Skip to content

fix: extract 1 unsafe expression(s) to env vars#21555

Closed
dagecko wants to merge 1 commit intoapache:masterfrom
dagecko:runner-guard/fix-ci-security
Closed

fix: extract 1 unsafe expression(s) to env vars#21555
dagecko wants to merge 1 commit intoapache:masterfrom
dagecko:runner-guard/fix-ci-security

Conversation

@dagecko
Copy link

@dagecko dagecko commented Mar 26, 2026

Security: Harden GitHub Actions workflows

Hey, we found some CI/CD security issues in this repo's workflows using Runner Guard, our open-source CI/CD security scanner at Vigilant. These are the same vulnerability classes being actively exploited right now in the tj-actions, Trivy, LiteLLM supply chain attack chain. We scanned the top 50K repos on GitHub and over 20,000 have this same problem. We're trying to get fixes out to as many maintainers as possible before more repos get hit.

This PR fixes what we could automatically, and flags anything else that needs a manual look. There's a real person behind this PR, we're actively checking back on comments so if you have any questions just drop them here and we'll respond.

Fixes applied (in this PR)

Rule Severity File Description
RGS-002 high .github/workflows/teardown-pr-preview.yml Extracted 1 unsafe expression(s) to env vars

Advisory: additional findings (manual review recommended)

| Rule | Severity | File | Description |
| RGS-004 | high | .github/workflows/pr-preview.yml | Comment-Triggered Workflow Without Author Authorization Check |
| RGS-004 | high | .github/workflows/pr-preview.yml | Comment-Triggered Workflow Without Author Authorization Check |
| RGS-004 | high | .github/workflows/pr-preview.yml | Comment-Triggered Workflow Without Author Authorization Check |
| RGS-004 | high | .github/workflows/pr-preview.yml | Comment-Triggered Workflow Without Author Authorization Check |
| RGS-004 | high | .github/workflows/pr-preview.yml | Comment-Triggered Workflow Without Author Authorization Check |

Why this matters

GitHub Actions workflows that use untrusted input in run: blocks, expose
secrets inline, or use unpinned third-party actions are vulnerable to
code injection, credential theft, and supply chain attacks. These are the same
vulnerability classes exploited in the tj-actions/changed-files incident
and subsequent supply chain attacks, which compromised CI secrets across
thousands of repositories.

How to verify

Review the diff — each change is mechanical and preserves workflow behavior:

  • Expression extraction (RGS-002/008/014): Moves ${{ }} expressions from
    run: blocks into env: mappings, preventing shell injection

Run brew install Vigilant-LLC/tap/runner-guard && runner-guard scan . or install from the
repo to verify.


Found by Runner Guard | Built by Vigilant Cyber Security | Learn more

If this PR is not welcome, just close it -- we won't send another.

Automated security fixes applied by Runner Guard (https://github.com/Vigilant-LLC/runner-guard).

Changes:
 .github/workflows/teardown-pr-preview.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
@echarts-bot
Copy link

echarts-bot bot commented Mar 26, 2026

Thanks for your contribution!
The community will review it ASAP. In the meanwhile, please checkout the coding standard and Wiki about How to make a pull request.

Please DO NOT commit the files in dist, i18n, and ssr/client/dist folders in a non-release pull request. These folders are for release use only.

To reviewers: If this PR is going to be described in the changelog in the future release, please make sure this PR has one of the following labels: PR: doc ready, PR: awaiting doc, PR: doc unchanged

This message is shown because the PR description doesn't contain the document related template.

@dagecko dagecko closed this by deleting the head repository Mar 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant