mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-18 21:22:28 +03:00
c2821e670c
CodeQL raised actions/artifact-poisoning/critical on the `next-build` fast path this PR builds on (#8941). The finding is real and it sits on the path that produces the published npm tarball. The step picks a CI run by querying the runs API for `head_sha` and filtering on `name == "CI" and conclusion == "success"`. That query also returns `pull_request` runs from FORKS: they execute in this repository's context and upload their own `next-build`, built from fork-controlled source. Measured today, 57 runs in this repo have a `head_repository` other than the repo itself. So the selection trusted bytes by coincidence of commit SHA — anything that made a fork's head commit coincide with the publish commit could put attacker-built bytes on npm. Adds `and .head_repository.full_name == env.REPO` to the selection. Provenance is now explicit; `head_sha` still carries tree-equality. Verified against the live API using the expression extracted from the workflow itself — the same single run (30518663668) is selected either way for the current tip, so the fast path keeps working while every fork run is excluded. Not a dismissal (hard rule #14) — the clause removes the flagged trust. node --import tsx/esm --test tests/unit/npm-publish-artifact-provenance.test.ts # 3 pass, 0 fail (base: 2 pass, 1 fail)