harden(janitor): SHA-pin actions/checkout (org-token-handling action) - #22
Open
asachs01 wants to merge 2 commits into
Open
harden(janitor): SHA-pin actions/checkout (org-token-handling action)#22asachs01 wants to merge 2 commits into
asachs01 wants to merge 2 commits into
Conversation
…pp-token)
GAP-2 (warden severity-elevated): the checkout step does token: ${{ steps.app-token.outputs.token }}
to push the backlog, persisting the ORG-WIDE Contents+PR app-token into .git/config. A
floating @v4 tag → a repointed/compromised tag could exfiltrate the crown-jewel token =
fleet-wide compromise. SHA-pin to v4.3.0 (34e114876b0b11c390a56381ad16ebd13914f8d5) per
CI-QW-3. Pure pin, zero behavior change. (create-github-app-token was already pinned.)
warden pin-legitimacy check: 34e114876b0b11c390a56381ad16ebd13914f8d5 is checkout v4.3.1 (current v4 head), NOT v4.3.0 (=08eba0b). SHA is legitimate; the comment mislabeled the version. SHA + comment must AGREE (the comment is how a human audits the intended version). Corrected to v4.3.1 (latest v4 patch, fine to pin).
Member
Author
|
warden pin-legitimacy catch: 34e1148 = v4.3.1 (current v4 head), not v4.3.0 (=08eba0b). SHA is legit; comment was mislabeled → corrected to # v4.3.1. SHA+comment now agree. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GAP-2 (warden-elevated): the janitor's checkout step persists the org-wide app-token into .git/config (backlog push). Floating @v4 → repointed-tag = org-token exfil = fleet compromise. SHA-pin to v4.3.0 per CI-QW-3. Pure pin, zero behavior change. Ready for Aaron approve + warden security-glance.