chore: add repository synchronization gates - #13
Conversation
Source PR: triggerdotdev#4859 Source head: 892e95c
⛔ Shipwright · BlockedRecommendation: do not merge PR #13 · Tier
Findings (8)
Fireworks usage: 8,370 input · 1,333 output · 9,703 total tokens · $0.0027 · 22s · 0 fix iteration(s) Open the Shipwright check for full evidence and the audit bundle. Use |
![shipwright-agent[bot]](https://avatars.githubusercontent.com/u/140162738?s=60&v=4){kind=small}
|
|
||
| for _ in $(seq 1 60); do | ||
| git -C public fetch --no-tags origin \ | ||
| +refs/heads/main:refs/remotes/origin/main |
There was a problem hiding this comment.
Shipwright · CRITICAL
The wait loop runs 'mono/tooling/plan-repo-ops-outbound.sh' and then parses 'native_count' from its output file.
Impact: The wait loop runs 'mono/tooling/plan-repo-ops-outbound.sh' and then parses 'native_count' from its output file. If the script fails, 'set -euo pipefail' will abort the step, but the temporary output file is never cleaned up because 'rm -f "$output"' is skipped on failure. More importantly, if the script produces no 'native_count=' line, 'grep' returns non-zero and the step fails immediately rather than retrying, wh…
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| git clone --filter=blob:none --no-tags \ | ||
| "https://x-access-token:${PUBLIC_TOKEN}@github.com/${PUBLIC_REPOSITORY}.git" public | ||
| git clone --filter=blob:none --no-tags \ | ||
| "https://x-access-token:${APP_TOKEN}@github.com/${MONO_REPOSITORY}.git" mono |
There was a problem hiding this comment.
Shipwright · CRITICAL
The workflow embeds the GitHub token directly into the clone URL: 'https://x-access-token:${PUBLIC_TOKEN}@github.com/...'.
Impact: The workflow embeds the GitHub token directly into the clone URL: 'https://x-access-token:${PUBLIC_TOKEN}@github.com/...'. GitHub Actions automatically redacts registered secrets in logs, but 'PUBLIC_TOKEN' is 'github.token', which is not a registered secret and may not be redacted. If the clone command fails or is echoed by 'set -x'/debug logging, the token can leak into workflow logs. Use 'git -c http.extraheader=…
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| git clone --filter=blob:none --no-tags \ | ||
| "https://x-access-token:${APP_TOKEN}@github.com/${MONO_REPOSITORY}.git" mono | ||
|
|
||
| for _ in $(seq 1 60); do |
There was a problem hiding this comment.
Shipwright · CRITICAL
The same token-in-URL pattern is used for the private mono repository with the GitHub App token: 'https://x-access-token:${APP_TOKEN}@github.com/${MONO_REPOSITORY}.git'.
Impact: The same token-in-URL pattern is used for the private mono repository with the GitHub App token: 'https://x-access-token:${APP_TOKEN}@github.com/${MONO_REPOSITORY}.git'. The App token has 'contents: read' on the private mono repository. If this URL leaks in logs, an attacker could read the entire private mono repository, which likely contains proprietary or unreleased code. This is a high-impact secret exposure risk.
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| +refs/heads/main:refs/remotes/origin/main | ||
| git -C mono fetch --no-tags origin \ | ||
| +refs/heads/main:refs/remotes/origin/main | ||
| output="$(mktemp)" |
There was a problem hiding this comment.
Shipwright · HIGH
The 'plan-repo-ops-outbound.sh' script is invoked with positional arguments 'mono public "$(git -C mono rev-parse origin/main)" "$MONO_BASELINE" "$PUBLIC_BASELINE" "$output"', but
Impact: The 'plan-repo-ops-outbound.sh' script is invoked with positional arguments 'mono public "$(git -C mono rev-parse origin/main)" "$MONO_BASELINE" "$PUBLIC_BASELINE" "$output"', but there is no documentation or comment explaining what these arguments mean. A new hire would have to read the script in the private mono repository to understand the contract. The variable names 'MONO_BASELINE' and 'PUBLIC_BASELINE' are opa…
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
|
|
||
| permissions: | ||
| contents: read | ||
|
|
There was a problem hiding this comment.
Shipwright · HIGH
The 'dispatch' workflow has a 'concurrency' group with 'cancel-in-progress: false', which means multiple pushes to main will queue up dispatches.
Impact: The 'dispatch' workflow has a 'concurrency' group with 'cancel-in-progress: false', which means multiple pushes to main will queue up dispatches. If the private sync worker is slow, this could create a backlog of dispatches. There is no comment explaining why 'cancel-in-progress' is false, which is unusual for a dispatch workflow where only the latest SHA matters.
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| id: app-token | ||
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | ||
| with: | ||
| app-id: ${{ vars.REPO_OPS_DISPATCHER_APP_ID }} |
There was a problem hiding this comment.
Shipwright · HIGH
The 'dispatch' job in the dispatch workflow uses 'permission-contents: write' for the GitHub App token, but the workflow-level permissions are 'contents: read'.
Impact: The 'dispatch' job in the dispatch workflow uses 'permission-contents: write' for the GitHub App token, but the workflow-level permissions are 'contents: read'. The App token is created with write access to the private mono repository, and the workflow dispatches a 'repository_dispatch' event to that repository. If the 'MONO_REPOSITORY' secret is ever compromised or the regex validation is bypassed, an attacker coul…
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| PR_BODY: ${{ github.event.pull_request.body }} | ||
| run: | | ||
| python3 - <<'PY' | ||
| import os |
There was a problem hiding this comment.
Shipwright · HIGH
The 'Reject reserved RepoOps trailers' step only checks the PR title and body for 'OSS-RevId:' or 'Mono-RevId:' trailers.
Impact: The 'Reject reserved RepoOps trailers' step only checks the PR title and body for 'OSS-RevId:' or 'Mono-RevId:' trailers. It does not check commit messages, which are a common place for trailers. An attacker could add a reserved trailer to a commit message and potentially confuse the sync tooling. The regex is also case-sensitive and anchored to line start, so 'oss-revid:' or leading whitespace would bypass the chec…
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| gate: | ||
| if: github.event_name == 'pull_request' || vars.REPO_OPS_SYNC_ENABLED == 'true' | ||
| timeout-minutes: 15 | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
Shipwright · LOW
The merge_group gate job condition is 'github.event_name == 'pull_request' || vars.REPO_OPS_SYNC_ENABLED == 'true''.
Impact: The merge_group gate job condition is 'github.event_name == 'pull_request' || vars.REPO_OPS_SYNC_ENABLED == 'true''. For merge_group events, the first condition is false, so the job only runs when the repository variable is enabled. However, the subsequent steps that create the app token and wait for pending mono changes are gated only on 'github.event_name == 'merge_group''. If the variable is disabled, the job is…
Suggested fix: Fix the review finding before release.
1 participant
Summary
Adds disabled repository synchronization workflows and guards merge-queue entries against unsynchronized changes. The workflows remain inactive until the repository configuration is explicitly enabled.
Source merge-base:
43ecf15f80277c0eb931c08ddd89de55179cc795Source head:
892e95c80b12bd51c44171f3fcaa2b729cdcc48e