[
https://issues.apache.org/jira/browse/IGNITE-23820?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17904132#comment-17904132
]
Arnout Engelen commented on IGNITE-23820:
-----------------------------------------
Hi Sergey, thanks for chiming in! Of course I should've pinged you for a review
sooner, sorry about that.
I'll look into fixing that workflow later today - I think it just needs a "-
uses: actions/checkout@v4", but will double-check.
As you say only `sonar-pr-from-fork-scan.yml` exposes permissions that we don't
want an outside contributor to be able to abuse. Since it is difficult to make
sure the workflow cannot be hijacked, we rely on committers reviewing the PR
before approving the workflow. The changes are needed to make sure an attacker
cannot circumvent the workflow approval by updating their PR just after it was
approved.
`sonar-pr-from-fork-scan.yml` _is_ triggered for pull requests: it starts
immediately after the `SonarBuild` is completed, without waiting for the PR to
be merged. While this workflow indeed doesn't run the build 'itself', it
invokes enough complicated code that it's difficult to be confident there's no
way to sneak in an attack in a malicious commit. For this reason it should also
check out the build that was approved, and not any updated version of the PR.
The "will only trigger a workflow if the workflow file is on the default
branch" restriction from the documentation just means that the workflow will
not run when the workflow is entirely absent from the default branch. Of course
in our case `sonar-pr-from-fork-scan.yml` is present on the default branch, so
that does not prevent the workflow from running.
> run privileged workflow against approved commit
> -----------------------------------------------
>
> Key: IGNITE-23820
> URL: https://issues.apache.org/jira/browse/IGNITE-23820
> Project: Ignite
> Issue Type: Improvement
> Components: build
> Reporter: Arnout Engelen
> Assignee: Pavel Tupitsyn
> Priority: Minor
> Fix For: 2.17
>
> Attachments: image-2024-12-09-18-53-12-359.png
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> `sonar-pr-from-fork-build.yml` and `sonar-pr-from-fork-scan.yml` analyze PRs.
> `sonar-pr-from-fork-scan.yml` needs privileges to access the
> `SONARCLOUD_TOKEN` and to update the status of the PR check.
> To avoid a malicious PR from accessing those privileges, Ignite requires
> approval for GitHub Actions, and reviews the PR to catch any malicious code
> before approving the workflow.
> Some changes to the workflow are needed to make sure the privileged workflow
> is ran against the commit that was approved, and does not pull in any changes
> that may have been added to the PR after approval.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
