fix(security): harden pull_request_target workflows against fork RCE [MSRC-111178]#353
Merged
imran-siddique merged 19 commits intomicrosoft:mainfrom Mar 23, 2026
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add EU AI Act, Colorado AI Act, and GPAI obligations timeline with AGT coverage mapping. Reference Microsoft Purview DSPM for AI as complementary data governance layer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The Scorecard API rejects workflows with write permissions at the workflow level. id-token: write and security-events: write must be scoped to the job level only. Restores permissions: read-all at workflow level while keeping job-level write permissions intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ft#324) Add Google-style docstrings with Args, Returns, Raises, Attributes, and Example sections to MCPMessageType, MCPAdapter, and MCPServer classes. Also enhances docstrings for key methods including handle_message, _handle_tools_call, _handle_resources_read, and _map_tool_to_action. Fixes microsoft#316
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
…s (dependency confusion) (microsoft#325) - Replace !pip install agent-os with !pip install -e ../.. in all 6 notebooks; agent-os is not on PyPI and installing it from PyPI is a dependency confusion vector - Replace zendesk-sdk/freshdesk-sdk with zenpy/freshdesk (the real published SDKs) in customer-service/requirements.txt - Remove hashlib-compat from healthcare-hipaa/requirements.txt; hashlib is stdlib and hashlib-compat is not a real PyPI package
…stall agent-os with agent-os-kernel Replace all remaining instances of `pip install agent-os` (unregistered on PyPI) with `pip install agent-os-kernel` (the actual package) across docs, examples, TypeScript extensions, CLI source, tests, and SVG assets. Also fixes `pip install emk` references to point to `agent-os-kernel[full]` since emk is a submodule, not a standalone PyPI package. Completes the fix started in PR microsoft#325 which only covered notebooks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Dify 65K→133K, AutoGen 42K→55K, CrewAI 28K→46K, Semantic Kernel 24K→27K, LangGraph 24K→27K, Haystack 22K→24K, Agent Framework 7.6K→8K. Added star counts for OpenAI Agents SDK (20K) and Google ADK (18K). Sorted by stars descending. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…it CI - scripts/check_dependency_confusion.py: Pre-commit hook that scans for pip install commands referencing unregistered PyPI packages. Maintains an allowlist of known registered packages. - .github/workflows/weekly-security-audit.yml: Weekly CI job running dependency confusion scan, security skills scan, and weak crypto check. Uploads reports as artifacts with 90-day retention. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…icrosoft#349) * docs: add testing guide for external testers and customers Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add regulatory alignment table and Purview positioning to README Add EU AI Act, Colorado AI Act, and GPAI obligations timeline with AGT coverage mapping. Reference Microsoft Purview DSPM for AI as complementary data governance layer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): restore read-all at workflow level for Scorecard verification The Scorecard API rejects workflows with write permissions at the workflow level. id-token: write and security-events: write must be scoped to the job level only. Restores permissions: read-all at workflow level while keeping job-level write permissions intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add comprehensive docstrings to mcp_adapter.py classes (microsoft#324) Add Google-style docstrings with Args, Returns, Raises, Attributes, and Example sections to MCPMessageType, MCPAdapter, and MCPServer classes. Also enhances docstrings for key methods including handle_message, _handle_tools_call, _handle_resources_read, and _map_tool_to_action. Fixes microsoft#316 * ci: add markdown link checker workflow (microsoft#323) Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * feat: add policy evaluation heatmap to SRE dashboard (microsoft#309) (microsoft#326) * fix: remove unregistered PyPI packages from notebooks and requirements (dependency confusion) (microsoft#325) - Replace !pip install agent-os with !pip install -e ../.. in all 6 notebooks; agent-os is not on PyPI and installing it from PyPI is a dependency confusion vector - Replace zendesk-sdk/freshdesk-sdk with zenpy/freshdesk (the real published SDKs) in customer-service/requirements.txt - Remove hashlib-compat from healthcare-hipaa/requirements.txt; hashlib is stdlib and hashlib-compat is not a real PyPI package * fix(security): complete dependency confusion fix — replace all pip install agent-os with agent-os-kernel Replace all remaining instances of `pip install agent-os` (unregistered on PyPI) with `pip install agent-os-kernel` (the actual package) across docs, examples, TypeScript extensions, CLI source, tests, and SVG assets. Also fixes `pip install emk` references to point to `agent-os-kernel[full]` since emk is a submodule, not a standalone PyPI package. Completes the fix started in PR microsoft#325 which only covered notebooks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update framework star counts to current values Dify 65K→133K, AutoGen 42K→55K, CrewAI 28K→46K, Semantic Kernel 24K→27K, LangGraph 24K→27K, Haystack 22K→24K, Agent Framework 7.6K→8K. Added star counts for OpenAI Agents SDK (20K) and Google ADK (18K). Sorted by stars descending. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Parsa Faraji Alamouti <165321600+parsa-faraji@users.noreply.github.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Zeel Desai <72783325+zeel2104@users.noreply.github.com> Co-authored-by: Xavier Garceau-Aranda <xavier.garceau-aranda@posteo.net>
- agentmesh → agentmesh-platform (5 files) - agentmesh-governance → agent-governance-toolkit - agent-os-observability → agent-os-kernel[observability] - hashlib.md5 → hashlib.sha256 (3 files) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…[MSRC-111178] Defense-in-depth hardening for all 6 AI agent workflows: - Explicit ref: base.sha on all checkout steps (was implicit default) - persist-credentials: false on all checkouts - Fork safety notices - Shallow clone (fetch-depth: 1) where full history not needed - Security header comments referencing MSRC case The core vulnerability (ref: head.sha checkout) was already removed in PR microsoft#303. These changes add belt-and-suspenders protection. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🤖 AI Agent: code-reviewer
Review Summary
This pull request addresses a critical security vulnerability related to the use of pull_request_target workflows in GitHub Actions. The changes implement defense-in-depth measures to mitigate potential remote code execution (RCE) risks from malicious fork PRs. The updates are well-documented and align with best practices for securing CI/CD pipelines.
