feat: add installer security advisory

Author: 777genius

__tests__/e2e/install-script.e2e.test.ts

@@ -122,6 +122,13 @@ describe('review-router curl installer e2e', () => {
 
     expect(result.status).toBe(0);
     expect(fs.existsSync(result.workflowPath)).toBe(true);
+    expect(result.stdout).toContain('Security advisory');
+    expect(result.stdout).toContain(
+      'Generated workflows use pull_request, skip fork PR secret-backed review, and do not use pull_request_target.'
+    );
+    expect(result.stdout).toContain(
+      'Skipping remote repository hardening checks in dry-run/local-only mode'
+    );
     expect(result.stdout).toContain('ReviewRouter doctor');
     expect(result.stdout).toContain('Workflow files are present');
     expect(result.stdout).toContain(
@@ -260,6 +267,9 @@ describe('review-router curl installer e2e', () => {
 
     expect(result.status).toBe(0);
     expect(result.stdout).toContain('ReviewRouter doctor');
+    expect(result.stdout).toContain(
+      'Codex OAuth stores your ChatGPT-managed Codex auth.json as an Actions secret'
+    );
     expect(result.stdout).toContain('Skipping CODEX_CONFIG_TOML by default');
     expect(result.stdout).not.toContain('gh secret set CODEX_CONFIG_TOML');
     const workflow = workflowText(result.workflowPath);

docs/install.md

@@ -134,6 +134,25 @@ REVIEW_ROUTER_SKIP_APP_DOCTOR=1
 
 Do not use this for production rollout. Without `Actions: write`, `/rr skip` can record the signed ledger but cannot rerun the failed review check automatically.
 
+## Security advisory
+
+The installer prints a security advisory before writing workflows.
+
+It always reminds you that generated workflows:
+
+- use `pull_request`, not `pull_request_target`
+- skip fork PR secret-backed review by default
+- keep `/rr skip` handling in a separate workflow
+
+When GitHub API access is available, it also checks:
+
+- whether the target repository is public while using Codex OAuth
+- whether the default branch has branch protection
+- whether a CODEOWNERS file exists
+- whether CODEOWNERS appears to cover `.github/workflows/**`
+
+These checks are warnings, not hard blockers. The main risk is not that collaborators can read Actions secrets in the GitHub UI. The practical risk is workflow-code access: anyone who can get a malicious workflow merged into a repository or push a same-repository branch where secrets are available can try to exfiltrate secrets during CI.
+
 ## Secret scopes
 
 | Scope  | Where secrets live                     | Repository access          | Best for                                                               |
@@ -259,6 +278,8 @@ ReviewRouter uses a binary-only Codex health check by default. The real review c
 
 Use this only in trusted automation. Do not put personal Codex OAuth credentials into public/open-source repos where untrusted workflow changes can access secrets. GitHub does not expose repository secrets to fork PR workflows by default, and the generated workflow skips fork PRs by default.
 
