Repository navigation
ci: keep fork PR builds off the self-hosted runner - #9
Merged
Merged
Conversation
pull_request builds check out and execute untrusted fork code (ensure-prereqs.sh, pip install, tests/run.sh). Running that on the persistent self-hosted runner is a remote code execution and secret exfiltration vector gated only by a maintainer's approval click. Route all PR builds to an ephemeral GitHub-hosted runner (free for public repos); keep the self-hosted runner for trusted push/dispatch events only. CI still runs for fork PRs, just never on self-hosted.
The hardcoded git7210 snapshot has been pruned from the AlliedMods drop server (404), so a clean runner downloaded the HTML error page and tar failed with 'not in gzip format'. The self-hosted runner only passed because it had the toolchain cached. Resolve the current build from the sourcemod-latest-<os> pointer and use curl -f so an HTTP error aborts with a clear message instead of writing a junk archive.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security fix (primary)
.github/workflows/ci.ymltriggers onpull_requestand thetestjob ran on[self-hosted, linux]with no fork guard — it checks out the PR and runsensure-prereqs.sh,pip install, andtests/run.sh, executing fork-supplied code on our persistent, shared self-hosted runner. A malicious fork PR = remote code execution + secret/credential exfiltration on the runner, with a foothold that outlives the job and can reach other repos (the runner is in the orgDefaultgroup, visible to all repos). The only gate today is the maintainer 'Approve and run' click, which is not a real boundary.Fix: route all PR builds to an ephemeral GitHub-hosted runner; keep self-hosted for trusted
push/workflow_dispatchonly (same pattern asmorass):Build-reliability fix (required to make the above green)
Routing PR CI to a clean runner surfaced a latent bug:
tests/run.shhardcoded SourceMod snapshotgit7210, which AlliedMods has since pruned (404).curl -s(no--fail) saved the HTML error page andtarfailed with not in gzip format. The self-hosted runner only passed because it had the toolchain cached — this would have broken it too once its cache cleared.Fix: resolve the current build from the
sourcemod-latest-<os>pointer and usecurl -fso a bad download aborts clearly.Verification
First PR run correctly executed on
ubuntu-latest(not self-hosted) — confirms the routing. Re-running with the toolchain fix now.