mirror of
https://github.com/pezkuwichain/pezkuwi-subquery.git
synced 2026-10-20 18:56:24 +00:00
SatoshiQaziMuhammed
dfa2527451
auto-merge.yml interpolated ${{ github.event.workflow_run.head_branch }} straight into a run script that holds a contents:write token. A fork pull request controls that branch name, so it could run commands with write access (CodeQL actions/code-injection/critical). It now arrives as an environment variable.
ci.yml, code-quality.yml and deploy.yml get permissions: contents: read; none of them writes through GITHUB_TOKEN.
57 lines
1.7 KiB
YAML
57 lines
1.7 KiB
YAML
name: Auto Merge
|
|
|
|
on:
|
|
workflow_run:
|
|
workflows: ["CI"]
|
|
types: [completed]
|
|
|
|
jobs:
|
|
auto-merge:
|
|
runs-on: ubuntu-latest
|
|
if: >
|
|
github.event.workflow_run.conclusion == 'success' &&
|
|
github.event.workflow_run.event == 'pull_request'
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
steps:
|
|
- name: Find and merge master → main PR
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
# Through the environment, never interpolated into the script: a fork's
|
|
# branch name is attacker-chosen and would run with this job's write token.
|
|
HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
|
|
run: |
|
|
echo "Workflow ran on branch: $HEAD_BRANCH"
|
|
|
|
if [ "$HEAD_BRANCH" != "master" ]; then
|
|
echo "Not a master branch PR, skipping"
|
|
exit 0
|
|
fi
|
|
|
|
PR_NUMBER=$(gh pr list \
|
|
--repo "$GITHUB_REPOSITORY" \
|
|
--base main \
|
|
--head master \
|
|
--state open \
|
|
--json number \
|
|
--jq '.[0].number')
|
|
|
|
if [ -z "$PR_NUMBER" ]; then
|
|
echo "No open PR from master to main found, skipping"
|
|
exit 0
|
|
fi
|
|
|
|
# CI finishing does not mean every required check has: Code Quality,
|
|
# Security and CodeQL may still be running. Merge now if the branch
|
|
# rules allow it, otherwise let GitHub merge once they pass.
|
|
echo "Merging PR #$PR_NUMBER"
|
|
gh pr merge "$PR_NUMBER" \
|
|
--repo "$GITHUB_REPOSITORY" \
|
|
--merge \
|
|
--delete-branch=false \
|
|
|| gh pr merge "$PR_NUMBER" \
|
|
--repo "$GITHUB_REPOSITORY" \
|
|
--merge \
|
|
--auto
|