chore: auto merge dependabot PRs for patch updates #16222
Conversation
| - name: Harden Runner | ||
| uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4 | ||
| with: | ||
| egress-policy: audit | ||
|
|
There was a problem hiding this comment.
Removing these as they do not provide any value in this workflow.
Also, this does not affect the OpenSSF score.
| runs-on: ubuntu-latest | ||
| if: github.event_name == 'pull_request_target' | ||
| if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'coder/coder' |
There was a problem hiding this comment.
This seems far too flimsy; is there no way we can reference a user by ID?
This workflow has to be crazy hardened if we're going to enable it.
See also: https://www.synacktiv.com/en/publications/github-actions-exploitation-dependabot
I have not read it fully; I'm focused on other tasks today
There was a problem hiding this comment.
We have been doing it at other places in ci.yaml too.
Also, they suggest we follow the GitHub docs. See: https://www.synacktiv.com/en/publications/github-actions-exploitation-dependabot#footnote4_i8j88po
And we are exactly following that.
As far as I understand, the exploit only works when using pull_request_target, and I have changed that to pull_request as per GitHub's recommendation.
See: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions
There was a problem hiding this comment.
Also trpc fixed it by updating github.actor --> github.event.pull_request.user.login
See: trpc/trpc@8187594
There was a problem hiding this comment.
https://api.github.com/users/dependabot[bot]
Can we not reference the ID instead? I wonder why they suggest login instead; feels flimsy.
This will ensure we run on label chnages.
We can do that. I am holding to merge and see if I can squeeze within the current PR. |
This is a bit tricky, as we are only enabling auto merge but would still need to wait for the CI to pass. We need to wait for the PR to merge before we send the notification. I will come to this in a follow up. |
Based on the instructions from https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions