...

The Apache Infrastructure GitHub Actions Policy has the formal rules around the use of GitHub actions. The content below is intended to be more practical advice.

IMPORTANT! You should enable CodeQL "actions" scanning in your repositories as described in  https://github.blog/security/application-security/how-to-secure-your-github-actions-workflows-with-codeql/  - this will scan and flag those issues described below and many more automatically for you

Threat model

We're trying to protect:

...

We mainly focus on attacks that can be triggered by external attackers, though ideally compromised committer accounts should also be considered.

Helpful tools

There are some validation tools that can help you identify risky patterns in your actions:

• Zizmor can be ran standalone or as a workflow
• CodeQL "Actions" scanning
• The ASF Infra team has a scanner for flagging obvious policy violations
• The ASF Tooling team is working on a scanner, though results are not public yet.

Workflow approval

By default, ASF repositories require approval before building PRs by non-committers.This has some limitations:

• This restriction does not apply to workflows triggered by pull_request_target or issue_comment
• This restriction does not protect against compromised committer accounts
• When using the 'checkout' action to check out the relevant PR, do not specify the ref  as "refs/pull/${{ github.event.number }}/merge" or "github.event.pull_request.head.ref": the PR may have been updated since the workflow was approved. Instead, leave the ref  empty to use the code associated with the event that triggered the build (which should what it looked like when it was approved), or use the exact commit hash.

Action allowlisting

The ASF GitHub org only allows action versions that have been added to the org-wide allowlist. You're invited to add actions you'd like to use to this allowlist, and review new versions as they appear. 

Default GITHUB_TOKEN permissions

...

There are some typical tasks done wit pull_request_target - for example labeling PRs with https://github.com/actions/labeler. Those could be often replaced with GitHub Apps - for example there is a "Boring Cyborg" GitHub App: https://github.com/kaxil/boring-cyborg that has similar functionality (among others). Also Boring Cyborg could be extended if some functionalities are missing. PRs are most welcome.It's highly recommended to use https://woodruffw.github.io/zizmor/ static analysis tool in your CI / pipelines to detect and fix potential security issues in your workflows.

Builds triggered with pull_request_target 

...