search

github / privileged-requester

Privileged Requester Action
MIT License
15 stars 2 forks source link

Can I add myself to `privileged-requester.yaml` or set `commitVerification: false` in the PR and get auto approved/impersonate? #177

Open lawrencegripper opened 3 weeks ago

lawrencegripper commented 3 weeks ago

Sorry if there is a mitigation in here I've missed, wanted to validate if this was possible.

Is it possible, for example, to edit the privileged-requester.yaml file in the PR where I make my changes so that it includes my user as a privileged requestor?

In a similar issue to the one @nobe4 mentioned :point_down: , could I set commitVerification to false in the branch to allow impersonation and then push as the bot user with unsigned commits?

I think these would be mitigated by reading the configuration from the default branch rather than from the PR branch but I'm not sure how to work that with

GrantBirki commented 3 weeks ago

👋 Hey @lawrencegripper! Here are some of the answers to which you seek

Is it possible, for example, to edit the privileged-requester.yaml file in the PR where I make my changes so that it includes my user as a privileged requestor?

The method that fetches the privileged-requester config looks at the main branch by default.

In a similar issue to the one @nobe4 mentioned 👇 , could I set commitVerification to false in the branch to allow impersonation and then push as the bot user with unsigned commits?

I do believe that this would be possible due to the nature in which Actions works. Perhaps a safer option would be to include it in the config that lives on the main branch and inform the Action to always read from there rather than from its own config that can be altered on PRs?

lawrencegripper commented 3 weeks ago

The method that fetches the privileged-requester config looks at the main branch by default.

Ah nice :heart:

I do believe that this would be possible due to the nature in which Actions works.

Yeah this is the route we try and use on Heaven when reading configuration that is enforcing/permissions related, we try and always read from the main branch. It's not always possible tho and sometimes we dont' get it right.

GrantBirki commented 3 weeks ago

IMO we need to update this Action with a new major version (breaking change) that ensures all config options related to security live on the main branch outside of the Action's config