The token left in the workspace

This pull request workflow installs dependencies and runs the repo's tests. Where is the extra credential?

name: ci
on: pull_request
permissions:
  contents: read
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - run: npm ci
      - run: npm test

Next puzzle in --:--:-- UTC

One try. The first answer sticks.

How to fix it

The default persist-credentials true stores a token under .git. Untrusted test code can read it. Set persist-credentials to false unless a later step needs to push.

actions/checkout authenticates to GitHub and, by default, saves that credential in the local git config so later steps can fetch. The test script in the pull request is written by the person who opened it. npm test can run anything they put in package.json. That script can read .git/config, print the token, or use it to read other repositories the token can see.

contents: read limits the damage and does not remove the file. You asked the action to persist a credential, then you executed untrusted code next to it.

Fix

- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
  with:
    persist-credentials: false

Turn it back on only in a job that pushes a tag or a commit, and do not run untrusted scripts in that job. Keep the default token permissions minimal. A test job rarely needs more than contents: read.

Sponsor this spot

Put your tool on the puzzle

One labeled card, in front of engineers who show up every day from YouTube, TikTok, and Instagram.

Advertise