Skip to content

some testing#8099

Closed
Inverle wants to merge 4 commits intoFreshRSS:edgefrom
Inverle:targeting-pr-v2
Closed

some testing#8099
Inverle wants to merge 4 commits intoFreshRSS:edgefrom
Inverle:targeting-pr-v2

Conversation

@Inverle
Copy link
Member

@Inverle Inverle commented Oct 12, 2025

ignore this PR

@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025

/fix-all

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

🤖 Command /fix-all received. Running…

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

❌ Command /fix-all failed. Check the workflow run for details.

@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025

oh ok

@Inverle Inverle closed this Oct 12, 2025
@Inverle Inverle reopened this Oct 12, 2025
@Alkarex
Copy link
Member

Alkarex commented Oct 12, 2025

See example: #8081 (comment)

@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025

/fix-all

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

🤖 Command /fix-all received. Running…

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

✅ Command /fix-all completed with no change.

@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025

/fix-all

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

🤖 Command /fix-all received. Running…

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

✅ Command /fix-all completed with no change.

@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025

/fix-all

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

🤖 Command /fix-all received. Running…

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

❌ Command /fix-all failed. Check the workflow run for details.

@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025

/fix-all

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

🤖 Command /fix-all received. Running…

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

❌ Command /fix-all failed. Check the workflow run for details.

@Inverle Inverle closed this Oct 12, 2025
@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025

Sorry for the spam

@Alkarex
Copy link
Member

Alkarex commented Oct 12, 2025

No worries, seems to work fine?

@Inverle Inverle reopened this Oct 12, 2025
@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025

/fix-all

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

🤖 Command /fix-all received. Running…

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

❌ Command /fix-all failed. Check the workflow run for details.

@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025

/fix-all

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

🤖 Command /fix-all received. Running…

@github-actions github-actions bot added the a11y Accessibility label Oct 12, 2025
@github-actions
Copy link

github-actions bot commented Oct 12, 2025

✅ Command /fix-all completed with no change.

@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025

@Alkarex I don't have permissions to change labels but I was able to do that using the action. Seems like a vulnerability?

@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025

relevant zizmor output:

root@vmware:/tmp/fff# zizmor ./test.yml
 INFO zizmor::registry: skipping impostor-commit: can't run without a GitHub API token
 INFO zizmor::registry: skipping ref-confusion: can't run without a GitHub API token
 INFO zizmor::registry: skipping known-vulnerable-actions: can't run without a GitHub API token
 INFO zizmor::registry: skipping stale-action-refs: can't run without a GitHub API token
 INFO zizmor::registry: skipping ref-version-mismatch: can't run without a GitHub API token
 INFO audit: zizmor: 🌈 completed ./test.yml
warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> ./test.yml:60:9
   |
60 |         - name: Checkout PR branch
   |  _________^
61 | |         uses: actions/checkout@v5
62 | |         with:
63 | |           token: ${{ secrets.GITHUB_TOKEN }}
64 | |           repository: ${{ fromJSON(steps.pr.outputs.result).repo.full_name }}
65 | |           ref: ${{ fromJSON(steps.pr.outputs.result).ref }}
   | |___________________________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix

@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025

/fix-all

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

🤖 Command /fix-all received. Running…

@github-actions
Copy link

github-actions bot commented Oct 12, 2025

✅ Command /fix-all completed with no change.

@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025 •
edited
Loading

I can also change title of #8093 to "pwn"

I think it's also possible to add commits to PRs but I already had trouble doing that (look at the spam before)

@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025 •
edited
Loading

Oh wait the action also has contents: write permission, meaning it's possible to make commits directly to the edge / latest branch too

I would try to do that but I don't know git very well[1], so best to fix this as soon as possible
see this: Inverle#2 (comment) (it did work on my fork)

[1]: this line is making it hard, it wasn't there before:

FreshRSS/.github/workflows/commands.yml

Line 64 in 458832c

repository: ${{ fromJSON(steps.pr.outputs.result).repo.full_name }}

@Alkarex
Copy link
Member

Alkarex commented Oct 12, 2025

Good catch. PR welcome if you can

@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025

Note that whatever malicious commit would get added to latest/edge, it also gets published to Docker automatically...

contents: write permission allows for making releases as well:

https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps?apiVersion=2022-11-28#repository-permissions-for-contents

@Alkarex
Copy link
Member

Alkarex commented Oct 12, 2025

I have temporarily disabled it, until it is fixed

@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025 •
edited
Loading

/fix-all (it's disabled)

@Inverle Inverle mentioned this pull request Oct 12, 2025
Closed
@Inverle
Copy link
Member Author

Inverle commented Oct 12, 2025

#8100

@Inverle Inverle closed this Oct 15, 2025
@Inverle Inverle mentioned this pull request Oct 15, 2025
Closed
@Inverle Inverle deleted the targeting-pr-v2 branch December 6, 2025 16:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

a11y Accessibility Security 🛡️

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Inverle @Alkarex