mirror of
https://github.com/Jeuners/ECC.git
synced 2026-09-09 15:02:30 +02:00
7f971b7e6f
`WRITE_PERMISSION_PATTERN` in `validate-workflow-security.js`
enumerates named GitHub Actions scopes (`contents: write`,
`issues: write`, etc.) to decide whether a workflow needs to:
- disable `persist-credentials` on `actions/checkout`
- pass `--ignore-scripts` to `npm ci`
The pattern misses the top-level shorthand `permissions:
write-all`, which is the strictly broader form — it grants every
named scope write access in a single line. As a result, a
workflow that opts into write-all currently slips both gates.
Reproduced on `main` before this commit:
$ cat /tmp/bad.yml
name: bad
on: [push]
permissions: write-all
jobs:
do:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: npm ci
$ ECC_WORKFLOWS_DIR=/tmp node scripts/ci/validate-workflow-security.js
Validated workflow security for 1 workflow files
$ echo $?
0
Expected: at least two violations (missing `persist-credentials:
false`, missing `--ignore-scripts`).
Actual: passes silently.
Fix: add a sibling pattern `WRITE_ALL_PATTERN` that matches
`^\s*permissions:\s*write-all\b` and OR it with
`WRITE_PERMISSION_PATTERN` at the single gate. Both top-level
and job-level `permissions:` blocks satisfy the `^\s*` prefix.
After this commit the reproduction above exits 1 with:
ERROR: bad.yml:8 - workflows with write permissions must disable checkout credential persistence
ERROR: bad.yml:9 - workflows with write permissions must install npm dependencies with --ignore-scripts
Three new regression tests in `tests/ci/validate-workflow-security.test.js`:
- rejects write-all + credential-persisting checkout
- rejects write-all + `npm ci` without `--ignore-scripts`
- allows write-all when both gates are satisfied (no over-block)
Test count: 14 → 17 in this file; full `yarn test` still green.
A separate `refs/pull/N/merge` bypass under `pull_request_target`
exists in the same validator and is fixed in the next commit.
|
||
|---|---|---|
| .. | ||
| ci | ||
| codemaps | ||
| codex | ||
| codex-git-hooks | ||
| hooks | ||
| lib | ||
| auto-update.js | ||
| build-opencode.js | ||
| catalog.js | ||
| claw.js | ||
| consult.js | ||
| discussion-audit.js | ||
| doctor.js | ||
| ecc.js | ||
| gan-harness.sh | ||
| gemini-adapt-agents.js | ||
| harness-adapter-compliance.js | ||
| harness-audit.js | ||
| install-apply.js | ||
| install-plan.js | ||
| list-installed.js | ||
| loop-status.js | ||
| observability-readiness.js | ||
| operator-readiness-dashboard.js | ||
| orchestrate-codex-worker.sh | ||
| orchestrate-worktrees.js | ||
| orchestration-status.js | ||
| platform-audit.js | ||
| preview-pack-smoke.js | ||
| release.sh | ||
| repair.js | ||
| session-inspect.js | ||
| sessions-cli.js | ||
| setup-package-manager.js | ||
| skill-create-output.js | ||
| skills-health.js | ||
| status.js | ||
| sync-ecc-to-codex.sh | ||
| uninstall.js | ||
| work-items.js | ||