morningman opened a new pull request, #4434: URL: https://github.com/apache/doris-website/pull/4434
## Summary Maintainer-triggered reviews currently check out PR code on runners that later receive OSS credentials or GitHub write tokens. An external contributor can change project plugins, dependency scripts, or the comment renderer and cross that boundary when a maintainer requests a review. Run credentialed orchestration from merged, trusted code and keep PR execution on separate read-only runners. The threat model is contributors without repository write access; repository writers remain trusted. Existing repository secrets and the existing Production environment continue to work, with no new Environment configuration, credential migration, or GitHub App installation required. - Authorize exact `/review` and `/review-docs` commands using the comment author's actual repository permission. Split analysis and comment publication into separate jobs, validate result schemas and current PR commits, and constrain inline comments to the reviewed diff. - Run a checksum-verified OpenCode binary from a clean directory with external plugins and tools disabled. Supply trusted review instructions plus PR text, exclude inherited GitHub/OSS credentials, and upload only the validated review JSON. Reviews disclose their text-only context limits and fail closed for oversized or incomplete results. - Give fork PR checks explicit read permissions, remove the Production environment from Build Check, disable checkout credential persistence, and pass changed-file lists through environment variables rather than interpolating them into shell scripts. - Split website/PDF builds from credentialed deployment jobs. Resolve protected source branches to immutable SHAs and load local deployment actions from the master workflow commit. Keep the current Russian publishing support and shared Japanese/Korean/Russian translation workflow. - Pin external actions and tool downloads. Disable lifecycle scripts in translation dependency installation, check credential presence without injecting raw values, and mask OSS-loaded authentication tokens. Document the trust model and verification procedure in `.github/WORKFLOW_SECURITY.md`. ## Validation - 17 workflow security tests pass, including hostile PR plugins/file names, authorization, secret-free model environments, stale/malformed results, diff locations, deployment refs, and repository-secret compatibility. - 90 existing docs-governance and translation tests pass. - actionlint 1.7.12 and its ShellCheck integration pass with the single documented compatibility exception for GitHub's supported `concurrency.queue` property. - `git diff --check` passes. No production credentials were used for testing. A live privileged review and deployment require verification after merge because comment workflows execute the default-branch version. OpenCode now performs text-only review; it does not run PR commands. PDF generation uses Node 20 and pins `vitpress-generate-pdf` to 1.1.4; full site/PDF publishing was not run locally. ## Self-review | Checkpoint | Conclusion | | --- | --- | | Goal | Untrusted PR workflows/actions/plugins cannot execute in credentialed jobs; privileged trigger authorization checks actual repository write permission. | | Scope and clarity | Changes are limited to workflow orchestration, its helpers, regression tests, and internal security guidance. Existing secrets remain compatible. | | Documentation architecture | User docs, active versions, locales, blog/community navigation, and sidebar structure are unaffected. The new guide is internal. | | Links and routing | No user-facing paths, slugs, anchors, sidebar entries, or redirects change. | | Repository/build conventions | Preserve website build commands and Russian locale support; isolate deployment through same-run artifacts. Trusted protected-branch previews remain supported. No frontend/theme code changes. | | Validation | Local security, related regression, workflow, and shell checks pass; live credentialed execution and full publishing remain rollout checks. | | Other issues | No additional blocking issues found in self-review. Review context limits and rollout checks are documented. | ## Versions Not applicable: automation and internal guidance only. ## Languages English internal security guidance; user documentation and locale counterparts are unaffected. ## Docs Checklist - [x] Checked by AI (self-review above) - [x] Test Cases Built (17 security and 90 related tests pass; full publishing is a rollout check) - [x] Updated required version and language counterparts, or explained why not - [x] If only one language changed, confirmed whether source/translation counterparts need sync -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
