Repository navigation
Conversation
Five workflows pushed their fixes to the pull request branch with the TAILOR_GITHUB_APP credentials, whose private key sits in repository secrets that workflows on any branch of the repository can read. Request the commit from a securefix server instead: the client only holds a key that can create issue labels, and the server pushes the commit with its own GitHub App token, so the checks on the new head still start by themselves. When the client pushes to the branch it runs on, it fails the step after sending the request. That marks only the superseded run, and it is what commit-action did by default; fail_on_self_push: false has no securefix counterpart, so ci.yml and add-renovate-changeset.yml fail the same way. Pull requests from forks get no secrets, so the steps and jobs skip them. skills-sync-check.yml also skips pushes to main, where securefix does not push. update_aqua_checksum.yml runs aqua update-checksum directly instead of the reusable workflow that was given the App credentials. Renovate must not treat the server commits as human edits, so add the securefix server bot to gitIgnoredAuthors.
Both workflows minted a GitHub App token only to open a pull request, which needs just contents: write and pull-requests: write on the job. Use the job's GITHUB_TOKEN, so the App credentials are no longer read here. Checks on a pull request opened or updated with GITHUB_TOKEN start only after someone with write access selects "Approve workflows to run", so the required checks need that click on the release PR and on the lockfile PR. release.yml also pushes a follow-up commit to the release PR branch through the Contents API; GitHub's documentation does not say whether that push asks for approval as well.
|
The securefix server only accepts a request from a client workflow named securefix and rejects any other name, so the five workflows that pushed fixes under their own names would have failed on every request. Move the fixes (generate, expected fixtures, lint and format on Renovate pull requests, skills sync, aqua checksums, Renovate changesets) into securefix.yml. Its regenerate job runs the branch's tooling without a secret and hands over a patch; its push job installs nothing from the branch, checks the patch against a denylist and sends it through the client. The generate and skills checks now fail on a difference instead of pushing, so pull requests from forks and pushes to main no longer pass with stale files. aqua update-checksum runs with -deep again, as the reusable workflow did.
The patch comes from a job that runs the pull request branch's own dependencies, and the push job commits it with the client's token. The denylist missed files that change how installs, editors, agents or the formatter behave, so a compromised dependency could have slipped one of them into the commit. Also reject .pnpmfile.*, .mcp.json, .vscode/, .devcontainer/, version manager files, CLAUDE.md, AGENTS.md, the oxfmt and oxlint configs and tsconfig files. A fix that needs one of them has to be committed by hand.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
TAILOR_GITHUB_APP_*credentials in the workflows. Pushes to a pull request branch go through securefix, and the two workflows that open pull requests useGITHUB_TOKEN.securefix, so every fix that is pushed to a pull request branch now lives insecurefix.yml. The workflows that check the same files keep only the checks.What changes per workflow
securefix.yml(new)ci.ymlauto-fix-lint-formatjob pushed lint/format fixescijob is unchangedgenerate.ymlcommit-action+ App keysecurefix.ymlskills-sync-check.ymlcommit-action+ App keyskills/differs; the copy lives in.github/scripts/sync-skills.shadd-renovate-changeset.ymlcommit-action+ App keysecurefix.ymlupdate_aqua_checksum.ymlaqua update-checksum -deep -pruneruns insecurefix.ymllockfile-audit-fix.ymlcreate-signed-prGITHUB_TOKEN(contents: write,pull-requests: writeon the job)release.ymlchangesets/actionand the release-PR fixup scriptGITHUB_TOKEN(pull-requests: writeadded to the job)renovate.json: the securefix server bot is added togitIgnoredAuthors, next to the existing bot, so Renovate does not treat its commits as human edits.actions.lockis regenerated withpnpm run actions:lock:update.How
securefix.ymlworksregenerateruns the pull request's dependencies and tools with no secret and hands over a patch as an artifact.pushholds the client key, installs and runs nothing from the branch, and applies the patch only if every changed path is allowed.renovate-<number>.md), package manager and tool settings, andpackage.jsonfiles are rejected. A fix that needs one of them has to be committed by hand.generate.ymlandskills-sync-check.ymlnow fail on them when files differ, instead of passing silently.Behavior to know
securefixrun is the superseded one; the run on the new head replaces it.cireports a lint or format failure, because a separate workflow cannot read that result.GITHUB_TOKENstart their checks after someone with write access selects "Approve workflows to run". The required checks (ci,deploy-result,generate,test-summary,generate-summary) need that click on the release PR and on the lockfile PR.To confirm by running
release.ymlpushes a follow-up commit to the release PR branch through the Contents API. GitHub's documentation does not say whether this push, made withGITHUB_TOKEN, also asks for approval.changesets/actionandcreate-signed-prto open pull requests withGITHUB_TOKEN.securefixworkflow and pushes the commit.Not in this PR
Removing the
TAILOR_GITHUB_APP_IDandTAILOR_GITHUB_APP_PRIVATE_KEYrepository secrets, once this has merged and the workflows have run.