Repository navigation
ci: gate TA signing workflow against fork PRs - #46
Merged
Merged
Conversation
Add an explicit same-repo guard to the `ta` job so fork PRs cannot reach the id-token: write signing job, instead of relying on GitHub's implicit fork token downgrade. Remove the OIDC-claims and AWS_ROLE debug steps from the sign job. Refs ORBS-1702.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the TA signing CI workflow by making the “same-repo only” boundary explicit for OIDC (id-token: write) usage, and by removing OIDC/AWS-secret diagnostic output from the signing workflow.
Changes:
- Add a job-level
ifguard indefault.yamlto skip thetareusable-workflow job for fork-basedpull_requestevents. - Remove OIDC-claims printing and AWS secret-presence echo steps from the
signjob inta.yaml.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/ta.yaml | Removes OIDC/AWS debug steps from the signing job to reduce sensitive workflow instrumentation. |
| .github/workflows/default.yaml | Adds an explicit same-repo gate so fork PRs can’t invoke the OIDC-enabled TA signing workflow job. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
BulatAbuzarov
enabled auto-merge (squash)
September 22, 2026 09:34
BulatAbuzarov
approved these changes
Sep 22, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pull_request_targettrigger, while preserving manual runs.anyhowminimum and lockfile to 1.0.103 to clear RUSTSEC-2026-0190.Why
HackerOne report #3718053 identified PR-controlled code execution inside the OIDC-enabled signing job. The original assessment found that GitHub's fork-token restrictions blocked the reported path. The explicit guard skips ordinary fork runs and covers both
pull_requestandpull_request_targetevent names.GitHub's fork-token restrictions remain required:
pull_requestloads PR-controlled workflow definitions, so a fork can edit this guard. It is defense in depth, not an independent authorization boundary. Changes to triggers or fork privileges require a separate review of the trusted signing entrypoint and AWS trust policy.Linear: ORBS-1702
Test plan
pull_request_target(7 cases).anyhowdependency.git diff --check.1c9e089: all 17 checks pass, including TA build, stage signing, packaging, and Cargo Deny.