Repository navigation
SonarCloud security issues in release workflows #413
Description
SonarCloud reports multiple security issues in the release workflows related to package installation and execution.
Files:
.github/workflows/if-nodejs-release.yml
.github/workflows/release-announcements.yml
Proposed Changes:
- Add --ignore-scripts to the npm install command.
- Replace the npx command with a safer package execution method.
- Define the exact package version in
.github/workflows/release-announcements.ymlto avoid installing unverified releases.
References these issues
Tagging @AceTheCreator for review
Activity
github-actions commentedon Aug 19, 2026
Welcome to AsyncAPI. Thanks a lot for reporting your first issue. Please check out our contributors guide and the instructions about a basic recommended setup useful for opening a pull request.
Keep in mind there are also other channels you can use to interact with AsyncAPI community. For more details check out this issue.
princerajpoot20 commentedon Oct 13, 2026
@catosaurusrex2003 I want to understand why this has been classified as
Advanced. I would say it’s not even a medium-level issue.catosaurusrex2003 commentedon Oct 13, 2026
I had already edited my submission from Advanced to Medium within a couple of minutes of posting it.
Since I'm not very familiar with the
.githubrepository or the potential consequences of modifying the shared release workflows, I think Medium is a reasonable classification for now.If @Shurtu-gal, as the maintainer of the
.githubrepo, feels the issue is easier than Medium, I'm happy to update the classification again.princerajpoot20 commentedon Oct 13, 2026
Ahh, okay. Maybe I was on the same screen when you posted it. Before you could edit it, I saw 'Advanced'. No worries. :)
There is no classification below the Medium category.
catosaurusrex2003 commentedon Oct 13, 2026
Yeah, textbook scenario of race condition 😁.
aeworxet commentedon Oct 14, 2026
@Shurtu-gal, please independently assess whether this GitHub Issue meets the criteria for even the
MediumComplexity Level.Shurtu-gal commentedon Oct 14, 2026
I am not very sure if #413 should be a bounty tbh. It's just 4 lines of code that need to be changed, and I think it's more of a good-first-issue. The only slightly tricky part might be testing the changes, since we need to replicate the release workflows in a sandbox environment.
I might have to help with the sandbox testing, as I already have some setup for it, although it would need a few tweaks.
Also, there is already a PR #414 open for this, but it seems to have stalled as the contributor hasn't responded in a while. Maybe we should follow up on that first.
For a bounty, I would actually prefer #137. But before submitting it, we need to check if the implementation is feasible, especially around
GH_TOKEN. I don't want to expose the token through workflows triggered by public comments, but from what I understand, we might need to do something along those lines for the proposed approach to work.Also, the previous implementation by @Souvikns didn't work as expected, so I think we should revisit that and figure out if there's a secure way to implement it before considering it for a bounty.
Shurtu-gal commentedon Oct 14, 2026
We can discuss this with all stakeholders I believe.
cc: @aeworxet @catosaurusrex2003 @princerajpoot20 @AceTheCreator
princerajpoot20 commentedon Oct 14, 2026
Agree with the points @Shurtu-gal mentioned above in #413 (comment).
Agree with this.
It's just a small change.If any help is needed with testing, I can help so that we can move this forward faster.Regarding #414, I'll check the issue for context and share my thoughts on it.
aeworxet commentedon Oct 14, 2026
@catosaurusrex2003, please investigate issues independently in the future before raising them with the team, so the team can focus on matters that do require their input.
catosaurusrex2003 commentedon Oct 14, 2026
Regarding #414, I don't think there will be new commits on that PR anytime soon. The last time I spoke with the contributor, she mentioned that she currently has exams. She is also a mentee in the asyncapi-react mentorship program, so this issue falls outside the scope of her mentorship.
I'd really appreciate your help with that. It might also be useful to add a CONTRIBUTING.md to the repo documenting how to set up and test these workflow changes in future ?
Given that there is already an existing PR and this may be closer to a good-first-issue than a Medium bounty, should I remove #413 from the Microgrant submission then?
aeworxet commentedon Oct 14, 2026
Yes, since the entire history is already here, removing it will avoid polluting the discussion.
Shurtu-gal commentedon Oct 15, 2026
Yeah should add to doc.