security: Harden GitHub Actions workflows (#2556)

Yermanaco · web-flow · commit aba870825eb2 · 2026-02-20T12:18:23.000Z
* security: harden GitHub Actions workflows against credential exposure and fork PR attacks

* gh default token for more steps

* more gh default token

* fix: for all external repos super token is needed

* chore: use new GITHUB_TOKEN_MISTICA token with specific permissions

* final naming

* security: prevent script code injection
diff --git a/.github/workflows/ChatGPT-Reviewer.yml b/.github/workflows/ChatGPT-Reviewer.yml
@@ -6,6 +6,10 @@ permissions:
 
 on:
   pull_request:
+    types: [opened, edited]
+    branches:
+      - production
+      - pre-production
 
 concurrency:
   group: ${{ github.repository }}-${{ github.event.number || github.head_ref || github.sha }}-${{ github.workflow }}
@@ -18,7 +22,7 @@ jobs:
     steps:
       - uses: platisd/openai-pr-description@master
         with:
-          github_token: ${{ secrets.NOVUM_PRIVATE_REPOS }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
           openai_api_key: ${{ secrets.OPENAI_API_KEY }}
           sample_prompt: |
             You are a design system designer and your function is create a table with all the changes for a GitHub Pull Request in Markdown format.
diff --git a/.github/workflows/archived/stale-issues.yml b/.github/workflows/archived/stale-issues.yml
@@ -1,5 +1,9 @@
 name: "Close stale issues and PR"
 
+permissions:
+  issues: write
+  pull-requests: write
+
 on:
   schedule:
     - cron: "30 1 * * 1"
diff --git a/.github/workflows/changelog-index.yml b/.github/workflows/changelog-index.yml
@@ -14,10 +14,12 @@ on:
 jobs:
   changelog-index:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
-          token: ${{ secrets.NOVUM_PRIVATE_REPOS }}
+          persist-credentials: false
 
       - name: Get branch name
         uses: rlespinasse/github-slug-action@v3.x
@@ -33,4 +35,4 @@ jobs:
           git config user.name "github-actions"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git commit -am "update changelog"
-          git push origin ${{ env.GITHUB_REF_SLUG_URL }}
+          git push https://x-access-token:${{ secrets.GH_TOKEN_MISTICA }}@github.com/${{ github.repository }}.git ${{ env.GITHUB_REF_SLUG_URL }}
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
@@ -18,21 +18,32 @@ on:
 jobs:
   release-notes:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      RELEASE_VERSION: ${{ github.event.inputs.releaseVersion }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
-          token: ${{ secrets.NOVUM_PRIVATE_REPOS }}
+          persist-credentials: false
+
+      - name: Validate release version format
+        run: |
+          if [[ ! "$RELEASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+)?$ ]]; then
+            echo "Invalid version format. Expected: X.Y.Z or X.Y.Z-suffix"
+            exit 1
+          fi
 
       - name: Get branch name
         uses: rlespinasse/github-slug-action@v3.x
 
       - name: Create Release Notes
         uses: docker://decathlon/release-notes-generator-action:3.1.5
         env:
-          GITHUB_TOKEN: ${{ secrets.NOVUM_PRIVATE_REPOS }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           OUTPUT_FOLDER: changelog-versions
           USE_MILESTONE_TITLE: "true"
-          FILENAME_PREFIX: ${{ github.event.inputs.releaseVersion }}
+          FILENAME_PREFIX: ${{ env.RELEASE_VERSION }}
 
       # - run: sudo python3 .github/resources/changelog-index-generator.py changelog-versions
 
@@ -42,7 +53,7 @@ jobs:
           git config user.name "github-actions"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git commit -am "update changelog"
-          git push origin ${{ env.GITHUB_REF_SLUG_URL }}
+          git push https://x-access-token:${{ secrets.GH_TOKEN_MISTICA }}@github.com/${{ github.repository }}.git ${{ env.GITHUB_REF_SLUG_URL }}
 
       # - name: Upload Release Notes to Wiki
       #   uses: docker://decathlon/wiki-page-creator-action:latest
diff --git a/.github/workflows/link-checker.yml b/.github/workflows/link-checker.yml
@@ -3,14 +3,19 @@ name: Link checker
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   link-checker:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Link Checker
         id: lychee
         uses: lycheeverse/lychee-action@v1.5.1
         env:
-          GITHUB_TOKEN: ${{secrets.NOVUM_PRIVATE_REPOS_READONLY}}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/link-issue-project.yml b/.github/workflows/link-issue-project.yml
@@ -3,8 +3,13 @@ name: Add Issues to Project
 on:
   issues:
     types: [opened]
+
+permissions:
+  contents: read
+  issues: read
+
 env:
-  GITHUB_API_TOKEN: ${{ secrets.NOVUM_PRIVATE_REPOS_READONLY}}
+  GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 jobs:
   add_to_project:
diff --git a/.github/workflows/mistica-ai.yml b/.github/workflows/mistica-ai.yml
@@ -2,7 +2,7 @@ name: Mística AI Discussions
 
 permissions:
   contents: read
-  pull-requests: write
+  discussions: write
 
 on:
   discussion:
@@ -18,7 +18,7 @@ jobs:
     steps:
       - uses: platisd/openai-pr-description@master
         with:
-          github_token: ${{ secrets.NOVUM_PRIVATE_REPOS }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
           openai_api_key: ${{ secrets.OPENAI_API_KEY }}
           sample_prompt: |
             It acts as the person who will decide whether a design requirement should enter into an overall design system and complies with the following rules:
@@ -36,7 +36,7 @@ jobs:
       - name: Add comment to discussion
         run: |
           curl -X POST \
-            -H "Authorization: Bearer ${{ secrets.NOVUM_PRIVATE_REPOS }}" \
+            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
             -H "Accept: application/vnd.github.v3+json" \
             https://api.github.com/repos/{owner}/{repo}/discussions/{discussion_number}/comments \
             --data-raw '{"body": "Generated response: ${description}"}'
diff --git a/.github/workflows/open-branches.yml b/.github/workflows/open-branches.yml
@@ -5,13 +5,18 @@ on:
   schedule:
     - cron: 0 8 * * *
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   sync-figma-brand:
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@v2
@@ -28,6 +33,6 @@ jobs:
       - name: Run sync for the brand(s)
         env:
           FIGMA_TOKEN: ${{ secrets.FIGMA_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.NOVUM_PRIVATE_REPOS }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         working-directory: .github/issue-scripts
         run: python3 branch-table.py
diff --git a/.github/workflows/pending-tasks.yml b/.github/workflows/pending-tasks.yml
@@ -5,12 +5,18 @@ on:
   schedule:
     - cron: 0 8 * * *
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   pending-tasks:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout del repositorio
-        uses: actions/checkout@v2
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Configurar Python
         uses: actions/setup-python@v2
@@ -24,6 +30,6 @@ jobs:
 
       - name: Ejecutar script de búsqueda y actualizar issue
         env:
-          TOKEN: ${{ secrets.NOVUM_PRIVATE_REPOS }}
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
         working-directory: .github/issue-scripts
         run: python3 pending-tasks.py
diff --git a/.github/workflows/schema-validator.yml b/.github/workflows/schema-validator.yml
@@ -10,6 +10,9 @@ on:
       - pre-production
       - production
 
+permissions:
+  contents: read
+
 jobs:
   validate-skins:
     runs-on: ubuntu-latest
@@ -32,6 +35,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
+        with:
+          persist-credentials: false
 
       - name: Validate ${{ matrix.skin }} skin
         id: validation
diff --git a/.github/workflows/screenshot-testing.yml b/.github/workflows/screenshot-testing.yml
@@ -11,20 +11,33 @@ on:
         description: "Put Figma BranchID to generate screenshot testing"
         required: true
 
+permissions:
+  contents: write
+  pull-requests: write
+
 env:
   FIGMA_TOKEN: ${{ secrets.FIGMA_TOKEN}}
 
 jobs:
   screenshot-test:
     name: Acceptance tests
     runs-on: ubuntu-latest
+    env:
+      BRANCH_ID: ${{ github.event.inputs.branchID }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
+
+      - name: Validate branch ID format
+        run: |
+          if [[ ! "$BRANCH_ID" =~ ^[a-zA-Z0-9_-]+$ ]]; then
+            echo "Invalid branch ID format. Only alphanumeric, dash and underscore allowed."
+            exit 1
+          fi
 
       - name: Checkout branch or create new one
         run: |
           git fetch
-          if git branch -a | grep origin/acceptance-tests; then
+          if git branch -a | grep "origin/acceptance-tests"; then
               git checkout acceptance-tests
           else
               git checkout -b acceptance-tests
@@ -60,14 +73,14 @@ jobs:
       - name: Checkout branch or create new one
         run: |
           git fetch
-          if git branch -a | grep origin/${{ github.event.inputs.branchID }}; then
-              git checkout ${{ github.event.inputs.branchID }}
+          if git branch -a | grep "origin/$BRANCH_ID"; then
+              git checkout "$BRANCH_ID"
           else
-              git checkout -b ${{ github.event.inputs.branchID }}
+              git checkout -b "$BRANCH_ID"
           fi
 
       - name: Export new screenshots
-        run: npx -p @figma-export/cli -p @figma-export/output-components-as-svg figma-export components ${{ github.event.inputs.branchID }} -O @figma-export/output-components-as-svg
+        run: npx -p @figma-export/cli -p @figma-export/output-components-as-svg figma-export components "$BRANCH_ID" -O @figma-export/output-components-as-svg
 
       - name: convert-svg2png
         run: |
@@ -79,14 +92,14 @@ jobs:
           git config user.name "github-actions"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add .
-          git commit -m "Screenshot tests from ${{ github.event.inputs.branchID }}"
-          git push origin ${{ github.event.inputs.branchID }}
+          git commit -m "Screenshot tests from $BRANCH_ID"
+          git push origin "$BRANCH_ID"
 
       - name: Create Pull-Request
         uses: repo-sync/pull-request@v2
         with:
-          source_branch: ${{ github.event.inputs.branchID }}
+          source_branch: ${{ env.BRANCH_ID }}
           destination_branch: "acceptance-tests"
-          pr_title: "Acceptance tests for ${{ github.event.inputs.branchID }} file"
+          pr_title: "Acceptance tests for ${{ env.BRANCH_ID }} file"
           pr_draft: true
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/sync-design-tokens.yml b/.github/workflows/sync-design-tokens.yml
@@ -1,4 +1,5 @@
 name: Sync design tokens
+
 on:
   workflow_dispatch:
     inputs:
@@ -12,37 +13,66 @@ on:
         required: false
         default: false
 
+permissions:
+  contents: read
+
 jobs:
   sync-design-tokens:
     runs-on: ubuntu-latest
+    env:
+      REF_INPUT: ${{ github.event.inputs.ref }}
+      DRAFT_INPUT: ${{ github.event.inputs.draft }}
     steps:
+      - name: Validate ref format
+        run: |
+          if [[ ! "$REF_INPUT" =~ ^[a-zA-Z0-9/_.-]+$ ]]; then
+            echo "Invalid ref format. Only alphanumeric, slash, dash, dot and underscore allowed."
+            exit 1
+          fi
+
       # https://docs.github.com/en/rest/actions/workflows?apiVersion=2022-11-28#create-a-workflow-dispatch-event
       - name: Trigger mistica-web repo workflow
         run: |
+          PAYLOAD=$(jq -n \
+            --arg ref "master" \
+            --argjson draft "$DRAFT_INPUT" \
+            --arg input_ref "$REF_INPUT" \
+            '{"ref": $ref, "inputs": {"draft": $draft, "ref": $input_ref}}')
+
           curl -L -f \
               -X POST \
-              -H "Authorization: Bearer ${{ secrets.NOVUM_PRIVATE_REPOS }}" \
+              -H "Authorization: Bearer ${{ secrets.GH_TOKEN_MISTICA }}" \
               -H "X-GitHub-Api-Version: 2022-11-28" \
               -H "Accept: application/vnd.github+json" \
               https://api.github.com/repos/telefonica/mistica-web/actions/workflows/import-design-tokens.yml/dispatches \
-              --data '{"ref": "master", "inputs": {"draft": ${{github.event.inputs.draft}}, "ref": "${{github.event.inputs.ref}}"}}'
+              --data "$PAYLOAD"
 
       - name: Trigger mistica-ios repo workflow
         run: |
+          PAYLOAD=$(jq -n \
+            --arg ref "main" \
+            --arg input_ref "$REF_INPUT" \
+            '{"ref": $ref, "inputs": {"ref": $input_ref}}')
+
           curl -L -f \
               -X POST \
-              -H "Authorization: Bearer ${{ secrets.NOVUM_PRIVATE_REPOS }}" \
+              -H "Authorization: Bearer ${{ secrets.GH_TOKEN_MISTICA }}" \
               -H "X-GitHub-Api-Version: 2022-11-28" \
               -H "Accept: application/vnd.github+json" \
               https://api.github.com/repos/telefonica/mistica-ios/actions/workflows/generate-mistica-tokens.yml/dispatches \
-              --data '{"ref": "main", "inputs": {"ref": "${{github.event.inputs.ref}}"}}'
+              --data "$PAYLOAD"
 
       - name: Trigger mistica-android repo workflow
         run: |
+          PAYLOAD=$(jq -n \
+            --arg ref "main" \
+            --arg input_ref "$REF_INPUT" \
+            '{"ref": $ref, "inputs": {"ref": $input_ref}}')
+
           curl -L -f \
               -X POST \
-              -H "Authorization: Bearer ${{ secrets.NOVUM_PRIVATE_REPOS }}" \
+              -H "Authorization: Bearer ${{ secrets.GH_TOKEN_MISTICA }}" \
               -H "X-GitHub-Api-Version: 2022-11-28" \
               -H "Accept: application/vnd.github+json" \
               https://api.github.com/repos/telefonica/mistica-android/actions/workflows/import-design-tokens.yml/dispatches \
-              --data '{"ref": "main", "inputs": {"ref": "${{github.event.inputs.ref}}"}}'
+              --data "$PAYLOAD"
diff --git a/.github/workflows/sync-figma-tokens.yml b/.github/workflows/sync-figma-tokens.yml
diff --git a/.github/workflows/tokens-pr.yml b/.github/workflows/tokens-pr.yml
