New repos: GitHub refuses the default CI stub as possibly malicious (JSON secrets transport)

[thorwhalen]

What happens

A repository scaffolded today with wads.project_setup.setup_project got the default CI stub, whose secrets: block is the JSON transport:

secrets:
  WADS_CI_SECRETS_JSON: ${{ toJSON(toJSON(secrets)) }}

GitHub did not run it. Every run ended at once with the conclusion action_required and no jobs, on both push and pull_request. The run page says:

GitHub detected that this workflow file may be malicious. It will not run until someone with write access approves it. Review the workflow file carefully before approving.

gh run rerun answers "cannot be rerun; its workflow file may be broken".

What fixed it

wads-migrate ci-to-stub --transport named, which passes PYPI_PASSWORD by name. The next push ran normally, with the same reusable workflow at @master.

Notes

• Older repositories with the same JSON stub still run. The refusal was seen on a repository created the same day, so it may apply to new repositories or to a workflow file's first appearance.
• Changing the repository's default workflow permissions made no difference.
• The signal is easy to misread: gh pr checks reports "no checks reported", and nothing in the API output gives the reason. It is only on the run's web page.

Suggestion

Either make named the transport of the stub that populate writes for a new repository, or have populate say that the first run may need an approval on the run page.

Seen on: https://github.com/thorwhalen/keeptabs/actions/runs/36307045959