Downgrade cross-repo PAT to GITHUB_TOKEN for public read-only checkout#652
Open
CodeOpsAI wants to merge 1 commit into
Open
Downgrade cross-repo PAT to GITHUB_TOKEN for public read-only checkout#652CodeOpsAI wants to merge 1 commit into
CodeOpsAI wants to merge 1 commit into
Conversation
This PR addresses 2 workflow findings: - [medium] permissions-missing in .github/workflows/pull-web-client.yml: Grant contents and pull-requests write for PR creation/merge - [high] pat-cross-repo in .github/workflows/pull-web-client.yml: Cross-repo PAT used for checkout These workflows handle CI/CD with elevated privileges; the affected configurations expand attack surface or grant tokens broader access than needed. See the PR description for per-finding rationale and citations.
CodeOpsAI
changed the title
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
About codeopsai
codeopsai analyzes public GitHub Actions workflows for security and reliability issues and opens fixes for maintainer review. Every PR carries citations to the relevant standard (CWE, GitHub docs) and a structural verification trail; if our evidence bar isn't met, we don't open the PR.
Mistake, or unwelcome? Comment here or open an issue at github.com/codeopsai/feedback. We read every one and adjust.
🔴
pat-cross-repo·update-web-clientWhy downgrade this token.
Checkout Web Client repositoryuses${{ secrets.PRIVATE_REPO_PAT }}to readMacro-Deck-App/Macro-Deck-Client-App(a public repository). The PAT carries the union of its owner's repository permissions — almost always broader than this single read requires.GITHUB_TOKENis workflow-scoped, ephemeral, and gives the same 5000/hr rate-limit ceiling for authenticated reads on public data — the strictly-safer credential.Reference: CWE-1392 · GitHub/OWASP guidance · Real-world precedent: tj-actions/changed-files supply-chain attack (CVE-2025-30066, Mar 2025) — exfiltrated PATs
Evidence & diff
AI-generated. Review the diff before merging.