fix(ci): pin actions by SHA, least-privilege tokens, digest-pinned builder - #14
Merged
Merged
Conversation
|
Warning Review limit reachedNext included review available in 57 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying umi-react-admin with
|
| Latest commit: |
78581ef
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://0fe034be.umi-react-admin.pages.dev |
| Branch Preview URL: | https://fix-workflow-hardening.umi-react-admin.pages.dev |
…ilder - all four actions pinned to full commit SHAs (version kept as comment); peaceiris/actions-gh-pages holds a write-capable GITHUB_TOKEN and its upstream is dormant, so a moved tag there meant attacker-controlled code in a privileged context - a SHA makes tag moves inert - explicit permissions blocks: ci.yml contents:read, deploy.yml contents:write (the minimum for pushing gh-pages), instead of inheriting the repo-wide read+write default - dependabot for github-actions and npm keeps the pins upgradable via reviewable PRs instead of silent tag drift in the other direction - Dockerfile: builder stage pinned to a digest like the runtime stage (a pinned runtime image provides no guarantee when the layer that produces dist/ floats), and the token ARG no longer leaks into the builder image history via a pointless ENV line docker build verification deferred to CI (local daemon unavailable); YAML syntax validated locally
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
审计 2026-09-22 M-3 + M-4 + L-1：
peaceiris/actions-gh-pages持有写权限的 GITHUB_TOKEN 且上游维护长期停滞——tag 被移动即攻击者代码在特权上下文执行（可篡改 gh-pages 内容，对访客构成存储型攻击面）permissions:，GITHUB_TOKEN 依赖仓库宽松默认（read+write）node:22-alpine浮动标签（运行镜像钉了 digest，但产物 dist 由 builder 产出——信任链实际未闭合）；ARG→ENV把 token 持久化进 builder 层 history改动
ci.yml→contents: read；deploy.yml→contents: write（推 gh-pages 的最小集）.github/dependabot.yml（github-actions + npm，weekly）：SHA 钉固后的升级经 PR 显式过目，避免钉死即过期的另一个极端ENV CESIUM_ION_TOKEN（ARG 在 RUN 中本就可见，ENV 只留 history 痕迹）验证
gh api repos/<owner>/<repo>/commits/<tag>逐一核实docker build本地未验证（daemon 不可用），由 CI 兜底；pnpm check全绿