tiennm99/ccs
1
0 Fork 0
mirror of https://github.com/tiennm99/ccs.git synced 2026-10-14 04:15:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): harden self-hosted workflow trust boundaries

Browse Source 
Keep active CCS workflows on self-hosted runners, gate self-hosted PR execution to trusted authors, and scope privileged release credentials to the exact git operations that need them.
This commit is contained in:
Kai (Tam Nhu) Tran authored and GitHub committed 2026-05-12 12:34:15 -04:00
1 parent d86032ed0a
commit 2273757c83
17 files changed
+210 -29
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/unit/scripts/github/release-workflow.test.ts
+9 -2
View File
@@ -7,7 +7,7 @@ function resolvePath(relativePath: string) {
}
describe('stable release workflow', () => {
test('uses the protected-branch runner and release token path', () => {
test('uses the self-hosted runner and scoped release token path', () => {
const workflowPath = resolvePath('../../../../.github/workflows/release.yml');
expect(fs.existsSync(workflowPath)).toBe(true);
@@ -26,7 +26,14 @@ describe('stable release workflow', () => {
expect(workflow).toContain('branches: [main]');
expect(workflow).toContain('runs-on: [self-hosted, linux, x64]');
expect(workflow).not.toContain('runs-on: ubuntu-latest');
expect(checkoutSection).toContain('token: ${{ secrets.PAT_TOKEN }}');
expect(checkoutSection).toContain('persist-credentials: false');
expect(checkoutSection).not.toContain('token: ${{ secrets.PAT_TOKEN }}');
expect(releaseSection).toContain('echo "::add-mask::${auth_header}"');
expect(releaseSection).toContain('GIT_CONFIG_COUNT=2');
expect(releaseSection).toContain('GIT_CONFIG_KEY_0=http.https://github.com/kaitranntt/ccs.extraheader');
expect(releaseSection).toContain('GIT_CONFIG_VALUE_0="AUTHORIZATION: basic ${auth_header}"');
expect(releaseSection).toContain('GIT_CONFIG_KEY_1=http.https://github.com/kaitranntt/ccs.git.extraheader');
expect(releaseSection).toContain('GIT_CONFIG_VALUE_1="AUTHORIZATION: basic ${auth_header}"');
expect(releaseSection).toContain('GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }}');
expect(releaseSection).toContain('GH_TOKEN: ${{ secrets.PAT_TOKEN }}');
expect(releaseSection).toContain('NPM_TOKEN: ${{ secrets.NPM_TOKEN }}');