Fix label-check and auto-assign on fork PRs#40
Conversation
Fork-submitted PRs get a read-only token on pull_request runs, so the label and assignee bots fail with 403. pull_request_target runs in the base repo context with a write token; safe here because neither job checks out or executes PR code. Build jobs stay on pull_request. Trim ci.yml permissions to what the builds need.
WalkthroughGitHub Actions workflows are refactored to improve security: a new dedicated ChangesWorkflow Security Refactoring
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai help |
ChatThere are 3 ways to chat with CodeRabbit:
CodeRabbit commands
Other keywords and placeholders
CodeRabbit configuration file (
|
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
@coderabbitai full review |
✅ Action performedFull review finished. |
|
@coderabbitai full review |
✅ Action performedFull review finished. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/label-check.yml:
- Around line 18-20: The workflow uses external reusable actions via the `uses:`
keys (e.g., the `label-check` job referencing
`ApolloAutomation/Workflows/.github/workflows/label-check.yml@main` and the
other workflow referencing `pozil/auto-assign-issue@v2`); replace those
branch/tag refs with immutable full commit SHAs (obtain the commit SHA for the
target repo/branch and update the `uses:` values to
`owner/repo/path@<full-sha>`), and audit transitive reusable workflows/actions
referenced by those workflows to ensure any nested `uses:` are also pinned to
full SHAs rather than branches or tags.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9959a411-cdfe-4d53-8884-0006c36e2f8f
📒 Files selected for processing (3)
.github/workflows/autoassign.yml.github/workflows/ci.yml.github/workflows/label-check.yml
💤 Files with no reviewable changes (1)
- .github/workflows/ci.yml
| label-check: | ||
| name: Label Check | ||
| uses: ApolloAutomation/Workflows/.github/workflows/label-check.yml@main |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# List workflow files
echo "== Workflows =="
ls -la .github/workflows || true
echo
# Show label-check.yml around stated lines
echo "== label-check.yml (head) =="
sed -n '1,120p' .github/workflows/label-check.yml || true
echo
echo "== label-check.yml (lines 1-60 with numbers) =="
nl -ba .github/workflows/label-check.yml | sed -n '1,80p' || true
echo
# Find and show autoassign.yml (if exists)
if [ -f .github/workflows/autoassign.yml ]; then
echo "== autoassign.yml (head) =="
sed -n '1,160p' .github/workflows/autoassign.yml
echo
echo "== autoassign.yml (lines 1-120 with numbers) =="
nl -ba .github/workflows/autoassign.yml | sed -n '1,140p'
else
echo "== autoassign.yml not found =="
rg -n --hidden "autoassign" .github/workflows || true
fi
# Check for pull_request_target workflows and permissions/write tokens
echo
echo "== pull_request_target workflows =="
rg -n --hidden "pull_request_target:" .github/workflows || true
echo
echo "== permissions blocks under pull_request_target =="
# Print files and nearby lines for permissions
rg -n --hidden -U "pull_request_target:([^\n]*\n){0,30}[[:space:]]*permissions:" .github/workflows || true
echo
# Check external uses refs in those files
echo "== External uses in label-check.yml =="
rg -n --hidden "uses:" .github/workflows/label-check.yml || true
echo
echo "== External uses in autoassign.yml =="
if [ -f .github/workflows/autoassign.yml ]; then
rg -n --hidden "uses:" .github/workflows/autoassign.yml || true
fi
echo
# Also search any other workflow using pull_request_target with external uses
echo "== Other pull_request_target jobs with uses: (all workflows) =="
rg -n --hidden -U "pull_request_target:[\s\S]*?uses:\s" .github/workflows || trueRepository: ApolloAutomation/PUMP-1
Length of output: 1999
🌐 Web query:
ApolloAutomation/Workflows#24 hardening pin commit SHA label-check reusable workflow
💡 Result:
There is no public GitHub issue #24 in the ApolloAutomation/Workflows repository, as this repository does not appear to exist [1][2]. Apollo Automation is a home automation hardware company [3], and its GitHub organization (ApolloAutomation) focuses on device firmware and integration tools [1][3]. The query appears to conflate a common supply-chain security best practice—hardening reusable workflows by pinning actions and internal references to commit SHAs—with the "Apollo" name. Pinning to full-length commit SHAs is a critical security measure to prevent supply-chain attacks, as it ensures that workflow code is immutable and cannot be altered by force-pushing tags or branches [4][5][6]. If you are implementing this hardening pattern in your own workflows, current industry best practices involve [4][5][6][7]: 1. Pinning all actions and reusable workflows to full 40-character commit SHAs (e.g., uses: actions/checkout@de0fac2e...). 2. Performing audit checks on the call graph to ensure that transitive reusable workflows are also pinned to SHAs [4]. 3. Avoiding mutable references like branches (main, master) or tags (v1, v2) in production CI/CD pipelines [8][5][6]. For context, Apollo Automation's GitHub organization does exist [1], but its repository structure is dedicated to hardware projects like AIR-1, MSR-1, and MSR-2 [1], rather than generic workflow automation libraries [1][3]. Additionally, there is a separate entity/project named "Apollo-Workflows" that focuses on academic or scientific workflow choreography [9][10], but it is unrelated to Apollo Automation's hardware business [3].
