Repository navigation
ci(promote): pin and harden promote-to-dev - #99
Merged
Merged
Conversation
…-token WHY: The promotion token came from getsentry/action-github-app-token, a third-party action pulled by a moving tag, and it could write to every repository the App is installed on. The job only needs to push to helm-configuration. HOW: - mint the token with actions/create-github-app-token, pinned to the same commit release-v3 uses - limit the token to helm-configuration with contents write Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
WHY: The job checked out with a moving tag and pushed with actions-js/push at master, so a change upstream would run with a token that writes the deployed versions. The other templates pin every action to a commit. HOW: - pin actions/checkout to v7.0.0, the commit release-v3 uses - pin actions-js/push to v1.6, the commit master points to today - stop checkout from saving the token, since the push action passes its own Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
WHY: The job downloaded whatever yq release was latest and ran it unchecked, so a new or replaced release would run unreviewed in a job that holds a token for helm-configuration. HOW: - download yq v4.54.1 by version - check the binary against the SHA-256 published with that release before installing it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
WHY: The image name, tag and environment were pasted into shell and yq scripts as text, so an input with quotes or shell syntax could run code in a job that holds a token for helm-configuration. HOW: - read the environment from an env variable in the validation step - give yq the image name and tag through strenv instead of building the expression from them, and quote the versions file path Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Troshchk
approved these changes
Nov 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardens
promote-to-dev.yaml, which pushes deployed versions to helm-configuration for 11 repos, against upstream changes and malformed inputs.Why
actions-js/push@master, two actions on moving tags, and whatever yq release was latest, all while holding a token that can change deployments.Design decisions
actions/create-github-app-tokeninstead of pinning getsentry: it's the action and commitrelease-v3.yamlalready uses, scoped tohelm-configurationwith contents write..[strenv(IMAGE_NAME)].tag: this is yq's documented dynamic-key form and writes the same key as.fynd-hosted.tag.Not yet tested
No caller has run this branch; the new token scope and the
strenvyq expression first run on the next promotion after merge.🤖 Generated with Claude Code