Informational 15 Bitcoin Committed Mar 3, 2026 · 10:05 UTC

ci: avoid running `bot-project-automation` in other repositories

c766db9a View source ↗

Public commit record

What the developer wrote

Authored by M1nd3r

97/100 · Strong

ci: avoid running `bot-project-automation` in other repositories

- Disabled jobs in `[Bot] add to GitHub project` workflow in other repositories than `trezor/trezor-firmware`.
- Merged job to avoid remove setup duplication.

[no changelog]

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode

The short version

What changed, and why it matters

This commit is a routine GitHub Actions workflow hardening change. It restricts an internal automation bot so it only runs in the official Trezor firmware repository, limits it to newly opened issues and pull requests, merges two nearly identical jobs into one, and pins a third-party action to a specific version. There is no indication this fixes an active security vulnerability or affects the Trezor device firmware or user funds.

Recommended action

No security action required. This is a benign CI hygiene improvement. Reviewers may optionally verify the pinned commit hash of `actions/add-to-project` matches a trusted release.

Security signals we found

Workflow repository guard added to prevent execution in forks

Third-party action pinned from floating branch to specific commit hash

Event trigger narrowed to reduce unnecessary workflow runs

No changes to firmware, bootloader, crypto, or secret storage

Technical analysis

Evidence from the diff

The patch modifies .github/workflows/bot-project-automation.yml. Changes: (1) narrows workflow triggers from all issues/pull_request events to only opened types; (2) adds a job-level if: github.repository == 'trezor/trezor-firmware' guard so the workflow does not execute in forks; (3) merges project-add-pull-request and project-add-issue into a single project-add job with step-level if conditions; (4) pins actions/add-to-project from the floating main branch to commit 158aad9ed186a4842abf69d0f8071a0ff95312d0. The workflow still uses a GitHub App token with repository-projects: write permission, but that scope is appropriate for adding items to an organization project board. No device code, crypto, or secrets handling were changed.

Changed components

.github/workflows/bot-project-automation.yml

Inspect captured patch +16 / −16

diff --git a/.github/workflows/bot-project-automation.yml b/.github/workflows/bot-project-automation.yml
index 8ea7a0bb..4a8466b0 100644
--- a/.github/workflows/bot-project-automation.yml
+++ b/.github/workflows/bot-project-automation.yml
@@ -1,6 +1,10 @@
 name: "[Bot] add to GitHub project"
 
-on: [issues, pull_request]
+on:
+  issues:
+    types: [opened]
+  pull_request:
+    types: [opened]
 
 permissions:
   contents: read
@@ -9,7 +13,9 @@ permissions:
   repository-projects: write
 
 jobs:
-  project-add-pull-request:
+  project-add:
+    # run only in 'trezor/trezor-firmware' repository
+    if: github.repository == 'trezor/trezor-firmware'
     runs-on: ubuntu-latest
     steps:
       - name: Generate GitHub App token
@@ -18,25 +24,19 @@ jobs:
         with:
           app-id: ${{ secrets.TREZOR_BOT_APP_ID }}
           private-key: ${{ secrets.TREZOR_BOT_PRIVATE_KEY }}
+
       - name: Add new pull request to the Firmware project
-        uses: actions/add-to-project@main
-        if: github.event_name == 'pull_request' && github.event.action == 'opened'
+        # run only for pull requests
+        if: github.event_name == 'pull_request'
+        uses: actions/add-to-project@158aad9ed186a4842abf69d0f8071a0ff95312d0 # main@2026-01-06
         with:
           project-url: https://github.com/orgs/trezor/projects/60
           github-token: ${{ steps.trezor-bot-token.outputs.token }}
 
-  project-add-issue:
-    name: Add new issue to the Firmware project
-    runs-on: ubuntu-latest
-    steps:
-      - name: Generate GitHub App token
-        id: trezor-bot-token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.TREZOR_BOT_APP_ID }}
-          private-key: ${{ secrets.TREZOR_BOT_PRIVATE_KEY }}
-      - uses: actions/add-to-project@main
-        if: github.event_name == 'issues' && github.event.action == 'opened'
+      - name: Add new issue to the Firmware project
+        # run only for issues
+        if: github.event_name == 'issues'
+        uses: actions/add-to-project@158aad9ed186a4842abf69d0f8071a0ff95312d0 # main@2026-01-06
         with:
           project-url: https://github.com/orgs/trezor/projects/60
           github-token: ${{ steps.trezor-bot-token.outputs.token }}

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

refactor(core): digest EIP-1559/EIP-7702 magic without RLP encoding

test(core): test RLP self-encoding bytestrings

chore(core): remove sha1 from regular FW