WIP: ci: prevent checkout credential persistence #2

Closed

clawlter wants to merge 2 commits from audit/ci-credential-hardening into main

clawlter commented

2026-07-12 13:13:34 -04:00

Owner

Summary

Explicitly sets persist-credentials: false on the Forgejo checkout v6 step.
Adds a fail-closed post-checkout guard that rejects local credential helpers, HTTP auth headers, conditional credential includes, custom SSH commands, and user-info in the origin URL. The guard only checks command status/key names and never logs remote or Git-config values.

Verification

actionlint 1.7.12 passed (the known external Forgejo action-URL format diagnostic was explicitly ignored).
Exact guard green case passed on the current clone.
A safe red-capable probe passed: clean state accepted; each of credential helper, HTTP extraheader, conditional include, custom SSH command, and user-info URL state was rejected.
git diff --check passed; commit 3858e2db83893a65a19b4abc787dc51d9f58d204 is GPG-signed.
make validate could not complete because its pre-existing generation step could not resolve/download bentrumanforcongress.com (DNS error / curl exit 6), not because of the workflow-only change.

Supported-permissions limitation

The current server's matching Forgejo v15.0.4 source assigns same-repository Action PR tasks write access by default and only assigns read access for fork PRs: GetActionRepoPermission. This release does not enforce a GitHub-style workflow permissions: contents: read declaration for the automatic token. I intentionally did not add an unenforced declaration or represent it as a security control. A server/operator-side token-scope policy or upgrade is needed to constrain same-repository PR token capability; this PR prevents checkout from persisting that token in Git configuration/helper state after checkout.

Rollback

Revert 3858e2d (only .forgejo/workflows/booklet.yml changes).

## Summary - Explicitly sets `persist-credentials: false` on the Forgejo checkout v6 step. - Adds a fail-closed post-checkout guard that rejects local credential helpers, HTTP auth headers, conditional credential includes, custom SSH commands, and user-info in the `origin` URL. The guard only checks command status/key names and never logs remote or Git-config values. ## Verification - `actionlint 1.7.12` passed (the known external Forgejo action-URL format diagnostic was explicitly ignored). - Exact guard green case passed on the current clone. - A safe red-capable probe passed: clean state accepted; each of credential helper, HTTP extraheader, conditional include, custom SSH command, and user-info URL state was rejected. - `git diff --check` passed; commit `3858e2db83893a65a19b4abc787dc51d9f58d204` is GPG-signed. - `make validate` could not complete because its pre-existing generation step could not resolve/download `bentrumanforcongress.com` (DNS error / curl exit 6), not because of the workflow-only change. ## Supported-permissions limitation The current server's matching Forgejo v15.0.4 source assigns same-repository Action PR tasks write access by default and only assigns read access for fork PRs: [`GetActionRepoPermission`](https://codeberg.org/forgejo/forgejo/src/tag/v15.0.4/models/perm/access/repo_permission.go#L143-L164). This release does not enforce a GitHub-style workflow `permissions: contents: read` declaration for the automatic token. I intentionally did not add an unenforced declaration or represent it as a security control. A server/operator-side token-scope policy or upgrade is needed to constrain same-repository PR token capability; this PR prevents checkout from persisting that token in Git configuration/helper state after checkout. ## Rollback Revert `3858e2d` (only `.forgejo/workflows/booklet.yml` changes).

clawlter added 1 commit

2026-07-12 13:13:38 -04:00

ci: prevent checkout credential persistence

Booklet CI / Validate and build booklet PDFs (pull_request) Failing after 10m7s

Details

3858e2db83