kobihikri opened a new issue, #10617:
URL: https://github.com/apache/rocketmq/issues/10617
### What happened
`.github/workflows/coverage.yml` hardcodes a **Codecov upload token in
plaintext** and passes it to a third-party action:
- **line 30** — `token: <redacted>` (a Codecov upload token, committed in
the clear)
- line 26 — `uses: codecov/codecov-action@v3`
- line 16 — `uses: actions/checkout@master`
(I've redacted the token value here on purpose and have not tested it
against any service — I'm only reporting that a credential is committed.)
### Why it matters
A credential committed to a public repository is readable by anyone and
should be treated as compromised. Codecov *upload* tokens are limited in scope
(they permit uploading coverage reports, not code push/read), so the blast
radius is bounded — but the standard, low-risk fix is to **rotate the token and
move it to a repository secret**. Every other credential in this repo's
workflows already uses `${{ secrets.* }}` (e.g. `DOCKERHUB_TOKEN`, `NEXUS_PW`),
so this one line is the exception.
There's also a small supply-chain angle: the token is handed to
`codecov/codecov-action@v3` (a mutable major tag) in a job that also uses
`actions/checkout@master` (a mutable branch), so pinning those to full commit
SHAs would harden the path the credential flows through.
### Suggested fix
1. **Rotate** the current Codecov token (regenerate it in Codecov).
2. Store it as a repository secret and reference it: `token: ${{
secrets.CODECOV_TOKEN }}`.
3. (Optional) Pin `codecov/codecov-action` and `actions/checkout` to full
commit SHAs.
Happy to send a PR for the workflow change once the token is rotated (I
understand PRs need an ICLA on file). I used AI assistance to spot this; I
verified the file and line numbers myself and did not exfiltrate or use the
credential.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