+Important auth freshness note: on GitHub-hosted runners, the runner filesystem is ephemeral. Codex can refresh `auth.json` during a run, but ReviewRouter cannot safely write the refreshed file back to GitHub Actions secrets automatically. If the stored secret becomes stale or a refresh token is rotated, run `codex login` again on a trusted machine and rerun the installer or update `CODEX_AUTH_JSON`. For fully automatic long-running auth, prefer an OpenAI API key or a trusted self-hosted runner with persistent `CODEX_HOME`.
+
 Default Codex model:
 
 ```text

scripts/install.sh

@@ -530,6 +530,78 @@ can_run_remote_checks() {
   ! is_true "$DRY_RUN" && ! is_true "$LOCAL_ONLY" && ! is_true "$SKIP_GH_CHECK"
 }
 
+decode_base64_to_stdout() {
+  if base64 --decode >/dev/null 2>&1 </dev/null; then
+    base64 --decode
+  else
+    base64 -D
+  fi
+}
+
+read_github_file() {
+  repo_path="$1"
+  ref="$2"
+  encoded="$(gh api "repos/$TARGET_REPO/contents/$repo_path?ref=$ref" --jq '.content' 2>/dev/null || true)"
+  [ -n "$encoded" ] || return 1
+  printf '%s' "$encoded" | tr -d '\n' | decode_base64_to_stdout 2>/dev/null
+}
+
+find_codeowners_content() {
+  ref="$1"
+  for codeowners_path in CODEOWNERS .github/CODEOWNERS docs/CODEOWNERS; do
+    if content="$(read_github_file "$codeowners_path" "$ref")"; then
+      printf '%s\n' "$content"
+      return 0
+    fi
+  done
+  return 1
+}
+
+run_security_advisory() {
+  log ""
+  info "Security advisory"
+  if [ "$AUTH_MODE" = "codex" ]; then
+    warn "Codex OAuth stores your ChatGPT-managed Codex auth.json as an Actions secret. Use it only for trusted private automation; prefer OpenAI API key mode for public/open-source repositories."
+    warn "GitHub-hosted runners are ephemeral. If Codex refreshes auth.json during a run, ReviewRouter cannot persist the refreshed file back to GitHub secrets automatically; reseed auth.json if Codex starts returning 401."
+  else
+    ok "Auth mode does not store Codex OAuth auth.json"
+  fi
+  ok "Generated workflows use pull_request, skip fork PR secret-backed review, and do not use pull_request_target."
+
+  if ! can_run_remote_checks; then
+    warn "Skipping remote repository hardening checks in dry-run/local-only mode"
+    return
+  fi
+
+  repo_visibility="$(gh repo view "$TARGET_REPO" --json visibility --jq '.visibility' 2>/dev/null || true)"
+  default_branch="$(gh repo view "$TARGET_REPO" --json defaultBranchRef --jq '.defaultBranchRef.name' 2>/dev/null || true)"
+  [ -n "$default_branch" ] || default_branch="main"
+
+  if [ "$AUTH_MODE" = "codex" ] && [ "$repo_visibility" = "PUBLIC" ]; then
+    warn "Target repository is public and auth mode is Codex OAuth. GitHub does not pass Actions secrets to fork PR workflows, but Codex OAuth is still not recommended for public/open-source repos."
+  fi
+
+  if gh api "repos/$TARGET_REPO/branches/$default_branch/protection" >/dev/null 2>&1; then
+    ok "Default branch protection is enabled on $default_branch"
+    if [ "$(gh api "repos/$TARGET_REPO/branches/$default_branch/protection" --jq '.required_pull_request_reviews != null' 2>/dev/null || printf 'false')" != "true" ]; then
+      warn "Default branch protection exists, but required pull request reviews were not detected. Require reviews for workflow changes before relying on secret-backed review."
+    fi
+  else
+    warn "Default branch protection was not detected on $default_branch. Protect the branch before storing Codex OAuth or provider API secrets."
+  fi
+
+  if codeowners="$(find_codeowners_content "$default_branch")"; then
+    ok "CODEOWNERS file detected"
+    if printf '%s\n' "$codeowners" | grep -Eq '(^|[[:space:]])\.github/(\*\*|workflows(/|\*\*)?)'; then
+      ok "CODEOWNERS appears to cover .github workflows"
+    else
+      warn "CODEOWNERS exists, but .github/workflows/** ownership was not detected. Add a workflow owners rule for stronger secret protection."
+    fi
+  else
+    warn "CODEOWNERS was not detected. Add CODEOWNERS for .github/workflows/** so workflow changes require trusted reviewers."
+  fi
+}
+
 verify_codex_auth_file() {
   auth_file="$1"
   [ -f "$auth_file" ] || fatal "Codex auth file not found: $auth_file. Run: codex login"
@@ -1644,6 +1716,7 @@ main() {
   info "Preset: $PRESET"
   info "Action ref: $ACTION_REF"
 
+  run_security_advisory
   setup_identity
   setup_auth
   setup_ledger_secret