igraphdata/.github/workflows/commit-suggest.yaml at main · igraph/igraphdata · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
# Posts the formatting patch produced by the `rcc` workflow
# as a comment on the pull request it came from.
#
# SECURITY -- `workflow_run` is a privileged trigger.
# It runs from the default branch of the BASE repository
# with a token that can write to it,
# and it fires for `rcc` runs of pull requests from forks.
# Everything reachable from `github.event.workflow_run` is therefore
# attacker-controlled data, not trusted input:
#
#   * `head_branch` is a fork branch name, and `git check-ref-format`
#     permits `"`, `` ` ``, `;` and `$(...)` in branch names.
#   * `head_commit.message`, repository descriptions and similar fields
#     are free text and may contain quotes.
#   * The `changes-patch` artifact was produced by a run
#     that executed the fork's code, so its contents are arbitrary.
#
# Consequently no field of the event is ever interpolated with `${{ }}`
# into a shell script; values are passed through the environment
# so the shell treats them as inert data.
# The pull request head is deliberately NOT checked out:
# this job only needs the artifact, and not checking out
# avoids placing a credentialed `.git/config`
# next to attacker-controlled files.
# That is why the steps below name their actions in full
# rather than as `./.github/workflows/...`:
# an action is fetched into the runner's action cache and not into the
# workspace, so it is the one way to share a script with a job that has
# no checkout. `@main` is the ref this workflow already runs from,
# `workflow_run` using the default branch of the base repository.
#
# https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
name: commit-suggest.yaml

on:
  workflow_run:
    workflows: ["rcc"]
    types:
      - completed

# Deny everything by default; the job opts back into the minimum it needs.
# This matters more here than in most workflows: `workflow_run` runs from the
# default branch with a token that can write to this repository, on runs that
# belong to a pull request from a fork.
permissions: {}

jobs:
  commit-suggest:
    runs-on: ubuntu-26.04
    if: github.event.workflow_run.event == 'pull_request'

    permissions:
      # Required by actions/download-artifact to read another run's artifacts.
      # The workflow did not previously request this, so the download could
      # only ever have failed -- silently, under `continue-on-error: true`.
      actions: read
      # `contents: read` is deliberately absent: the pull request checkout is
      # gone, and nothing else in this job reads the repository.
      # Required to post the suggestion comment
      pull-requests: write

    steps:
      - name: Download artifact
        uses: actions/download-artifact@v7
        with:
          name: changes-patch
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}
        continue-on-error: true

      - name: Check if artifact exists
        id: check-artifact
        run: |
          if [ -f changes.patch ]; then
            echo "has_diff=true" >> $GITHUB_OUTPUT
          else
            echo "has_diff=false" >> $GITHUB_OUTPUT
            echo "No changes-patch artifact found"
          fi
        shell: bash

      - name: Find PR number for branch from correct head repository
        id: find-pr
        if: steps.check-artifact.outputs.has_diff == 'true'
        uses: cynkra/cynkratemplate/.github/actions/commit-suggest-find-pr@main
        with:
          gh-token: ${{ github.token }}
          head-branch: ${{ github.event.workflow_run.head_branch }}
          head-owner: ${{ github.event.workflow_run.head_repository.owner.login }}
      - name: Generate comment body
        if: steps.check-artifact.outputs.has_diff == 'true' && steps.find-pr.outputs.pr_number != ''
        uses: cynkra/cynkratemplate/.github/actions/commit-suggest-body@main
        with:
          run-id: ${{ github.event.workflow_run.id }}
          repo: ${{ github.repository }}
          pr-number: ${{ steps.find-pr.outputs.pr_number }}
      - name: Post or update comment
        if: steps.check-artifact.outputs.has_diff == 'true' && steps.find-pr.outputs.pr_number != ''
        uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
        with:
          pr-number: ${{ steps.find-pr.outputs.pr_number }}
          file-path: comment.md
          comment-tag: formatting-suggestions
          mode: recreate