mirror of
https://github.com/NoFxAiOS/nofx.git
synced 2026-07-28 22:42:52 +08:00
c5277c0fb9
pr-checks-comment.yml runs in the privileged workflow_run context with a write token while consuming artifacts produced by the untrusted PR workflow. Seven spots template-interpolated that untrusted data (and the fork-controlled head branch name) directly into github-script source — a crafted artifact could escape the string literal and run arbitrary JS with the privileged token (CodeQL actions/code-injection, critical). - All untrusted values now flow through env vars and process.env; the PR number is parsed and validated before use - test.yml / docker-build.yml gain workflow-level 'permissions: contents: read' (CodeQL actions/missing-workflow-permissions); publish jobs keep their job-level packages:write