pan3793 commented on code in PR #8450:
URL: https://github.com/apache/hadoop/pull/8450#discussion_r3125543667
##########
.github/workflows/tmpl_build_and_test.yml:
##########
@@ -86,6 +90,20 @@ jobs:
name: Build Image ${{ inputs.os }}-${{ inputs.branch }}
runs-on: ubuntu-24.04
needs: [ precondition ]
+ # Security: this does not leak write access for our image repository to
+ # forked repos.
+ #
+ # We have `packages: write` permissions for our GITHUB_TOKEN below.
However:
+ #
+ # - For `pull_request`, GitHub downgrades GITHUB_TOKEN permissions to
+ # read-only.
+ # - For `push` triggers on a fork, the GITHUB_TOKEN retains write
+ # permissions, but the `push` is happening in the context of the fork,
not
+ # the upstream repo.
+ # - For `pull_request_target` (risky), the write permission is
+ # overridden by our repository's setting "Send write tokens to workflows
+ # from pull requests" which should be disabled.
+ # See https://issues.apache.org/jira/browse/INFRA-27839 for confirmation.
Review Comment:
as I said before, I think we should NOT do that, some workflow will not work
without write permission
##########
.github/workflows/update_build_status.yml:
##########
@@ -23,6 +23,8 @@ on:
schedule:
- cron: "*/15 * * * *"
+# Security: privileged (can write) workflow is only triggered via schedule,
+# so issues associated with forks do not apply.
Review Comment:
nit
```suggestion
# so issues associated with forks do not apply.
```
##########
.github/workflows/tmpl_build_and_test.yml:
##########
@@ -86,6 +90,20 @@ jobs:
name: Build Image ${{ inputs.os }}-${{ inputs.branch }}
runs-on: ubuntu-24.04
needs: [ precondition ]
+ # Security: this does not leak write access for our image repository to
+ # forked repos.
+ #
+ # We have `packages: write` permissions for our GITHUB_TOKEN below.
However:
+ #
+ # - For `pull_request`, GitHub downgrades GITHUB_TOKEN permissions to
+ # read-only.
+ # - For `push` triggers on a fork, the GITHUB_TOKEN retains write
+ # permissions, but the `push` is happening in the context of the fork,
not
+ # the upstream repo.
+ # - For `pull_request_target` (risky), the write permission is
+ # overridden by our repository's setting "Send write tokens to workflows
+ # from pull requests" which should be disabled.
+ # See https://issues.apache.org/jira/browse/INFRA-27839 for confirmation.
Review Comment:
as I said before, I think we should NOT do that, some workflows will not
work without write permission
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
