache/ -p toolbox_langchain

‎.github/workflows/lint-toolbox-llamaindex.yaml‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -25,23 +25,14 @@ on:
2525
permissions: read-all
2626

2727
jobs:
28-
lint:
29-
if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' }}"
30-
name: lint
28+
remove-label:
29+
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
3130
runs-on: ubuntu-latest
32-
concurrency:
33-
group: ${{ github.workflow }}-${{ github.ref }}
34-
cancel-in-progress: true
35-
defaults:
36-
run:
37-
working-directory: ./packages/toolbox-llamaindex
3831
permissions:
39-
contents: 'read'
4032
issues: 'write'
4133
pull-requests: 'write'
4234
steps:
4335
- name: Remove PR Label
44-
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
4536
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
4637
with:
4738
github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -56,12 +47,26 @@ jobs:
5647
} catch (e) {
5748
console.log('Failed to remove label. Another job may have already removed it!');
5849
}
50+
51+
lint:
52+
if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' }}"
53+
name: lint
54+
runs-on: ubuntu-latest
55+
concurrency:
56+
group: ${{ github.workflow }}-${{ github.ref }}
57+
cancel-in-progress: true
58+
defaults:
59+
run:
60+
working-directory: ./packages/toolbox-llamaindex
61+
permissions:
62+
contents: 'read'
63+
steps:
5964
- name: Checkout code
6065
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6166
with:
6267
ref: ${{ github.event.pull_request.head.sha }}
6368
repository: ${{ github.event.pull_request.head.repo.full_name }}
64-
token: ${{ secrets.GITHUB_TOKEN }}
69+
persist-credentials: false
6570
- name: Setup Python
6671
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
6772
with:
@@ -81,4 +86,4 @@ jobs:
8186
- name: Run type-check
8287
env:
8388
MYPYPATH: './src'
84-
run: mypy --install-types --non-interactive --cache-dir=.mypy_cache/ -p toolbox_llamaindex
89+
run: mypy --install-types --non-interactive --cache-dir=.mypy_cache/ -p toolbox_llamaindex

0 commit comments

Comments
 (0)