Why does this action restrict the workflow name to `autofix.ci`?

[suzuki-shunsuke]

This action restricts the workflow name to autofix.ci for security reasons.

https://github.com/autofix-ci/action/blob/ff86a557419858bb967097bfc916833f5647fa8c/index.ts#L18-L20

But I'm not sure the meaning of this restriction. Could you explain more details? What threat do you assume?

Thank you.

[mhils]

What threat do you assume?

Consider a user that has two workflows: autofix.ci and compromisedWorkflow. We have an attacker with RCE in compromisedWorkflow, but compromisedWorkflow is locked down to permissions: contents: read. The autofix.ci workflow is safe and not controlled by the attacker.

In this scenario, an attacker could use compromisedWorkflow to upload an autofix artifact and manually POST https://api.autofix.ci/fix, which would allow them to add a malicious fix commit = escalate privileges. To mitigate against this, we enforce that the autofix workflow must have a particular name. This server-side check is replicated in the client-side action to provide immediate feedback (otherwise we would need to use a check run here, too).

Thank you for asking really good questions, please keep them coming! :) I will add some of what I wrote to https://autofix.ci/security. :)

[suzuki-shunsuke]

Ah, I see. Thank you for your explanation. Even if scripts, actions, or tools used in workflows are compromised, malicious code can't push commits via this app in workflows other than autofix.ci because other workflows can't upload the artifact autofix.ci to the workflow autofix.ci.