chore: update fullsend shim workflow - #960
Conversation
|
🤖 Finished Review · ✅ Success · Started 8:55 PM UTC · Completed 9:00 PM UTC |
ReviewFindingsHigh
Next steps:
Previous runReviewFindingsHigh
Medium
Low
Next steps:
Previous run (2)ReviewFindingsHigh
Medium
Low
Next steps:
Previous run (3)ReviewFindingsHigh
Low
Next steps:
Previous run (4)Review — PR #960Verdict: request-changes SummaryThis PR changes the fullsend shim workflow ( Findings🔴 HIGH — Supply chain: reusable workflow unpinned from SHA to mutable branch referenceFile: The - uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@ec21706cccc58d01588ecd842464a5afcc375ba1 # main
+ uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@mainWhy this matters: This workflow declares elevated permissions — GitHub's security hardening guide explicitly recommends pinning to full-length commit SHAs for supply chain integrity. Mitigating factors:
These mitigating factors reduce practical risk but do not eliminate it. A compromise of the Remediation: If the intent is to update to a newer version of uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@<current-sha> # main1 finding | 1 high Labels: PR modifies GitHub Actions workflow with security implications Previous run (5)Review — PR #960Verdict: request-changes SummaryThis PR replaces a SHA-pinned reusable workflow reference with a branch reference ( Findings🔴 [high] Supply chain: SHA pin removed from reusable workflow referenceFile: The change replaces a commit-SHA-pinned reference: uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@ec21706cccc58d01588ecd842464a5afcc375ba1 # mainwith an unpinned branch reference: uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@mainWhy this matters:
Mitigating factors acknowledged:
Remediation: Keep the SHA-pinned reference. If uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@<current-sha> # mainThis maintains the project's consistent SHA-pinning convention while still tracking the latest version. Dimensions Reviewed
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #960 +/- ##
=======================================
Coverage 76.92% 76.92%
=======================================
Files 26 26
Lines 2817 2817
=======================================
Hits 2167 2167
Misses 452 452
Partials 198 198
Flags with carried forward coverage won't be shown. Click here to find out more. Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
32a6fff to
bc5258e
Compare
|
🤖 Finished Review · ✅ Success · Started 8:53 AM UTC · Completed 8:57 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
github_actions
bc5258e to
7d543a9
Compare
PR Summary by QodoUpdate fullsend shim workflow to track upstream template
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
|
🤖 Review · ❌ Terminated · Started 12:47 PM UTC · Ended 12:59 PM UTC |
Code Review by Qodo
1. Unpinned workflow reference
|
![qodo-app-for-konflux-ci[bot]](https://avatars.githubusercontent.com/u/155583288?s=60&v=4){kind=small}
| github.event_name != 'issue_comment' | ||
| || github.event.comment.user.type != 'Bot' | ||
| uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@ec21706cccc58d01588ecd842464a5afcc375ba1 # main | ||
| uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@main |
There was a problem hiding this comment.
1. Unpinned workflow reference 🐞 Bug ⛨ Security
The fullsend shim now calls konflux-ci/.fullsend using the mutable ref @main, so upstream changes can alter what runs in this repo without a PR here. This reduces auditability/reproducibility and increases supply-chain blast radius (this workflow requests actions: write and id-token: write).
Agent Prompt
### Issue description
`.github/workflows/fullsend.yaml` references a reusable workflow via `@main`, which is mutable and can change behavior without review in this repo.
### Issue Context
This workflow runs with elevated permissions (including `id-token: write`), so keeping the called workflow immutable improves auditability and limits supply-chain risk.
### Fix Focus Areas
- .github/workflows/fullsend.yaml[44-44]
### Suggested fix
- Replace `@main` with an immutable ref (commit SHA, or a protected/immutable tag if your org uses those).
- If you need to stay aligned with the template, update the pinned SHA as part of a reviewed/automated bump process (e.g., periodic PRs).
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 12:47 PM UTC · Completed 12:59 PM UTC |
7d543a9 to
ad2cddf
Compare
|
🤖 Finished Review · ✅ Success · Started 9:28 PM UTC · Completed 9:39 PM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Update the shim workflow to match the current template in the .fullsend config repo.
ad2cddf to
c534e31
Compare
|
🤖 Finished Review · ✅ Success · Started 7:49 PM UTC · Completed 8:03 PM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
Code review by qodo was updated up to the latest commit b3cfa76 |
|
🤖 Finished Review · ✅ Success · Started 6:40 AM UTC · Completed 6:51 AM UTC Commit: |
| github.event_name != 'issue_comment' | ||
| || github.event.comment.user.type != 'Bot' | ||
| uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@ec21706cccc58d01588ecd842464a5afcc375ba1 # main | ||
| uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@main |
There was a problem hiding this comment.
[high] security/supply-chain
Replacing the SHA-pinned reusable workflow reference (@ec21706cccc58d01588ecd842464a5afcc375ba1) with a floating branch reference (@main) removes supply-chain integrity for this external workflow call. The dispatch.yml workflow from konflux-ci/.fullsend will now resolve to whatever commit happens to be at main at invocation time. Because this workflow runs on pull_request_target with id-token: write and actions: write permissions, any future push to main in the .fullsend repo instantly changes what privileged code executes in this repository without any review gate in this repo. Every other uses: directive across all workflows in this repository is SHA-pinned, making this an inconsistency with the established security convention.
Suggested fix: Keep the SHA-pinned reference. If the intent is to update to a newer commit of dispatch.yml, pin to the new SHA with the branch name as a trailing comment (e.g., uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@ # main), consistent with every other workflow reference in this repository.
2 participants
This PR updates the fullsend shim workflow to match the current template in the
.fullsendconfig repo.The shim content has drifted from the template — this brings it back in sync.