[
https://issues.apache.org/jira/browse/HADOOP-19868?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18075486#comment-18075486
]
ASF GitHub Bot commented on HADOOP-19868:
-----------------------------------------
ajfabbri commented on code in PR #8450:
URL: https://github.com/apache/hadoop/pull/8450#discussion_r3125723202
##########
.github/workflows/tmpl_build_and_test.yml:
##########
@@ -86,6 +90,19 @@ jobs:
name: Build Image ${{ inputs.os }}-${{ inputs.branch }}
runs-on: ubuntu-24.04
needs: [ precondition ]
+ # Security: this does not leak write access for our image repository to
+ # forked repos.
+ #
+ # We have `packages: write` permissions for our GITHUB_TOKEN below.
However:
+ #
+ # - For `pull_request`, GitHub downgrades GITHUB_TOKEN permissions to
+ # read-only.
+ # - For `push` triggers on a fork, the GITHUB_TOKEN retains write
+ # permissions, but the `push` is happening in the context of the fork,
not
+ # the upstream repo.
+ # - For `pull_request_target` (not used here), image repo permissions are
+ # scoped to the repository they run on. This prevents forks from writing
+ # to our Apache Hadoop image repo.
Review Comment:
I could probably word this better.
`pull_request_target` always uses the base repo's default branch. So an
attacker cannot add an action which prints/leaks secrets. As you put it, we
trust the code we've already merged.
I don't think forks can push images to our image repo, since GITHUB_TOKEN is
scoped to the repository it runs on, for ghcr.io.
This article is good:
https://github.blog/changelog/2025-11-07-actions-pull_request_target-and-environment-branch-protections-changes/
Note we're following the suggestions in the [What Should You
Do](https://github.blog/changelog/2025-11-07-actions-pull_request_target-and-environment-branch-protections-changes/#what-you-should-do
) section.
My goal here was "proving" that we cannot leak a GITHUB_TOKEN with write
access to the official image repo.
> ci: add security comments to github actions
> -------------------------------------------
>
> Key: HADOOP-19868
> URL: https://issues.apache.org/jira/browse/HADOOP-19868
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: test
> Reporter: Aaron Fabbri
> Assignee: Aaron Fabbri
> Priority: Minor
> Labels: pull-request-available
>
> Following up on HADOOP-19858, I have a patch for some `# Security:` comments
> to add to our github actions to explain why each workflow is safe.
> I'm also following up on INFRA-27839, just to double check they haven't
> enabled any risky defaults. I'll add comments with any details I find.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
