fix(ci): stop checking out event-controlled refs in privileged workflows (#1738)

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Author: FelixTJDietrich

.github/workflows/openapi-autocommit.yml

@@ -1,7 +1,7 @@
 name: API
 
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers] PR code runs only in the read-only generate job.
+  pull_request:
     branches: [main]
     types: [labeled]
 
@@ -14,6 +14,7 @@ concurrency:
 jobs:
   generate:
     name: Generate spec and client
+    # A fork's token is read-only, so nothing could be pushed back; skip the whole run.
     if: >-
       ${{ github.event.label.name == 'autocommit-openapi'
         && github.event.pull_request.head.repo.full_name == github.repository }}
@@ -36,7 +37,6 @@ jobs:
         with:
           distribution: temurin
           java-version: 21
-      # This executes PR-controlled Maven plugins, so this job must remain read-only and secretless.
       - name: Generate OpenAPI spec and client
         run: pnpm run generate:api
       - name: Upload generated files
@@ -59,7 +59,7 @@ jobs:
     outputs:
       changed: ${{ steps.commit.outputs.changed }}
     steps:
-      # Do not execute files from the checkout or artifact in this job.
+      # Holds the write token: nothing from the checkout or artifact is executed here.
       - name: Checkout PR commit
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/release.yml

@@ -43,10 +43,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          # Pin to the exact commit CI/CD built — never main's tip, which may
-          # already carry a newer version bump (that would skip this release).
-          ref: ${{ github.event.workflow_run.head_sha }}
+          ref: ${{ github.sha }}
           fetch-depth: 0
+          persist-credentials: false
 
       # Decides whether this commit cuts a release, and creates nothing.
       # The draft is created in tag-images, after the evidence gate, so a gate failure leaves no
@@ -62,6 +61,10 @@ jobs:
         run: |
           set -euo pipefail
 
+          # Read the commit CI/CD built, not main's tip, which may already carry a newer version bump.
+          git merge-base --is-ancestor "$SHA" origin/main || {
+            echo "::error::Commit $SHA is not on main"; exit 1; }
+
           VERSION=$(git show "$SHA:package.json" | jq -r .version)
           PARENT_VERSION=$(git show "${SHA}^:package.json" | jq -r .version)
           TAG="v$VERSION"
@@ -141,6 +144,7 @@ jobs:
         with:
           ref: ${{ needs.release.outputs.sha }}
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Log in to GitHub Container Registry
         uses: ./.github/actions/ghcr-login

scripts/ci-contract.test.ts

@@ -562,6 +562,23 @@ void describe("CI contract", () => {
 		assert.doesNotMatch(source, /pull_request\.title|github\.head_ref/);
 	});
 
+	void test("checks out no ref taken straight from a pull_request_target or workflow_run event", async () => {
+		// Scorecard's Dangerous-Workflow rule, checked here because Scorecard itself runs only after merge.
+		for (const [file, source] of await workflowSources()) {
+			if (!/^ {2}(?:pull_request_target|workflow_run):/m.test(source)) continue;
+			assert.doesNotMatch(
+				source,
+				/^ +ref:.*github\.event\.(?:pull_request|workflow_run)/m,
+				`${file} checks out a ref taken from the triggering event`,
+			);
+		}
+		// The release jobs check out the run's commit through an output; this is what makes it safe.
+		assert.match(
+			job(await readFile(".github/workflows/release.yml", "utf8"), "release"),
+			/git merge-base --is-ancestor "\$SHA" origin\/main/,
+		);
+	});
+
 	void test("never invokes a repository-local action before checkout", async () => {
 		for (const [file, source] of await workflowSources()) {
 			for (const jobSource of source.split(/^ {2}(?=[A-Za-z][\w-]*:\s*$)/m).slice(1)) {