PD-13324 speed up CI - #2923
Conversation
🚀 Preview DeploymentYour UI docs preview is ready! Preview URL: https://orcid.github.io/orcid-angular/runway/PD-13324/ This preview will be updated automatically when you push new commits to this PR. Deployed from commit: |
![orcid-sast[bot]](https://avatars.githubusercontent.com/in/1359722?s=60&v=4){kind=small}
| # Must be a required status check; see .github/workflows/format.yml. | ||
| format: | ||
| uses: ./.github/workflows/format.yml | ||
| secrets: inherit |
There was a problem hiding this comment.
This workflow uses secrets: inherit to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the secrets: map, e.g. secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }.
🎈 Fixed in commit c3ac923 🎈
| needs: detect | ||
| if: needs.detect.outputs.ci_only == 'true' | ||
| uses: ./.github/workflows/bld_test_rel_tag.yml | ||
| secrets: inherit |
There was a problem hiding this comment.
This workflow uses secrets: inherit to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the secrets: map, e.g. secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }.
🌟 Fixed in commit c3ac923 🌟
| needs: detect | ||
| if: needs.detect.outputs.ci_only == 'true' | ||
| uses: ./.github/workflows/pr.yml | ||
| secrets: inherit |
There was a problem hiding this comment.
This workflow uses secrets: inherit to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the secrets: map, e.g. secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }.
🧼 Fixed in commit 2116139 🧼
| push_i18n_source: | ||
| if: ${{ github.ref == 'refs/heads/main' && inputs.deploy }} | ||
| uses: ./.github/workflows/push_i18n_source.yml | ||
| secrets: inherit # pass all secrets for Transifex |
There was a problem hiding this comment.
This workflow uses secrets: inherit to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the secrets: map, e.g. secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }.
🎉 Fixed in commit c3ac923 🎉
1 participant
PD-13324