tiennm99/ccs
1
0
Fork 0
mirror of https://github.com/tiennm99/ccs.git synced 2026-07-30 20:22:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): harden self-hosted workflow trust boundaries

Browse Source 
Keep active CCS workflows on self-hosted runners, gate self-hosted PR execution to trusted authors, and scope privileged release credentials to the exact git operations that need them.
This commit is contained in:
Kai (Tam Nhu) Tran
2026-05-12 12:34:15 -04:00
committed by GitHub
parent d86032ed0a
commit 2273757c83
17 changed files with 210 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/scripts/github/dev-release-workflow.test.ts
+8 -1
View File
@@ -26,8 +26,15 @@ describe('dev release workflow', () => {
expect(workflow).toContain('branches: [dev]');
expect(workflow.match(/runs-on: \[self-hosted, linux, x64\]/g)).toHaveLength(2);
expect(workflow).not.toContain('runs-on: ubuntu-latest');
expect(checkoutSection).toContain("token: ${{ secrets.PAT_TOKEN }}");
expect(checkoutSection).toContain('persist-credentials: false');
expect(checkoutSection).not.toContain('token: ${{ secrets.PAT_TOKEN }}');
expect(checkoutSection).not.toContain('token: ${{ github.token }}');
expect(releaseSection).toContain('echo "::add-mask::${auth_header}"');
expect(releaseSection).toContain('GIT_CONFIG_COUNT=2');
expect(releaseSection).toContain('GIT_CONFIG_KEY_0=http.https://github.com/kaitranntt/ccs.extraheader');
expect(releaseSection).toContain('GIT_CONFIG_VALUE_0="AUTHORIZATION: basic ${auth_header}"');
expect(releaseSection).toContain('GIT_CONFIG_KEY_1=http.https://github.com/kaitranntt/ccs.git.extraheader');
expect(releaseSection).toContain('GIT_CONFIG_VALUE_1="AUTHORIZATION: basic ${auth_header}"');
expect(releaseSection).toContain('GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }}');
expect(releaseSection).toContain('GH_TOKEN: ${{ secrets.PAT_TOKEN }}');
expect(releaseSection).not.toContain('GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}');