fix(ci): select the hosted runner explicitly in ci-workflows callers - #28
Merged
Merged
Conversation
This repository is public, so `pull_request` executes untrusted fork code. 2 caller(s) relied on the reusable workflow's own `runner` default instead of naming a runner. That default is a property of the pinned commit, not of this repository. At the current pin (ac4d1f4, 0.5.1) actionlint.yml and secret-scan.yml still default to `ubuntu-latest`, so this change is a no-op today. On current ci-workflows main, 39 of 46 reusables default `runner` to the estate's self-hosted `amsterdam` label — including both of those. A routine pin bump would therefore move these public `pull_request` jobs, fork PRs included, onto trusted private infrastructure, with no diff here to review. Naming the runner makes the caller, not the pin, decide where fork code runs. Signed-off-by: rldyourmnd <danil@nddev.it.com>
Make the constraint enforced by the preceding change durable so it is not mistaken for redundant boilerplate and removed. Both projections state the rule and the pin-bump review step: diff `inputs.runner.default` across the two commits before merging. Signed-off-by: rldyourmnd <danil@nddev.it.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This repository is public, so
pull_requestexecutes untrusted fork code. Itscallers of
ci-workflowsreusables relied on the reusable's ownrunnerdefault instead of naming a runner.
That default is a property of the pinned commit, not of this repository. At
the pin in use it is still
ubuntu-latest, so this change is a no-op today. Oncurrent
ci-workflowsmain, 39 of 46 reusables defaultrunnerto the estate'sself-hosted
amsterdamlabel — including the ones called here. A routineDependabot pin bump would therefore have moved these public
pull_requestjobs,fork PRs included, onto trusted private infrastructure, with no diff in this
repository to review.
Naming the runner makes the caller, not the pin, decide where fork code runs.
The rule is recorded in both instruction projections so it is not later mistaken
for redundant boilerplate and removed.
ci-workflowsenforces this for its own self-calls viacheck_workflow_contracts.py, and now for its published examples too, butnothing extends it to external consumers — hence the per-repository rule.
Verification
actionlintexit 0. The reusables acceptrunnerat the pinned SHA and alreadydefault it to
ubuntu-latestthere, so behaviour is unchanged until the pinmoves.