Skip to content

More secure version of renovate-changelog.yml workflow#4453

Open
janhoy wants to merge 3 commits into
apache:mainfrom
janhoy:feature/renovate-changelog-workflow-run
Open

More secure version of renovate-changelog.yml workflow#4453
janhoy wants to merge 3 commits into
apache:mainfrom
janhoy:feature/renovate-changelog-workflow-run

Conversation

@janhoy
Copy link
Copy Markdown
Contributor

@janhoy janhoy commented May 20, 2026

The renovate-changelog.yml workflow used pull_request_target to auto-generate
changelog entries for Renovate (solrbot) PRs. This trigger is flagged as a security
anti-pattern: it runs with write access to SOLRBOT_GITHUB_TOKEN while also checking
out code from a fork branch.

We had no reason to believe the existing workflow is in insecure in practice, for our particular
use, but this is done to align with best practices.

This PR replaces existing renovate-changelog.yml workflow with the two-stage
workflow_run pattern recommended by GitHub's security hardening guide:

Stage 1 (renovate-changelog-prepare.yml, pull_request trigger, no secrets):

  • Checks out the base repo at the base branch — never fork code
  • Runs the trusted generate-renovate-changelog.py script
  • Uploads the generated changelog/unreleased/PR#NNN-*.yml and PR metadata as an artifact

Stage 2 (renovate-changelog-push.yml, workflow_run trigger, has SOLRBOT_GITHUB_TOKEN):

  • Triggers only when Stage 1 succeeds and for solrbot/apache-_-solr (prevents
    spurious runs on non-solrbot PRs)
  • Downloads the artifact; parses metadata with grep/cut (never source)
  • Validates HEAD_REPO, PR_NUMBER, and HEAD_REF before any write operation
  • Clones the fork branch using a git credential store so the token never appears
    in the process list or command line
  • Removes stale PR#NNN-*.yml files (handles slug changes), copies the new file,
    commits and pushes

No changes to .github/scripts/generate-renovate-changelog.py.

Disclaimer: Developed by Claude code, reviewed by Github Copilot. Follows

janhoy added 2 commits May 20, 2026 00:45
Splits renovate-changelog.yml into two separate workflows:
- Stage 1 (pull_request): checks out BASE repo only, runs trusted Python
  script, uploads generated changelog + PR metadata as artifact. No secrets.
- Stage 2 (workflow_run): downloads artifact, validates metadata, clones
  fork branch via SOLRBOT_GITHUB_TOKEN PAT, and pushes changelog file.

This eliminates the pull_request_target security anti-pattern where fork
code was checked out in a context with write access to repository secrets.
- Stage 2: replace source of metadata file with grep/cut parsing to
  avoid executing file content as shell code
- Stage 2: use git credential store so SOLRBOT_GITHUB_TOKEN never
  appears in the command line or process listing
- Stage 2: add head_repository check to job if-condition, preventing
  spurious artifact-not-found failures for non-solrbot PRs
- Stage 2: add @ to HEAD_REF allowlist for Renovate branch names
  (e.g. renovate/node@lts)
- Stage 2: improve commit message to include PR number
- Both: add set -euo pipefail to multi-command run blocks

This comment was marked as resolved.

- grep lines use || true so missing keys fall through to the explicit
  error message instead of aborting silently under set -euo pipefail
- Replace HEAD_REF allowlist regex with git check-ref-format --branch,
  which rejects dangerous refspec chars (:, .., @{, trailing .lock)
  while correctly accepting Renovate branch names like renovate/node@lts
- chmod 600 on ~/.git-credentials and remove it after push completes
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants