Skip to content

加固 PR-Agent workflow 的 secrets 暴露面 #276

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
H-Chris233 merged 1 commit into from
May 6, 2026
Merged

加固 PR-Agent workflow 的 secrets 暴露面 #276

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 19 additions & 4 deletions .github/workflows/pr-agent.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,26 +1,41 @@
name: PR-Agent

on:
# 使用 pull_request_target，让外部 PR 也能读取仓库 Secrets，并获得声明的写权限。
# 本 workflow 不 checkout / 执行 PR 分支代码，只让 PR-Agent 通过 GitHub API 读取 diff。
# 使用 pull_request_target 让同仓库与外部 fork PR 都能自动运行 PR-Agent，
# 并在 synchronize 事件跟进每次新 commit。
# 本 workflow 不 checkout / 执行 PR 分支代码，只让 digest-pinned PR-Agent 镜像通过 GitHub API 读取 diff。
pull_request_target:
types: [opened, reopened, ready_for_review, synchronize]
issue_comment:
types: [created]

jobs:
pr_agent_job:
if: ${{ github.event.sender.type != 'Bot' && (github.event_name != 'issue_comment' || github.event.issue.pull_request) }}
# PR 与每次新 commit 自动运行；评论触发仍限制为可信成员，避免任意评论滥用 Secrets。
if: >-
${{
github.event.sender.type != 'Bot' &&
(
github.event_name == 'pull_request_target' ||
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Gate pull_request_target on same-repo PRs

For an external fork PR opened or synchronized via pull_request_target, this branch evaluates true before any repository-owner check, so the secrets-bearing PR-Agent job still runs automatically with OPENAI_KEY and write-scoped GITHUB_TOKEN. The trusted-member gate only applies to issue_comment, leaving the external-PR auto path that this hardening change says it removes; add a check such as comparing github.event.pull_request.head.repo.full_name with github.repository for this event.

Useful? React with 👍 / 👎.

(
github.event_name == 'issue_comment' &&
github.event.issue.pull_request &&
contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
)
)
}}
runs-on: ubuntu-latest

permissions:
# PR-Agent 需要在 PR/issue 上评论，并通过 GitHub API 读取 diff/文件内容。
issues: write
pull-requests: write
contents: read

steps:
- name: Run PR Agent
uses: the-pr-agent/pr-agent@main
# Pin the actual PR-Agent container image because this job can access repo Secrets.
uses: docker://pragent/pr-agent@sha256:a0b36966ca3a197ca739fa1e65c16703076fc1c744cd423ca203b8c21707d71c
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Expand Down
Loading