[
https://issues.apache.org/jira/browse/IGNITE-23820?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17904185#comment-17904185
]
Sergey Korotkov commented on IGNITE-23820:
------------------------------------------
{quote}The changes are needed to make sure an attacker cannot circumvent the
workflow approval by updating their PR just after it was approved.
{quote}
As I see, the update to PR from the non-maintener user just asks for another
workflow approval.
{quote}workflow will not run when the workflow is entirely absent from the
default branch
{quote}
Are you 100% sure? As I remember my tests show the opposite. Such workflows not
just not run if absent but *execute* only code from the master brunch.
As I understand the *workflow_run* is exactly designed to support cases like
this. Build in not priviledged workflow and anylyze and post comments to PR in
the priviledged one.
[https://github.blog/news-insights/product-news/github-actions-improvements-for-fork-and-pull-request-workflows/]
{quote}The new workflow_run event enables you to trigger a new workflow when
one or more workflows are requested or completed. Runs triggered by the
workflow_run event {*}always use the default branch for the repository{*}, and
have access to a read/write token as well as secrets. As an example, as a
maintainer you could set up a workflow that takes the artifacts generated by
the pull request workflow, do some analysis, and post comments back to the pull
request. This event is also available as a web hook and works all repos.
{quote}
> run privileged workflow against approved commit
> -----------------------------------------------
>
> Key: IGNITE-23820
> URL: https://issues.apache.org/jira/browse/IGNITE-23820
> Project: Ignite
> Issue Type: Improvement
> Components: build
> Reporter: Arnout Engelen
> Assignee: Pavel Tupitsyn
> Priority: Minor
> Fix For: 2.17
>
> Attachments: image-2024-12-09-18-53-12-359.png
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> `sonar-pr-from-fork-build.yml` and `sonar-pr-from-fork-scan.yml` analyze PRs.
> `sonar-pr-from-fork-scan.yml` needs privileges to access the
> `SONARCLOUD_TOKEN` and to update the status of the PR check.
> To avoid a malicious PR from accessing those privileges, Ignite requires
> approval for GitHub Actions, and reviews the PR to catch any malicious code
> before approving the workflow.
> Some changes to the workflow are needed to make sure the privileged workflow
> is ran against the commit that was approved, and does not pull in any changes
> that may have been added to the PR after approval.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
