HansMarcus01 opened a new pull request, #39811: URL: https://github.com/apache/beam/pull/39811
## Summary of changes This PR completely refactors the checkout strategy in `.github/workflows/beam_UserRoles.yml` to resolve a critical "pwn request" security vulnerability and unblock Terraform deployments from forks. ## The problem The previous workflow attempted a full checkout of untrusted fork code within a highly privileged `pull_request_target` context. This exposed GCP credentials and secrets to potential malicious scripts. Consequently, GitHub Actions securely blocked the checkout, breaking the IAM CI/CD pipeline. ## The Solution: Dual Secure Checkout We implemented a safe, two-step checkout process utilizing Git's `sparse-checkout`: - Secure Code Checkout: Checks out the trusted, reviewed Terraform configurations and executable scripts directly from the base branch (master). - Isolated Data Checkout: Uses `sparse-checkout` to surgically fetch only the modified `infra/iam/users.yml` data file from the incoming PR. - Safe Integration: Overwrites the base `users.yml` with the PR's dataset before running Terraform. ## Key Benefits * **Zero Security Risk**: Only trusted executable code from master is run, making malicious script injection impossible. * **Restored Validation**: Terraform plan works perfectly against the new data, correctly posting the comparison in PR comments. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