Citations:
- 1: https://github.com/orgs/ApolloAutomation/repositories
- 2: https://github.com/ApolloAutomation/docs
- 3: https://wiki.apolloautomation.com/
- 4: https://www.systemshardening.com/articles/cicd/github-actions-reusable-workflow-pinning-audit/
- 5: https://www.systemshardening.com/articles/cicd/github-actions-supply-chain-hardening/
- 6: https://www.wiz.io/blog/github-actions-security-guide
- 7: github-community-projects/ospo-reusable-workflows@23927bf
- 8: praetorian-inc/public-workflows@9ea060d
- 9: https://github.com/Apollo-Workflows/Overview
- 10: https://github.com/Apollo-Workflows/Sentiment-Analysis
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== pull_request_target workflows using external uses: (all workflows) =="
rg -n --hidden -U "pull_request_target:|uses:" .github/workflows/*.yml || true
echo
echo "== label-check.yml external uses ref =="
rg -n --hidden "uses:" .github/workflows/label-check.yml || true
echo
echo "== autoassign.yml external uses ref =="
rg -n --hidden "uses:" .github/workflows/autoassign.yml || trueRepository: ApolloAutomation/PUMP-1
Length of output: 1020
Pin external uses: refs in pull_request_target workflows to immutable commit SHAs
.github/workflows/label-check.yml uses the external reusable workflow ApolloAutomation/Workflows/.github/workflows/label-check.yml@main, and .github/workflows/autoassign.yml uses pozil/auto-assign-issue@v2, both under pull_request_target with write permissions—pin these uses: references to full commit SHAs (and ensure transitive reusable workflows/actions are pinned too).
🧰 Tools
🪛 zizmor (1.25.2)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/label-check.yml around lines 18 - 20, The workflow uses
external reusable actions via the `uses:` keys (e.g., the `label-check` job
referencing `ApolloAutomation/Workflows/.github/workflows/label-check.yml@main`
and the other workflow referencing `pozil/auto-assign-issue@v2`); replace those
branch/tag refs with immutable full commit SHAs (obtain the commit SHA for the
target repo/branch and update the `uses:` values to
`owner/repo/path@<full-sha>`), and audit transitive reusable workflows/actions
referenced by those workflows to ensure any nested `uses:` are also pinned to
full SHAs rather than branches or tags.
Source: Linters/SAST tools
2 participants
Version: N/A (workflows only, does not publish)
What does this implement/fix?
Fixes the Label Check and Auto Assign failures on fork-submitted PRs (seen on the CO2 auto calibration PR).
Workflows triggered by
pull_requestfrom a fork run with a read-only token, soactions-ecosystem/action-add-labelsandpozil/auto-assign-issuefail with403 Resource not accessible by integration. Moving those two jobs topull_request_targetruns them in the base repo's context with a write token.ci.ymlinto its ownlabel-check.ymlonpull_request_target(witheditedin the trigger types, so fixing a checkbox re-runs the check). The firmware build jobs stay onpull_request, since they compile PR-controlled YAML and must never get a write token.autoassign.ymlswitches its PR trigger topull_request_target(issues trigger unchanged).ci.ymlpermissions are trimmed to what the build jobs need.This is safe because neither moved job checks out or executes PR code. Depends on ApolloAutomation/Workflows#24, which hardens the reusable label-check against script injection from the PR body; that PR should merge first.
Same fix is rolling out to every device repo with these workflows: AIR-1, MSR-2, MTR-1, R_PRO-1, PLT-1, TEMP-1, BTN-1, H-1, H-2, MSR-1, and PUMP-1.
Types of changes
Checklist / Checklijst:
If user-visible functionality or configuration variables are added/modified:
🤖 Generated with Claude Code
Summary by CodeRabbit