Symlink in repo seems to generate false positives for Dangerous Workflow policy in v4.4

[pburkholder]

Hi -- In the last week we started getting AllStar findings like this:

Error while running checks.DangerousWorkflow: internal error: error during ListFiles: error walking the path "/home/vcap/tmp/allstar623027289": stat /home/vcap/tmp/allstar623027289/meteor/.cfignore: no such file or directory

see https://github.com/cloud-gov/product/issues/3292

I've been able to reproduce this by building v4.4 and running:

./allstar -once -repo cloud-gov/cf-hello-worlds -policy "Dangerous Workflow"
{"severity":"WARNING","org":"cloud-gov","repo":"cf-hello-worlds","area":"Dangerous Workflow","error":"internal error: error during ListFiles: error walking the path \"/Users/peterdburkholder/tmp/allstar2379061765\": stat /Users/peterdburkholder/tmp/allstar2379061765/meteor/.cfignore: no such file or directory","time":"2025-05-30T18:34:07-04:00","message":"Error while running checks.DangerousWorkflow"}

Indeed, the file meteor/.cfconfig was a symlink 10 years ago: https://github.com/cloud-gov/cf-hello-worlds/tree/089391cfc6cb30fc5044a0f931771747063b6d54/meteor

When I checkout v4.3 I don't get the error.

Is that enough info to help track this down? Thanks!

[pburkholder]

git bisect narrowed this down to commit 1a41570

[pburkholder]

We eliminated the issue locally by deleting stale branches, and I have not been able to recreate it by adding a symlink to a new branch (e.g. https://github.com/cloud-gov/cf-hello-worlds/tree/pb/symlink-test/go-hello). Not sure why a branch from 10 years ago was treated differently from one today.

[pburkholder]

I couldn't let this rest. In https://github.com/cloud-gov/cf-hello-worlds/, I created a new branch with git cherry-pick 089391cfc6cb30fc5044a0f931771747063b6d54 and I was able reproduce this bug again.

[jeffmendoza]

Thanks for reporting and doing the analysis.
Just to confirm, we are logging a warning, but Allstar continues to check all other repos?

I'll try to reproduce with Scorecard directly and isolate the issue there.

[jeffmendoza]

The recent change is that Allstar is now running the Scorecard Dangerous Workflow check on all branches, not just main.
#569

You can use the branchList: default config to only scan the default branch.
https://pkg.go.dev/github.com/ossf/allstar/pkg/policies/workflow#OrgConfig

[jeffmendoza]

Opened: ossf/scorecard#4654