Feature: Fork pull request workflows from outside collaborators

[irsl]

Is your feature request related to a problem? Please describe.

A GitHub workflow that runs on the pull_request trigger from a fork PR uses the workflow file from the fork, not the PR base.

GitHub supports three options for Fork pull request workflows from outside collaborators:

• Require approval for first-time contributors who are new to GitHub
• Require approval for first-time contributors
• Require approval for all outside collaborators

The default setting is insecure: "Require approval for first-time contributors" as an attacker could send an innocent first time contribution first (e.g. typo fix in a documentation page) and then could trigger workflow executions with overridden actions.

The severity is high when the workflow is executed in a non-ephemeral self-hosted runner environment.

Describe the solution you'd like

I'd like scorecard to emit a finding when this config option is set to anything else but "Require approval for all outside collaborators".

Describe alternatives you've considered

Alternative options to defend against this attack vector are:

• The self-hosted runner group could be moved to the organization level and configure the group to only run on specific workflows that have already been committed to the main branch. GitHub docs
• A pre-job hook could be configured to verify whether workflow definitions are intact. Github docs

[pnacht]

Is this information available via the REST API? I couldn't find it, and neither could the people in https://github.com/orgs/community/discussions/35808.

Also, whenever it's available, it seems like the sort of thing GitHub usually requires an admin token for, so it wouldn't be accessible by outsiders or the Scorecard cronjob.

But it would be an interesting check, I agree.

[laurentsimon]

@josepalafox an API for this setting would be nice to have

[patrick-knight]

Hey @laurentsimon I work with a few of the teams around this area. Wanted to share we have a feature request open for this but don't have additional details to share on a timeframe.

[github-actions]

This issue has been marked stale because it has been open for 60 days with no activity.