Add Workflows and Scripts to automatically keep the approved_patterns.yml up to date. #90
Conversation
Remove details from comment
07d17fa to
4af480a
Compare
sebbASF
left a comment
There was a problem hiding this comment.
Documentation needed please
|
@assignUser Nice , instead of on root, could we move the gateway scripts to some folders? just for easy to segregate and we might add more scripts in future/ add further improvements. WDYT? |
|
missing feature: ban list of compromised actions, though afaik that is a feature that zizmor provides? |
| 1. **Fork** this repository | ||
| 2. **Remove** the relevant entry from `actions.yaml` | ||
| 3. **Create a PR** against the `main` branch | ||
| 4. **Mark it as urgent** in the PR title (e.g., "URGENT: Remove vulnerable action X") | ||
| 5. **Include in your PR description**: | ||
| - The reason for removal | ||
| - Any CVE or security advisory ID if applicable | ||
| - Impact on projects currently using the action | ||
| - Recommended alternatives if available |
There was a problem hiding this comment.
The process was chatgpts idea but I do think it makes sense to have some process like this for cases like the tj-actions incident, where anyone who comes across a compromised actions can quickly initiate removal of said action.
| git config --local user.email "$GITHUB_ACTOR@users.noreply.github.com" | ||
| git add -f actions.yml approved_patterns.yml | ||
| git commit -m "Update Actions" || echo "No changes" | ||
| git push origin |
There was a problem hiding this comment.
If branch protection rules enabled, will this work? it seems pushing directly to main.
There was a problem hiding this comment.
Ah, no that would probably block it. I think the best solution for that would be to use a simple github app and add that to the bypass list.
|
Good stuff , LGTM :) |
As discussed with @dfoulks1 this PR adds the technical frontend to allow easy management of the org wide actions allow list. The backend is a pip service that listens for changes to
approved_patterns.ymland updates the actual org setting through the GH API. The missing component is the social part of reviewing add or updated actions in PRs based on policy/heuristic.I have overwritten the currentThanks @dfoulks1 for the conversion!approved_patterns.ymlwith an example file, before actually merging this we have to convert the current version into the new format without wildcards and SHAs instead of tags.keep: truewhich prevents them being pruned by the cron job.This will then enable us to implement the following process: