From 6324144f61be027982c95ed806fc78e9be84cf14 Mon Sep 17 00:00:00 2001 From: evilgensec Date: Tue, 14 Jul 2026 21:37:46 +0545 Subject: [PATCH] ci: restrict credentialed Custard test job to trusted refs The test job in custard-run.yaml runs on the workflow_run event in the base-repository context with id-token: write and authenticates to Google Cloud as kokoro-system-test@long-door-651. It checks out the triggering commit and runs `make test`, which runs `npm install` and `npm test`. With only `if: needs.affected.outputs.paths != '[]'`, a pull request opened from a fork reaches this job, so fork-controlled npm lifecycle and test scripts run with the service account credentials present in the workspace. Gate the job so it runs only for trusted refs: same-repo branches on workflow_run, plus push and workflow_dispatch. Fork pull requests no longer execute their code in this privileged context. This matches the boundary the legacy test job in custard-ci.yaml already enforces (github.event.pull_request.head.repo.fork == false). --- .github/workflows/custard-run.yaml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml index 1ad7e86cea..51ff193c59 100644 --- a/.github/workflows/custard-run.yaml +++ b/.github/workflows/custard-run.yaml @@ -102,7 +102,19 @@ jobs: status: failure test: - if: needs.affected.outputs.paths != '[]' + # These tests authenticate to Google Cloud as the + # kokoro-system-test@long-door-651 service account and run repository code + # (make test -> npm install -> npm test), so they must only run on trusted + # refs. For workflow_run triggers, limit execution to same-repo branches. + # Pull requests from forks do not reach the service account credentials or + # execute their code in this privileged context; push (post-merge) and + # workflow_dispatch runs are unaffected. The legacy test job in + # custard-ci.yaml enforces the same boundary with + # `github.event.pull_request.head.repo.fork == false`. + if: >- + needs.affected.outputs.paths != '[]' && + (github.event_name != 'workflow_run' || + github.event.workflow_run.head_repository.full_name == github.repository) needs: affected runs-on: ubuntu-latest timeout-minutes: 120 # 2 hours hard limit