ci: fix sync with trezor-common repository
What the developer wrote
Authored by Martin Milata
ci: fix sync with trezor-common repository
- do not persist conflicting token from actions/checkout
- remove failing git command that is no longer needed
- explicitly specify required permissions
What changed, and why it matters
This commit adjusts a GitHub Actions workflow that synchronizes code between two Trezor repositories. The changes remove a leftover default authentication token, explicitly request only the write permission needed for contents, and drop an unnecessary git command. These are hardening improvements rather than a fix for an active vulnerability.
No immediate action required. Treat as routine CI hardening. Reviewers may verify that the generated app token has no broader permissions than `contents: write` and that no other workflows persist default credentials unnecessarily.
Security signals we found
Credential persistence disabled on actions/checkout
Explicit least-privilege permission requested for generated GitHub App token
Removal of git extraheader cleanup command that is no longer needed
Workflow typo fix unrelated to security
Evidence from the diff
The patch modifies .github/workflows/bot-common-sync.yml. It sets persist-credentials: false on actions/checkout, adds permission-contents: write to the GitHub App token generation step, fixes a typo in a step name, and removes git config --unset-all http.https://github.com/.extraheader from the sync script invocation. The intent is to prevent the job from accidentally carrying the default GITHUB_TOKEN from actions/checkout and to scope the generated app token more narrowly.
Changed components
.github/workflows/bot-common-sync.ymlInspect captured patch +4 / −2
diff --git a/.github/workflows/bot-common-sync.yml b/.github/workflows/bot-common-sync.yml
index f84c656f..d326570b 100644
--- a/.github/workflows/bot-common-sync.yml
+++ b/.github/workflows/bot-common-sync.yml
@@ -19,6 +19,8 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # actions/checkout@v6.0.2
with:
fetch-depth: 0
+ persist-credentials: false
+
- name: Generate GitHub App token
id: trezor-bot-token
uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # actions/create-github-app-token@v3.1.1
@@ -28,13 +30,14 @@ jobs:
owner: ${{ github.repository_owner }}
repositories: |
trezor-common
+ permission-contents: write
- name: Copy git-filter and script to temporary directory
run: |
cp ./ci/common_sync/common_repo_sync.sh ${{runner.temp}}/common_repo_sync.sh
cp ./ci/common_sync/git-filter-repo ${{runner.temp}}/git-filter-repo
- - name: Confiugre git user
+ - name: Configure git user
run: |
git config --global user.name "${BOT_USERNAME}"
git config --global user.email "${BOT_EMAIL}"
@@ -49,5 +52,4 @@ jobs:
BOT_TOKEN: ${{ steps.trezor-bot-token.outputs.token }}
run: |
echo "Synchronizing common with the trezor-common repository"
- git config --unset-all http.https://github.com/.extraheader
${{ runner.temp }}/common_repo_sync.sh
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.