Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: potential CI injections #15720

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

fix: potential CI injections #15720

wants to merge 2 commits into from

Conversation

erikburt
Copy link
Collaborator

Changes

  • Updated all references of actions/checkout to use persist-credentials: false
  • Fixed basic possible template injection patterns with high severity

Motivation

https://smartcontract-it.atlassian.net/browse/RE-3341

@erikburt erikburt self-assigned this Dec 16, 2024
@erikburt erikburt requested review from a team as code owners December 16, 2024 21:41
jmank88
jmank88 reviewed Dec 16, 2024
View reviewed changes
.github/workflows/build-publish-goreleaser.yml
Comment on lines +18 to +19
with:
persist-credentials: false
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a way to do this by default so that we don't have to spam it around everywhere? (and remember to add it in the future for new workflows?)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jmank88 jmank88 jmank88 left review comments

At least 2 approving reviews are required to merge this pull request.

Assignees

@erikburt erikburt

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@erikburt @jmank88