fix: Removed usage of pull_request_target as much as possible to prev…

…ent security concerns Signed-off-by: Theodor Mihalache <[email protected]>
tmihalac · Sep 24, 2024 · ced4c78 · ced4c78
1 parent 290bb5c
commit ced4c78
Show file tree

Hide file tree

Showing 7 changed files with 45 additions and 33 deletions.
diff --git a/.github/fork_workflows/fork_pr_integration_tests_aws.yml b/.github/fork_workflows/fork_pr_integration_tests_aws.yml
@@ -27,9 +27,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          repository: ${{ github.event.repository.full_name }}  # Uses the full repository name
-          ref: ${{ github.ref }}                                  # Uses the ref from the event
-          token: ${{ secrets.GITHUB_TOKEN }}                     # Automatically provided token
+          # pull_request_target runs the workflow in the context of the base repo
+          # as such actions/checkout needs to be explicit configured to retrieve
+          # code from the PR.
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
       - name: Setup Python
         uses: actions/setup-python@v5

diff --git a/.github/fork_workflows/fork_pr_integration_tests_gcp.yml b/.github/fork_workflows/fork_pr_integration_tests_gcp.yml
@@ -27,9 +27,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          repository: ${{ github.event.repository.full_name }}  # Uses the full repository name
-          ref: ${{ github.ref }}                                  # Uses the ref from the event
-          token: ${{ secrets.GITHUB_TOKEN }}                     # Automatically provided token
+          # pull_request_target runs the workflow in the context of the base repo
+          # as such actions/checkout needs to be explicit configured to retrieve
+          # code from the PR.
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
       - name: Setup Python
         uses: actions/setup-python@v5

diff --git a/.github/fork_workflows/fork_pr_integration_tests_snowflake.yml b/.github/fork_workflows/fork_pr_integration_tests_snowflake.yml
@@ -27,9 +27,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          repository: ${{ github.event.repository.full_name }}  # Uses the full repository name
-          ref: ${{ github.ref }}                                  # Uses the ref from the event
-          token: ${{ secrets.GITHUB_TOKEN }}                     # Automatically provided token
+          # pull_request_target runs the workflow in the context of the base repo
+          # as such actions/checkout needs to be explicit configured to retrieve
+          # code from the PR.
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
       - name: Setup Python
         uses: actions/setup-python@v5

diff --git a/.github/workflows/java_pr.yml b/.github/workflows/java_pr.yml
@@ -1,15 +1,18 @@
 name: java_pr
 
 on:
-  pull_request:
+  pull_request_target:
     types:
       - opened
       - synchronize
       - labeled
 
+permissions:
+  pull-requests: read
+
 jobs:
   lint-java:
-    # when using pull_request, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
+    # when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
     if:
       ((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
       (github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
@@ -18,15 +21,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          repository: ${{ github.event.repository.full_name }}  # Uses the full repository name
-          ref: ${{ github.ref }}                                  # Uses the ref from the event
-          token: ${{ secrets.GITHUB_TOKEN }}                     # Automatically provided token
+          # pull_request_target runs the workflow in the context of the base repo
+          # as such actions/checkout needs to be explicit configured to retrieve
+          # code from the PR.
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
+          persist-credentials: false
       - name: Lint java
         run: make lint-java
 
   unit-test-java:
-    # when using pull_request, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
+    # when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
     if:
       ((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
       (github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
@@ -36,10 +41,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          repository: ${{ github.event.repository.full_name }}  # Uses the full repository name
-          ref: ${{ github.ref }}                                  # Uses the ref from the event
-          token: ${{ secrets.GITHUB_TOKEN }}                     # Automatically provided token
+          # pull_request_target runs the workflow in the context of the base repo
+          # as such actions/checkout needs to be explicit configured to retrieve
+          # code from the PR.
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
+          persist-credentials: false
       - name: Set up JDK 11
         uses: actions/setup-java@v1
         with:
@@ -66,7 +73,7 @@ jobs:
           path: ${{ github.workspace }}/docs/coverage/java/target/site/jacoco-aggregate/
 
   build-docker-image-java:
-    # when using pull_request, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
+    # when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
     if:
       ((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
       (github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
@@ -82,6 +89,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: 'true'
+          persist-credentials: false
       - name: Setup Python
         uses: actions/setup-python@v5
         id: setup-python
@@ -101,7 +109,7 @@ jobs:
         run: make build-${{ matrix.component }}-docker REGISTRY=${REGISTRY} VERSION=${GITHUB_SHA}
 
   integration-test-java-pr:
-    # when using pull_request, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
+    # when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
     if:
       ((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
       (github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
@@ -113,11 +121,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          # pull_request runs the workflow in the context of the base repo
+          # pull_request_target runs the workflow in the context of the base repo
           # as such actions/checkout needs to be explicit configured to retrieve
           # code from the PR.
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
+          persist-credentials: false
       - name: Set up JDK 11
         uses: actions/setup-java@v1
         with:

diff --git a/.github/workflows/lint_pr.yml b/.github/workflows/lint_pr.yml
@@ -7,14 +7,10 @@ on:
       - edited
       - synchronize
 
-permissions:
-  # read-only perms specified due to use of pull_request in lieu of security label check
-  pull-requests: read
-
 jobs:
   validate-title:
     if:
-      github.repository == 'feast-dev/feast'
+      github.event.pull_request.base.repo.full_name == 'feast-dev/feast'
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:

diff --git a/.github/workflows/pr_integration_tests.yml b/.github/workflows/pr_integration_tests.yml
@@ -1,7 +1,7 @@
 name: pr-integration-tests
 
 on:
-  pull_request:
+  pull_request_target:
     types:
       - opened
       - synchronize
@@ -11,10 +11,13 @@ on:
 #concurrency:
 #  group: pr-integration-tests-${{ github.event.pull_request.number }}
 #  cancel-in-progress: true
+permissions:
+  actions: write
+  pull-requests: read
 
 jobs:
   integration-test-python:
-    # when using pull_request, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
+    # when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
     if:
       ((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
       (github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
@@ -41,10 +44,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          repository: ${{ github.event.repository.full_name }}  # Uses the full repository name
-          ref: ${{ github.ref }}                                  # Uses the ref from the event
-          token: ${{ secrets.GITHUB_TOKEN }}                     # Automatically provided token
+          # pull_request_target runs the workflow in the context of the base repo
+          # as such actions/checkout needs to be explicit configured to retrieve
+          # code from the PR.
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
+          persist-credentials: false
       - name: Setup Python
         uses: actions/setup-python@v5
         id: setup-python

diff --git a/.github/workflows/pr_local_integration_tests.yml b/.github/workflows/pr_local_integration_tests.yml
@@ -10,11 +10,10 @@ on:
 
 jobs:
   integration-test-python-local:
-    # when using pull_request, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
     if:
       ((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
       (github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
-      github.repository == 'feast-dev/feast'
+      github.event.pull_request.base.repo.full_name == 'feast-dev/feast'
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false