Harden CI: stop the i18n autotranslate jobs persisting the job credential #5343
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -34,6 +34,17 @@ jobs: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| fetch-depth: 2 # need the previous en.json to detect CHANGED keys | ||
| # Nothing in this job pushes from this working copy. The only git | ||
|
There was a problem hiding this comment. The blueprint describes scanning workflow definitions for unscoped repository tokens but does not document the There was a problem hiding this comment. The blueprint describes the SecurityAuditScanner component that scans for unscoped repository tokens in workflow definitions, but does not document the There was a problem hiding this comment. The blueprint describes the SecurityAuditScanner component that scans workflow definitions for unscoped repository tokens, but does not document the There was a problem hiding this comment. The blueprint describes SecurityAuditScanner scanning workflow definitions for unscoped repository tokens but does not document the There was a problem hiding this comment. The blueprint documents that SecurityAuditScanner scans workflow definitions for unscoped repository tokens, but does not document the There was a problem hiding this comment. The blueprint documents that SecurityAuditScanner scans workflow definitions for unscoped repository tokens, but does not document the There was a problem hiding this comment. The blueprint documents SecurityAuditScanner's responsibility to scan workflow definitions for unscoped repository tokens, but does not document the There was a problem hiding this comment. The blueprint documents SecurityAuditScanner's responsibility to scan workflow definitions for unscoped repository tokens, but does not document the There was a problem hiding this comment. The blueprint documents SecurityAuditScanner's responsibility to scan workflow definitions for unscoped repository tokens, but does not document the systematic application of There was a problem hiding this comment. The blueprint documents SecurityAuditScanner's responsibility to scan workflow definitions for unscoped repository tokens but does not document the There was a problem hiding this comment. The blueprint documents SecurityAuditScanner's responsibility to scan workflow definitions for unscoped repository tokens but does not document the There was a problem hiding this comment. The blueprint documents SecurityAuditScanner scanning workflow definitions for unscoped repository tokens but does not document the There was a problem hiding this comment. The blueprint documents SecurityAuditScanner scanning workflow definitions for unscoped repository tokens, but does not document the systematic application of There was a problem hiding this comment. The blueprint documents SecurityAuditScanner scanning workflow definitions for unscoped repository tokens, but does not document the systematic hardening practice of applying |
||
| # operation that reaches the network is the `Open sync PR` step, and | ||
| # peter-evans/create-pull-request configures its own credential from | ||
| # its `token` input (default `${{ github.token }}`) -- it unsets any | ||
| # persisted http.<url>.extraheader first and restores it afterwards, | ||
| # so it never reads this one. The script below only runs | ||
| # `git show <ref>:<path>`, a local object read needing no credential. | ||
| # Left persisted, a `contents: write` token would instead sit | ||
| # readable in .git/config for the whole job, which installs a global | ||
| # npm package and runs the Claude Code CLI over repository content. | ||
| persist-credentials: false | ||
|
|
||
| - name: Guard - require Claude Code token | ||
| run: | | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -28,6 +28,15 @@ jobs: | |
| CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
|
There was a problem hiding this comment. The blueprint describes scanning workflow definitions for security issues but does not document the There was a problem hiding this comment. The blueprint describes scanning workflow definitions for unscoped repository tokens but does not document the There was a problem hiding this comment. The blueprint describes the SecurityAuditScanner component that scans for unscoped repository tokens in workflow definitions, but does not document the There was a problem hiding this comment. The blueprint describes the SecurityAuditScanner component that scans workflow definitions for unscoped repository tokens, but does not document the There was a problem hiding this comment. The blueprint describes SecurityAuditScanner scanning workflow definitions for unscoped repository tokens but does not document the There was a problem hiding this comment. The blueprint documents that SecurityAuditScanner scans workflow definitions for unscoped repository tokens, but does not document the There was a problem hiding this comment. The blueprint documents that SecurityAuditScanner scans workflow definitions for unscoped repository tokens, but does not document the There was a problem hiding this comment. The blueprint documents SecurityAuditScanner's responsibility to scan workflow definitions for unscoped repository tokens, but does not document the There was a problem hiding this comment. The blueprint documents SecurityAuditScanner's responsibility to scan workflow definitions for unscoped repository tokens, but does not document the There was a problem hiding this comment. The blueprint documents SecurityAuditScanner's responsibility to scan workflow definitions for unscoped repository tokens, but does not document the systematic application of There was a problem hiding this comment. The blueprint documents SecurityAuditScanner's responsibility to scan workflow definitions for unscoped repository tokens but does not document the There was a problem hiding this comment. The blueprint documents SecurityAuditScanner's responsibility to scan workflow definitions for unscoped repository tokens but does not document the There was a problem hiding this comment. The blueprint documents SecurityAuditScanner scanning workflow definitions for unscoped repository tokens but does not document the There was a problem hiding this comment. The blueprint documents SecurityAuditScanner scanning workflow definitions for unscoped repository tokens, but does not document the systematic application of There was a problem hiding this comment. The blueprint documents SecurityAuditScanner scanning workflow definitions for unscoped repository tokens, but does not document the systematic hardening practice of applying |
||
| # Same reasoning as i18n-autotranslate.yml: this working copy is | ||
| # never pushed from. The only networked git operation is the | ||
| # `Open sync PR` step, and peter-evans/create-pull-request supplies | ||
| # its own credential from its `token` input rather than reading a | ||
| # persisted one. scripts/i18n_translate_docs.py does not touch git | ||
| # at all. So this credential has no consumer, and would otherwise | ||
| # stay readable in .git/config across the Claude Code CLI run. | ||
| persist-credentials: false | ||
|
|
||
| - name: Guard - require Claude Code token | ||
| run: | | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The blueprint describes scanning workflow definitions for security issues but does not document the
persist-credentials: falsehardening practice now systematically applied across 78 checkout steps in 38 workflow files, including in the i18n workflows.