Skip to content

fix(security): scope CI secrets and pin third-party actions - #5171

Open
causten wants to merge 1 commit into
developfrom
mythos/pr-ci-workflow-secrets
Open

fix(security): scope CI secrets and pin third-party actions#5171
causten wants to merge 1 commit into
developfrom
mythos/pr-ci-workflow-secrets

Conversation

@causten

@causten causten commented Aug 21, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Move DockerHub credentials from workflow-level env to push jobs only
  • Replace cleartext Codecov token with CODECOV_TOKEN secret
  • Pin jlumbroso/free-disk-space to commit SHA

JIRA

  • ROCM-26618, ROCM-26607, ROCM-26609

Test plan

  • Verify CI on internal PR

Made with Cursor

Addresses ROCM-26618, ROCM-26607, ROCM-26609.

Keeps existing self-hosted job behavior for tidy/cppcheck/sles (ROCM-26603
already handled elsewhere).

Co-authored-by: Cursor <cursoragent@cursor.com>
Copilot AI lite review requested due to automatic review settings August 21, 2026 23:11

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the repository’s GitHub Actions CI workflow by reducing the scope of sensitive credentials and improving supply-chain safety for third-party actions.

Changes:

  • Scoped DockerHub credentials to only the image publish jobs and prevented those jobs from running on fork PRs.
  • Replaced a hardcoded Codecov token with the CODECOV_TOKEN secret.
  • Pinned jlumbroso/free-disk-space to a specific commit SHA.
Suppressed comments (1)

.github/workflows/ci.yaml:110

  • Same issue as build_image: with this job skipped on fork PRs when the SLES image tag does not exist, downstream jobs that assume the image exists can still run (because they treat skipped as acceptable) and then fail when they try to use the missing image. Consider gating downstream SLES-image consumers on imageexists_sles == 'true' for fork PRs, or make this job fail fast (without touching secrets) when it cannot build/push.
    if: >-
      ${{ needs.check_image.outputs.imageexists_sles != 'true'
      && (github.event_name != 'pull_request'
          || github.event.pull_request.head.repo.full_name == github.repository) }}
    env:
      DOCKER_USER: ${{ secrets.DOCKERHUB_USERID }}
      DOCKER_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
    steps:

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread .github/workflows/ci.yaml
Comment on lines +3 to +4
permissions:
contents: read
Comment thread .github/workflows/ci.yaml
Comment on lines +75 to +81
if: >-
${{ needs.check_image.outputs.imageexists != 'true'
&& (github.event_name != 'pull_request'
|| github.event.pull_request.head.repo.full_name == github.repository) }}
env:
DOCKER_USER: ${{ secrets.DOCKERHUB_USERID }}
DOCKER_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
Comment thread .github/workflows/ci.yaml
Comment on lines 504 to +507
- name: Upload code coverage
if: "matrix.configuration == 'codecov'"
env:
CODECOV_TOKEN: "f5d5a10b-3177-4c76-b25f-9b1c2f165e8b"
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants