fix(ci): patch shell injection and unsafe pull_request_target#32
Open
stevefulme1 wants to merge 4 commits intoredhat-cop:mainfrom
Open
fix(ci): patch shell injection and unsafe pull_request_target#32stevefulme1 wants to merge 4 commits intoredhat-cop:mainfrom
stevefulme1 wants to merge 4 commits intoredhat-cop:mainfrom
Conversation
Adds .gitleaks.toml with custom rules for Ansible-specific credential patterns (OpenShift API keys, Automation Hub tokens, container registry passwords) and allowlists for placeholder values and Jinja2 templates. Adds a GitHub Actions workflow to run Gitleaks on pushes and PRs. Resolves: MFG-376 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add allowlists for docsible-generated README.md variable documentation (HTML bold tags), multi-line YAML block scalars (>- / |) where values are Jinja2 templates on the following line, and task files that reference credential variable names without containing actual secrets. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sends alerts to Slack channel on PR open, close, merge, reopen, and review events. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove pull_request_target trigger from gitleaks workflow to prevent untrusted PR code from running with write permissions. Move GitHub context interpolation from run: blocks to env: variables in Slack notifications to prevent shell injection via crafted PR titles. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
stevefulme1
requested a deployment
to
external-ci
GitHub Actions
Waiting
spyrexd
reviewed
Apr 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pull_request_targettrigger that checked out untrusted PR code with repo write permissions. Thepull_requesttrigger already covers same-repo PRs safely.PR title,user login,review state) from inline${{ }}interpolation inrun:steps toenv:block variables, preventing shell injection via crafted PR titles.Both vulnerabilities were identified by Semgrep static analysis:
pull-request-target-code-checkout(ERROR)run-shell-injection(ERROR)Test plan
pushandpull_requestto main🤖 Generated with Claude Code