Feedback
🔴 CRITICAL
-
Fork Safety Check Logic:
- The fork safety check (
github.event.pull_request.head.repo.full_name != github.repository) is a good addition, but it does not prevent execution of malicious code if a fork PR modifies the.github/actions/directory in the base branch. While theref: ${{ github.event.pull_request.base.sha }}mitigates this risk, ensure that composite actions themselves are hardened against arbitrary code execution. Consider adding a validation step to verify the integrity of composite actions (e.g., checksum validation).
- The fork safety check (
-
Persist Credentials:
- Setting
persist-credentials: falseis critical to prevent unauthorized access to theGITHUB_TOKEN. However, ensure that all subsequent steps in the workflow do not inadvertently re-enable credentials or rely on them for sensitive operations.
- Setting
🟡 WARNING
- Backward Compatibility:
- The change from implicit default ref (
HEAD) to explicitBASE(github.event.pull_request.base.sha) may alter the behavior of workflows that previously relied on the PR head for dynamic analysis. For example, workflows analyzing changes introduced in the PR may need adjustments to fetch the diff explicitly via the GitHub API. Ensure that downstream tools or scripts are compatible with this change.
- The change from implicit default ref (
💡 SUGGESTION
-
Shallow Clone (
fetch-depth: 1):- While shallow clones improve performance, they may limit debugging capabilities in workflows that require full commit history. Consider documenting this trade-off in the workflow comments or providing an option to override
fetch-depthfor debugging purposes.
- While shallow clones improve performance, they may limit debugging capabilities in workflows that require full commit history. Consider documenting this trade-off in the workflow comments or providing an option to override
-
Security Header Comments:
- The security header comments referencing MSRC Case 111178 are helpful for context. Consider adding a link to the MSRC documentation or a summary of the vulnerability for future maintainers who may not have direct access to the case details.
-
Workflow Reusability:
- The fork safety check and other security measures are repeated across multiple workflows. Consider abstracting these steps into a reusable composite action to reduce duplication and ensure consistency across workflows.
-
Testing:
- Ensure that these changes are tested against various scenarios, including fork PRs, base branch modifications, and workflows requiring full commit history. Automated tests for CI/CD workflows can help validate these scenarios.
-
Documentation Update:
- Update the repository's documentation to reflect these security changes, especially for contributors who may rely on
pull_request_targetworkflows for testing their PRs.
- Update the repository's documentation to reflect these security changes, especially for contributors who may rely on
Action Items
- Harden composite actions against arbitrary code execution (e.g., checksum validation).
- Verify compatibility of downstream tools/scripts with the explicit
BASEref. - Abstract repeated security steps into a reusable composite action.
- Test workflows against edge cases and document the changes.
Conclusion
The changes in this pull request significantly improve the security posture of the repository's CI/CD workflows. Address the critical and warning items to ensure comprehensive mitigation of RCE risks and maintain backward compatibility. The suggestions provided will further enhance maintainability and usability.
🤖 AI Agent: security-scanner — Security Review of Pull Request: Hardening `pull_request_target` WorkflowsSecurity Review of Pull Request: Hardening
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Defense-in-depth hardening for all 6 AI agent workflows using pull_request_target.
Changes across 6 workflow files:
The core vulnerability (ref: head.sha checkout enabling fork RCE) was already removed in PR #303. These changes add defense-in-depth per MSRC requirements.
Ref: MSRC Case 111178