Fix security issues in GitHub Actions workflows - #551
Open
Navaneeth Shanmugasundaram (navaneethshan) wants to merge 3 commits into
Open
Fix security issues in GitHub Actions workflows#551Navaneeth Shanmugasundaram (navaneethshan) wants to merge 3 commits into
Navaneeth Shanmugasundaram (navaneethshan) wants to merge 3 commits into
Conversation
- Fix workflow_run trigger vulnerability in automerge.yml by validating that the workflow was triggered by a successful run from the default branch - Fix code injection vulnerability in issue-release-workflow.yml by moving user-controlled input to environment variable - Add explicit repository scoping to GitHub App tokens in automerge.yml and sync_from_upstream.yml to limit permissions These changes address security issues flagged by zizmor scanner.
Navaneeth Shanmugasundaram (navaneethshan)
force-pushed
the
security-fixes
branch
from
July 27, 2026 21:58
ca35ed7 to
c2116c4
Compare
Combine sync and automerge workflows to eliminate the insecure workflow_run trigger. The automerge job now runs as part of the sync_from_upstream.yml workflow using job dependencies (needs). Changes: - sync_from_upstream.yml: Add Run-Automerge job that runs after Fetch-Upstream - automerge.yml: Remove workflow_run trigger, keep only workflow_dispatch for manual runs This eliminates the zizmor security warning while maintaining the same functionality. The workflows now run sequentially in a single workflow execution.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Prevent credential persistence in git config by setting persist-credentials to false on all checkout actions that use custom tokens. This addresses the security warning from GitHub Advanced Security / zizmor about credential persistence through GitHub Actions artifacts. This ensures tokens are not stored in the repository's .git/config and cannot be accidentally exposed through artifacts or logs.
Contributor
Author
|
Closing this PR, as the same change was merged upstream: llvm/llvm-project#212634 |
Contributor
Author
|
Reopening it, as I closed it by mistake. This fix is needed on downstream. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
These changes address security issues flagged by zizmor scanner.