ci: replace pull_request_target fork CI with rotating public token - #4298
Open
mfazekas wants to merge 2 commits into
Open
ci: replace pull_request_target fork CI with rotating public token#4298mfazekas wants to merge 2 commits into
mfazekas wants to merge 2 commits into
Conversation
…tated token actions/checkout v4.4.0+ refuses to check out fork PR code from pull_request_target workflows (pwn-request hardening). Instead of opting into the unsafe checkout, drop the privileged fork workflow entirely: fork PRs now run the regular pull_request CI, falling back to a public rotatable Mapbox token fetched from rnmapbox/ci-config when secrets are unavailable. The Mapbox SDK download no longer requires a secret token, so the only token needed is the semi-public runtime access token.
…pbox/ci-config The token is public by design (any fork PR could print it); obfuscation only keeps it out of secret scanners. Rotation 2x/week in ci-config is the actual defense. Obfuscation key is versioned (v1) so it can be rotated by bumping the URL/key in scripts/ci/fetch-mapbox-token.sh.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
actions/checkout v4.4.0+ refuses to check out fork PR code from
pull_request_targetworkflows (pwn-request hardening), which brokeci-for-forked-repos.yml. Rather than opting into the unsafe checkout, this removes that workflow entirely.Fork PRs now run the native builds through the regular
pull_requesttrigger inon-push.yml, like any other CI job. They get no repo secrets, soMAPBOX_ACCESS_TOKENfalls back to a token fetched and decoded viascripts/ci/fetch-mapbox-token.shfrom rnmapbox/ci-config. That token is public by design (any fork PR could print whatever token CI uses anyway); the obfuscation only keeps it out of secret scanners, and the real defense is automatic rotation twice a week plus minimal read-only scopes. See the ci-config README for the full design.Checklist
CONTRIBUTING.mdyarn generatein the root folder — N/A, CI workflow change only/exampleapp. — N/A, CI infra change; verified via live GitHub Actions runs of the rotate workflow and the fetch script against the published token/example) — N/AScreenshot OR Video
N/A — CI configuration change, no UI impact.
Component to reproduce the issue you're fixing
N/A — not a bug fix; see linked ci-config repo for the rotation design.