mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-07-31 04:12:13 +03:00
1e2d6f6081
The resolve-conflicts job runs on issue_comment, a privileged trigger: it holds GITHUB_TOKEN, the Claude OAuth token and the push PAT, and it checks out fork code with `gh pr checkout`. The only gate was that the commenter is the repository owner, which says nothing about the code that ends up in the workspace. A contributor could force-push to the pull request head between the owner asking for the merge and the runner fetching it, so the owner reviews one tree and the job runs another. Verify before anything is checked out that the head repository was last pushed to before the triggering comment was written, and refuse the run otherwise. Pin the head SHA reported by that check and abort if the commit `gh pr checkout` lands on differs, which closes the remaining window between the check and the fetch. Require author_association to be OWNER alongside the existing login comparison. This also clears CodeQL actions/untrusted-checkout/high, which for issue_comment triggers demands both an actor/association check and a comment-vs-head-date check dominating the checkout.