ci: gen PR labels from master instead of fork
What the developer wrote
Authored by satsfy (Renato Britto)
ci: gen PR labels from master instead of fork
The labeler checked out the fork and ran cargo metadata on
its manifests while holding the base repo token, a github
actions security vulnerability called pwn request.
But we don't need the fork checkout to generate labels, this
commit now does it from master.
What changed, and why it matters
This commit fixes a GitHub Actions workflow that was checking out code from a pull request's fork while holding a write-capable repository token. That setup is a known 'pwn request' attack pattern: a malicious fork could run code during the workflow and potentially steal or misuse the repository token. The fix removes the fork checkout and generates labels using only the trusted master branch, so untrusted code no longer runs with privileged credentials.
Verify that no other workflows in the repository check out refs/pull/<number>/merge or fork refs while using the default GITHUB_TOKEN, and consider pinning all actions to commit SHAs as already done here. Review the gen_label_config.sh script to ensure it does not itself invoke network or file operations that could reintroduce risk.
Security signals we found
Workflow executed untrusted PR merge code with base-repo GITHUB_TOKEN
Removal of refs/pull/<number>/merge checkout
Self-described fix for 'github actions security vulnerability called pwn request'
Reduction of token exposure surface by no longer checking out fork code
Evidence from the diff
The manage-pr.yml workflow previously performed two checkouts: one of master and one of the PR merge commit (refs/pull/
Changed components
.github/workflows/manage-pr.ymlInspect captured patch +2 / −9
### .github/workflows/manage-pr.yml
@@ -13,18 +13,11 @@ jobs:
- name: Checkout master
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
- path: master
- persist-credentials: false
- - name: Checkout merge commit
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- with:
- path: merge
- ref: "refs/pull/${{ github.event.number }}/merge"
persist-credentials: false
- name: Generate label config
- run: cd master && SCAN_DIR=../merge ./.github/gen_label_config.sh
+ run: ./.github/gen_label_config.sh
- name: Update labels
uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
with:
- configuration-path: master/.github/labeler.yml
+ configuration-path: .github/labeler.yml
sync-labels: trueWhy this scored 47/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.