Add use-pr-linker workflow to auto-link PRs to issues - #1087
Conversation
WalkthroughA GitHub Actions workflow file is added to automatically link pull requests to issues. The workflow triggers on PR lifecycle events, applies minimal permissions, and delegates to an external reusable workflow from the kattu repository, passing the ChangesPR-to-Issue Linking Workflow
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Signed-off-by: Ivanmeneges <ivan.anil016@gmail.com>
d21a9a8 to
41a101f
Compare
Signed-off-by: Ivanmeneges <ivan.anil016@gmail.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/use-pr-linker.yml:
- Line 19: Replace the floating reference "uses:
mosip/kattu/.github/workflows/link-pr-to-issue.yml@develop" with a pinned commit
SHA: fetch the current commit SHA for mosip/kattu develop (e.g. via git
ls-remote or GitHub UI), then update the line to "uses:
mosip/kattu/.github/workflows/link-pr-to-issue.yml@<COMMIT_SHA>" so the workflow
references a specific immutable commit; commit that change and open a PR to
deliberately update the SHA in future.
- Around line 4-10: The workflow currently runs on pull_request_target and
forwards secrets.ACTION_PAT into the reusable workflow which parses
github.event.pull_request.title/body to determine a target repo (allowing fork
PRs to cause writes elsewhere); change the execution to avoid exposing
ACTION_PAT by either (A) switching the caller to use pull_request and the
default GITHUB_TOKEN instead of secrets.ACTION_PAT if cross-repo writes are not
required, or (B) add strict validation inside the reusable workflow
(link-pr-to-issue.yml) so the extracted owner/repo from
github.event.pull_request.title/body is only allowed if it equals
github.repository (or an explicit allowlist) and otherwise aborts without
calling the API; implement the chosen mitigation by updating the caller workflow
triggers (replace pull_request_target with pull_request) or by adding the
allowlist check around the code that parses the PR body and calls the GitHub API
(the logic that uses ACTION_PAT and creates/updates/deletes issue comments).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 3634a1e2-688d-454a-a301-6d667c41b7a0
📒 Files selected for processing (1)
.github/workflows/use-pr-linker.yml
| pull_request_target: | ||
| types: | ||
| - opened | ||
| - edited | ||
| - synchronize | ||
| - reopened | ||
| - closed |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Fetch and examine the external workflow to verify it doesn't execute untrusted code
# Fetch the external workflow file
curl -s https://raw.githubusercontent.com/mosip/kattu/develop/.github/workflows/link-pr-to-issue.ymlRepository: mosip/mosip-compliance-toolkit
Length of output: 9683
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the caller workflow to understand how pull_request_target is used and how the reusable workflow is invoked.
sed -n '1,200p' .github/workflows/use-pr-linker.ymlRepository: mosip/mosip-compliance-toolkit
Length of output: 440
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Also fetch the referenced external reusable workflow file (already fetched once, but this ensures we capture any headers or missing sections).
curl -s https://raw.githubusercontent.com/mosip/kattu/develop/.github/workflows/link-pr-to-issue.yml | sed -n '1,200p'Repository: mosip/mosip-compliance-toolkit
Length of output: 6333
Reassess pull_request_target: reusable workflow writes issue comments based on untrusted PR body.
.github/workflows/use-pr-linker.ymlruns onpull_request_targetand passessecrets.ACTION_PATintomosip/kattu/.github/workflows/link-pr-to-issue.yml@develop.- The reusable workflow doesn’t check out PR code, but it parses
${{ github.event.pull_request.title }}/${{ github.event.pull_request.body }}to extractowner/repo#numberand then usesACTION_PATto create/update/delete issue comments via the GitHub API. - With
pull_request_target, fork PRs can influence where the workflow writes; ifACTION_PAThas access beyond the base repo, crafting PR text can cause comment writes/deletions to other repos (and later cleanup onedited). - Mitigate by restricting extracted issue references to an allowlist (e.g., only
github.repository) and/or re-evaluating whetherpull_request+GITHUB_TOKENcan be used if cross-repo linking isn’t required.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 3-10: use of fundamentally insecure workflow trigger (dangerous-triggers): pull_request_target is almost always used insecurely
(dangerous-triggers)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/use-pr-linker.yml around lines 4 - 10, The workflow
currently runs on pull_request_target and forwards secrets.ACTION_PAT into the
reusable workflow which parses github.event.pull_request.title/body to determine
a target repo (allowing fork PRs to cause writes elsewhere); change the
execution to avoid exposing ACTION_PAT by either (A) switching the caller to use
pull_request and the default GITHUB_TOKEN instead of secrets.ACTION_PAT if
cross-repo writes are not required, or (B) add strict validation inside the
reusable workflow (link-pr-to-issue.yml) so the extracted owner/repo from
github.event.pull_request.title/body is only allowed if it equals
github.repository (or an explicit allowlist) and otherwise aborts without
calling the API; implement the chosen mitigation by updating the caller workflow
triggers (replace pull_request_target with pull_request) or by adding the
allowlist check around the code that parses the PR body and calls the GitHub API
(the logic that uses ACTION_PAT and creates/updates/deletes issue comments).
|
|
||
| jobs: | ||
| call-linker: | ||
| uses: mosip/kattu/.github/workflows/link-pr-to-issue.yml@develop |
There was a problem hiding this comment.
Pin the workflow reference to a commit hash instead of @develop.
Referencing the external workflow with @develop instead of a commit hash creates a security and stability risk. The external workflow could be modified maliciously or unintentionally, and changes would automatically propagate to this repository without review.
Best practice is to pin to a specific commit SHA and update it deliberately through PRs.
🔒 Recommended approach
-
Find the current commit SHA of the workflow on the develop branch:
git ls-remote https://github.com/mosip/kattu.git develop
-
Update the reference to use the commit hash:
- uses: mosip/kattu/.github/workflows/link-pr-to-issue.yml@develop + uses: mosip/kattu/.github/workflows/link-pr-to-issue.yml@<commit-sha>
-
Establish a process to periodically review and update the pinned reference.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 19-19: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/use-pr-linker.yml at line 19, Replace the floating
reference "uses: mosip/kattu/.github/workflows/link-pr-to-issue.yml@develop"
with a pinned commit SHA: fetch the current commit SHA for mosip/kattu develop
(e.g. via git ls-remote or GitHub UI), then update the line to "uses:
mosip/kattu/.github/workflows/link-pr-to-issue.yml@<COMMIT_SHA>" so the workflow
references a specific immutable commit; commit that change and open a PR to
deliberately update the SHA in future.
1 participant
Summary
Adds
use-pr-linker.ymlworkflow that calls the reusable PR-to-issue linker frommosip/kattu(@develop).Notes
ACTION_PATrepository secret to be configured.develop.Summary by CodeRabbit