Skip to content

Add direct-push alerting and sensitive-change gate #214

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jeremy merged 1 commit into from
Mar 8, 2026
Merged

Add direct-push alerting and sensitive-change gate #214

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .github/workflows/direct-push-alert.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
name: Direct Push Alert

on:
push:
branches: [main]

permissions:
contents: read
issues: write

jobs:
alert:
uses: basecamp/.github/.github/workflows/direct-push-alert.yml@a667bfaac8b33b9c8a6c61019664463a98055995
permissions:
contents: read
issues: write
Comment on lines +14 to +16
Copy link

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The permissions key inside a job that uses a reusable workflow (uses:) is not valid GitHub Actions syntax and is silently ignored at runtime. The actual permissions enforced come from the top-level permissions block (lines 7–9). The job-level block here has no effect.

Note that the same pattern is already present in .github/workflows/ai-labeler.yml — so this appears to be an established (if ineffective) convention in the repository.

Suggested change
permissions:
contents: read
issues: write

Copilot uses AI. Check for mistakes.
21 changes: 21 additions & 0 deletions .github/workflows/sensitive-change-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
name: Sensitive Change Gate

on:
pull_request_target:
types: [opened, synchronize, reopened]
Comment on lines +4 to +5
Copy link

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pull_request_target runs with write permissions in the context of the base branch, which means the called reusable workflow has elevated access even for PRs from forks. Combined with pull-requests: write, if the reusable workflow at basecamp/.github ever checks out or executes code from the PR head branch (e.g. via actions/checkout with ref: ${{ github.event.pull_request.head.sha }}), this creates a significant security risk (arbitrary code execution with write access to the repository).

Before using pull_request_target, verify that the pinned reusable workflow does not check out PR code or execute user-controlled scripts. If it only reads PR metadata via the GitHub API, the risk is lower, but it is still worth confirming explicitly. Adding a comment here explaining why pull_request_target is safe in this context would help future maintainers.

Copilot uses AI. Check for mistakes.

permissions:
contents: read
pull-requests: write

jobs:
gate:
uses: basecamp/.github/.github/workflows/sensitive-change-gate.yml@a667bfaac8b33b9c8a6c61019664463a98055995
with:
extra-patterns: |
scripts/publish-aur.sh
scripts/sync-skills.sh
scripts/manage-release-env.sh
permissions:
contents: read
pull-requests: write
Comment on lines +19 to +21
Copy link

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The permissions key inside a job that uses a reusable workflow (uses:) is not valid GitHub Actions syntax and is silently ignored at runtime. GitHub Actions only honours permissions at the workflow level or within a regular steps-based job. The job-level permissions block here has no effect; the actual permissions that apply to this workflow run come from the top-level permissions block (lines 7–9).

If the intent is to document which permissions are required, a comment would be clearer. If the intent is to actually restrict permissions on the called workflow, those restrictions must be declared in the reusable workflow itself.

Note that the same pattern is already present in .github/workflows/ai-labeler.yml — so this appears to be an established (if ineffective) convention in the repository.

Suggested change
permissions:
contents: read
pull-requests: write
# Requires permissions:
# contents: read
# pull-requests: write

Copilot uses AI. Check for mistakes.
Loading