fix(release): use inline http.extraheader instead of git remote set-url - #84
Conversation
CodeRabbit catch (CWE-522) on the retrofit's rollout to the other repos: set-url writes the token into .git/config, readable by any later process in the job. Authenticate each git network call individually via -c http.extraheader instead -- nothing persists to disk. task_1788457898992.
|
Warning Review limit reachedNext included review available in 6 minutes. View limit detailsLimit details: You’ve used all 10 included reviews currently available. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (1)
Comment |
GitHub auto-masks GITHUB_TOKEN itself but not derived/transformed values like its base64 encoding -- a stray verbose/trace output could otherwise print the header in a public workflow log. ::add-mask:: right after computing it, before any git command uses it, at all 3 call sites.
|
Reviewed the full diff directly. Confirmed all 3 sites correctly: fetch (env GITHUB_TOKEN, already present), tag push (added a new env block since that step had none before -- correct, it needs GITHUB_TOKEN now), release/next push (uses a distinct PUSH_TOKEN rather than the step's GITHUB_TOKEN, which is correctly claimed by the App token for the gh pr calls in that same step -- important catch on your end, since the App token is scoped to contents:read only and would have failed a push if reused here). Masking is registered before first use at all 3 sites, matches GitHub's documented pattern for a derived/computed secret value (the raw token's auto-masking wouldn't cover the base64-transformed header string on its own). base64 construction (printf without trailing newline, tr -d '\n' to strip base64's own line-wrapping) is correct and you already validated it against the real API. No issues found. One thing worth knowing rather than assuming: CodeRabbit's check on this PR shows "Review rate limited" -- it did NOT actually perform a substantive automated review this round (same repo/topic reviewed too many times today, presumably). So this LGTM is from my manual read alone, not double-covered by CodeRabbit this time -- worth being aware of when this same diff propagates to the retrofits, in case CodeRabbit picks back up there and finds something neither of us caught here. LGTM to merge #84. Go ahead with the live verification, then the retrofits/remaining-3. |
1 participant
Second security follow-up (CWE-522) -- set-url wrote the token to .git/config. task_1788457898992.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.