From dfa252745125a9a3d8dc513a492b278e285b21cb Mon Sep 17 00:00:00 2001
From: SatoshiQaziMuhammed <info@pezkuwichain.io>
Date: Tue, 20 Oct 2026 22:52:09 +0400
Subject: [PATCH] fix(ci): pass workflow_run head_branch through env; read-only
 tokens (#35)

auto-merge.yml interpolated ${{ github.event.workflow_run.head_branch }} straight into a run script that holds a contents:write token. A fork pull request controls that branch name, so it could run commands with write access (CodeQL actions/code-injection/critical). It now arrives as an environment variable.

ci.yml, code-quality.yml and deploy.yml get permissions: contents: read; none of them writes through GITHUB_TOKEN.
---
 .github/workflows/auto-merge.yml   | 4 +++-
 .github/workflows/ci.yml           | 5 +++++
 .github/workflows/code-quality.yml | 5 +++++
 .github/workflows/deploy.yml       | 5 +++++
 4 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 7bf56bb..67e5a74 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -18,8 +18,10 @@ jobs:
       - name: Find and merge master → main PR
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Through the environment, never interpolated into the script: a fork's
+          # branch name is attacker-chosen and would run with this job's write token.
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
         run: |
-          HEAD_BRANCH="${{ github.event.workflow_run.head_branch }}"
           echo "Workflow ran on branch: $HEAD_BRANCH"
 
           if [ "$HEAD_BRANCH" != "master" ]; then
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a190558..b2db091 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,11 @@ on:
   pull_request:
     branches: [main]
 
+
+# Read-only token: these jobs never write through GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index 34e843b..dd17ce1 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -6,6 +6,11 @@ on:
   pull_request:
     branches: [main]
 
+
+# Read-only token: these jobs never write through GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: ESLint
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 03c267a..e0a541e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -18,6 +18,11 @@ on:
 env:
   SUBQL_ACCESS_TOKEN: ${{ secrets.SUBQL_ACCESS_TOKEN }}
 
+
+# Read-only token: these jobs never write through GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   deploy-pezkuwi:
     if: ${{ github.event_name == 'release' || github.event.inputs.project == 'all' || github.event.inputs.project == 'pezkuwi' }}