chore: fixed the dangerous workflow #439
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Warn: script injection with untrusted input ' github.event.pull_request.title ': .github/workflows/commitlint.yml:28 https://securityscorecards.dev/viewer/?uri=github.com/defenseunicorns/pepr https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections Signed-off-by: naveensrinivasan <[email protected]>
naveensrinivasan
requested review from
UncleGedd,
jeff-mccoy,
decleaver and
mjnagel
as code owners
naveensrinivasan
changed the title
|
Thanks for this @naveensrinivasan ! I think a few of repos also have this vulnerability. I'm going to update the title (just need to remove that first colon) and rerun the e2e tests |
UncleGedd
changed the title
|
And our permissions seem to be jacked No issue with this PR though, I'll address the permissions issue internally |
|
FYSA @Racer159 has an open PR to add commitlint check as a reusable workflow at which point you can just call it from uds-common defenseunicorns/uds-common#44 |
Thanks @zachariahmiller , we'll go with the common workflow |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Fixed the dangerous workflow
Warn: script injection with untrusted input ' github.event.pull_request.title ': .github/workflows/commitlint.yml:28
https://securityscorecards.dev/viewer/?uri=github.com/defenseunicorns/pepr https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
Related Issue
Fixes #
Relates to #
Type of change
Checklist before merging