Possible this workflow uses `secrets: inherit` to pass all of the calling workflow's s… in build-docker.yml #1435

New issue

Open

opened 2026-08-18 21:11:18 -04:00 by begininvoke · 0 comments

begininvoke commented

2026-08-18 21:11:18 -04:00

(Migrated from github.com)

Came across something in .github/workflows/build-docker.yml around line 20 that looked worth flagging.

The workflow forwards all repository secrets to a reusable workflow using secrets: inherit. This grants the called workflow unnecessary privileged access; if the reusable workflow is compromised or originates from an untrusted source, an attacker could exfiltrate any secret (CWE‑250). Because secrets often include deployment tokens, API keys, and credentials, the impact can be full repository compromise. The risk is classified as high due to the broad exposure and difficulty in revoking after leakage.

The code in question

    secrets: inherit

Something like this might fix it:

```diff
@@
-    secrets: inherit
+    # Pass only the secrets required by the reusable workflow
+    secrets:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
```

For reference: rule yaml.github-actions.security.secrets-inherit.secrets-inherit, CWE-250 (Execution with Unnecessary Privileges). Rated high.

I may be wrong about this one — closing it costs you nothing if so.

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.

Came across something in `.github/workflows/build-docker.yml` around line 20 that looked worth flagging. The workflow forwards all repository secrets to a reusable workflow using `secrets: inherit`. This grants the called workflow unnecessary privileged access; if the reusable workflow is compromised or originates from an untrusted source, an attacker could exfiltrate any secret (CWE‑250). Because secrets often include deployment tokens, API keys, and credentials, the impact can be full repository compromise. The risk is classified as **high** due to the broad exposure and difficulty in revoking after leakage. <details> <summary>The code in question</summary> ``` secrets: inherit ``` </details> Something like this might fix it: ```` ```diff @@ - secrets: inherit + # Pass only the secrets required by the reusable workflow + secrets: + DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }} + DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} ``` ```` For reference: rule `yaml.github-actions.security.secrets-inherit.secrets-inherit`, [CWE-250 (Execution with Unnecessary Privileges)](https://cwe.mitre.org/data/definitions/250.html). Rated high. I may be wrong about this one — closing it costs you nothing if so. --- *Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*

This discussion has been locked. Commenting is limited to contributors.