From be53143f52885227628b65188ba84b93949ef2d5 Mon Sep 17 00:00:00 2001 From: evilgensec Date: Thu, 18 Jun 2026 02:28:57 +0545 Subject: [PATCH] ci: do not run fork PR code on the self-hosted runner The lint and test jobs run on a self-hosted runner and check out and execute the pull request head (pip install -r requirements.txt, pytest, pylint over src/gcp_scanner/*.py). On a pull_request event this also runs for PRs from forks, so any external contributor can execute arbitrary code on the runner. The runner is a persistent GCE instance with an attached service account: the acceptance test (src/gcp_scanner/test_acceptance.py) scans the live project test-gcp-scanner-2 using credsdb.get_creds_from_metadata(), which reads an OAuth token from the instance metadata server. Fork PR code on that runner can read the same metadata token and steal the service-account credential, even though no secrets are passed to the job. Guard both self-hosted jobs so they run only on pushes and on pull requests originating from this repository, not from forks. --- .github/workflows/python-app.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index 304e6e9f..c6d0d5b4 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -14,6 +14,10 @@ permissions: jobs: lint: + # Do not run untrusted fork PR code on the self-hosted runner, which has an + # ambient GCP service-account identity available via the instance metadata + # server. Only run on pushes (to main) and PRs originating from this repo. + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository runs-on: self-hosted @@ -48,6 +52,9 @@ jobs: #flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics test: + # See the note on the lint job above: keep untrusted fork PR code off the + # self-hosted runner that holds an ambient GCP service-account identity. + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository runs-on: self-hosted