gh-workflow 1.10 accepted security residuals: comment-edit attribution, App tokens, allowlist config surface, JSON apiMessage bound

[chrisdpurcell]

Outcome

Record the four security residuals accepted for github-workflow 1.10 as tracked follow-up work for a 1.11 cut.

Context

Found during the pre-merge security read of github-workflow 1.10 hardening (/tmp/ps529-session/reviews/sec-gw110.md, leg gw110 @ ba4b9719), and accepted as residuals for 1.10 because the deployment is single-owner with a PAT. Tracked against #234 (github-workflow 1.10 hardening) and PR #251.

Quoting /tmp/ps529-session/reviews/sec-gw110.md:

• Item 5 (LOW residual) — sec-gw110.md:5 — "disposition attribution by login only; a maintainer comment EDIT keeps the author → accepted residual (document); allowlist half of AC1 has no config surface (partially met)."
• Item 6 (LOW) — sec-gw110.md:6 — "apiMessage JSON branch not bounded by maxMessageBytes (pre-existing)."
• Item 8 (INFO) — sec-gw110.md:8 — "GET /user hard precondition breaks App/installation tokens; ValidateLogin rejects [bot] logins. Accepted (single owner, PAT)."

(Item 5 covers two distinct residuals: comment-edit attribution, and the trusted-author allowlist's missing config surface.)

Scope

• Disposition/comment attribution by GitHub login only: a maintainer editing a comment after posting keeps the original author as the attributed login, which can misattribute a later edit.
• The trusted-author allowlist has no configuration surface (partially meets AC1).
• apiMessage's JSON-decoding branch is not bounded by maxMessageBytes.
• GET /user as a hard precondition rejects GitHub App/installation tokens and [bot] logins, so gh-workflow cannot run under those identities.

Out of scope

Any other finding from the sec-gw110.md read (items 1-4, 7, 9), which were fixed or otherwise dispositioned before 1.10 shipped.

Acceptance criteria

• Comment/disposition attribution is resilient to a post-hoc edit, or the residual is documented as an accepted limitation with a stated reason.
• The trusted-author allowlist gains a configuration surface, or the gap is documented as accepted.
• apiMessage's JSON-decoding branch is bounded by maxMessageBytes.
• GET /user as a hard precondition is relaxed to support App/installation tokens and [bot] logins, or the limitation is documented as accepted for this deployment shape.

Evidence / references

• github-workflow 1.10: harden gh-workflow against untrusted GitHub content and racy mutations #234 (github-workflow 1.10 hardening)
• PR feat(github-workflow): cut 1.10 with the #234 hardening, shared-read dedup, land, and a stripped binary #251
• /tmp/ps529-session/reviews/sec-gw110.md items 5, 6, 8