Repository navigation
chore: update cppcheck.yml workflow configuration - #351
Conversation
1. Upgrade actions/checkout from v3 to v7 2. Add allow-unsafe-pr-checkout: true parameter for PR checkout 3. Keep existing cppcheck workflow structure unchanged Influence: 1. Verify cppcheck workflow triggers on pull requests 2. Confirm checkout action v7 works correctly with unsafe PR checkout chore: 更新 cppcheck.yml 工作流配置 1. 将 actions/checkout 从 v3 升级至 v7 2. 新增 allow-unsafe-pr-checkout: true 参数用于 PR checkout 3. 保持现有 cppcheck 工作流结构不变 Influence: 1. 验证 cppcheck 工作流在 PR 上正常触发 2. 确认 checkout action v7 在 unsafe PR checkout 模式下正常工作
|
Skipping CI for Draft Pull Request. |
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThe cppcheck GitHub Actions workflow now uses actions/checkout v7 and explicitly permits unsafe pull-request checkout while continuing to analyze the pull request head commit without persisting credentials. Sequence diagram for cppcheck pull request checkoutsequenceDiagram
participant GitHubActions
participant Checkout as actions/checkout@v7
participant Cppcheck as linuxdeepin/action-cppcheck@main
GitHubActions->>Checkout: checkout(ref, persist-credentials, allow-unsafe-pr-checkout)
Checkout-->>GitHubActions: pull request head commit
GitHubActions->>Cppcheck: run github_token analysis
Cppcheck-->>GitHubActions: cppcheck results
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/cppcheck.yml" line_range="21" />
<code_context>
with:
ref: ${{ github.event.pull_request.head.sha }}
persist-credentials: false
+ allow-unsafe-pr-checkout: true
- uses: linuxdeepin/action-cppcheck@main
with:
</code_context>
<issue_to_address>
**Untrusted PR code enters privileged job**
When an attacker-controlled PR head is checked out and its content reaches an unsafe execution or interpretation path in the scanner, a malicious PR can supply the checked-out workspace to `linuxdeepin/action-cppcheck@main`, which also receives `GITHUB_TOKEN`; if crafted input is executed or interpreted unsafely by the analysis step, the token is exposed or abused. The caller sees a compromised token-bearing workflow run.
Avoid checking out untrusted PR code in a `pull_request_target` job that receives a token; run analysis in an unprivileged `pull_request` workflow or isolate it and restrict token permissions.
</issue_to_address>| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| persist-credentials: false | ||
| allow-unsafe-pr-checkout: true |
There was a problem hiding this comment.
🔴 Critical · Untrusted PR code enters privileged job
When an attacker-controlled PR head is checked out and its content reaches an unsafe execution or interpretation path in the scanner, a malicious PR can supply the checked-out workspace to linuxdeepin/action-cppcheck@main, which also receives GITHUB_TOKEN; if crafted input is executed or interpreted unsafely by the analysis step, the token is exposed or abused. The caller sees a compromised token-bearing workflow run.
Avoid checking out untrusted PR code in a pull_request_target job that receives a token; run analysis in an unprivileged pull_request workflow or isolate it and restrict token permissions.
Prompt for AI agents
In `.github/workflows/cppcheck.yml` at line 21:
**Untrusted PR code enters privileged job**
When an attacker-controlled PR head is checked out and its content reaches an unsafe execution or interpretation path in the scanner, a malicious PR can supply the checked-out workspace to `linuxdeepin/action-cppcheck@main`, which also receives `GITHUB_TOKEN`; if crafted input is executed or interpreted unsafely by the analysis step, the token is exposed or abused. The caller sees a compromised token-bearing workflow run.
Avoid checking out untrusted PR code in a `pull_request_target` job that receives a token; run analysis in an unprivileged `pull_request` workflow or isolate it and restrict token permissions.
deepin pr auto review🤖 AI 代码审查报告总体评分： 📊 总体评价
🔍 详细分析1. 语法逻辑 ✅评价： 语法正确，逻辑清晰 ✅ 通过 潜在问题： 建议： [] 2. 代码质量 ✅评价： 代码结构清晰，注释完整 ✅ 通过 潜在问题： 建议： [] 3. 代码性能 ✅评价： 性能良好，资源使用合理 ✅ 通过 潜在问题： 建议： [] 4. 代码安全 🔓评价： 存在1个安全漏洞 ❌ 不通过
安全漏洞详情：
建议： ['将工作流触发器从 pull_request_target 改为 pull_request，使工作流以 PR 自身的有限权限运行， 而非基础仓库的密钥。若需要写权限发布审查评论，可使用单独的 pull_request_target 作业仅发布评论。', '若必须保留 pull_request_target，添加最小权限的 permissions 块： permissions: { contents: read, pull-requests: write }', '将 linuxdeepin/action-cppcheck@main 固定到特定 commit SHA，避免 @main 分支被篡改时引入恶意代码。', '移除第 16 行 - run: export（预存问题），该命令将所有环境变量输出到日志，可能泄露敏感信息。'] 💡 改进建议代码示例# 方案1（推荐）：将触发器改为 pull_request，移除 allow-unsafe-pr-checkout
name: cppcheck
on:
pull_request:
paths-ignore:
- ".github/workflows/**"
permissions:
contents: read
pull-requests: write
jobs:
cppchceck:
name: cppcheck
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
with:
persist-credentials: false
- uses: linuxdeepin/action-cppcheck@<full-commit-sha> # 固定到特定 SHA
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
repository: ${{ github.repository }}
pull_request_id: ${{ github.event.pull_request.number }}
allow_approve: false本报告由 AI 代码审查工具自动生成 |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: BLumia, Ivy233 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
备注： |
3 participants
Changes
actions/checkoutfrom v3 to v7allow-unsafe-pr-checkout: trueparameter for PR checkoutThis update ensures the cppcheck workflow uses the latest checkout action version and supports unsafe PR checkout as needed.
Multica Issue: DDE-476
Summary by Sourcery
Modernize the cppcheck workflow checkout configuration for pull-request validation.
Enhancements:
CI: