Skip to content

[SECURITY] Add contributor identity validation to prevent duplicate or mismatched contributor records #65

@niy-ati

Description

@niy-ati

Bug Description

The current contribution process allows contributor information to be manually supplied without automated validation which can lead to :

  1. Duplicate contributor entries.
  2. Username mismatches.
  3. Incorrect attribution.
  4. Data integrity issues.

Current Behavior

Contributor information is accepted without validation against the PR author.

proposed solution

Implement a GitHub Action that:

  1. Retrieves PR author information.
  2. Validates submitted GitHub usernames.
  3. Detects duplicates.
  4. Rejects malformed contributor entries.

Steps To Reproduce

Scenario 1: Mismatched GitHub Username

  1. Fork the repository.
  2. Create a new branch.
  3. Modify the contributor section by adding an entry using a GitHub username that does not belong to the contributor submitting the PR.
  4. Fill out the Pull Request template and provide a different GitHub username in the "GitHub Profile" field.
  5. Submit the Pull Request.

Expected Behavior

The workflow should automatically verify that:

  1. The submitted GitHub username matches the Pull Request author.
  2. Contributor information is valid before review.

Screenshots or Additional Context

Benefits

Preserves contributor data integrity.
Prevents duplicate records.
Improves automation reliability.

Impact Level

Level 3 – Security / Integrity Issue

Files Potentially Affected

.github/workflows/*
PULL_REQUEST_TEMPLATE.md
README.md
CONTRIBUTORS.md

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions