PAS/nitter

Fix possible this workflow uses `secrets: inherit` to pass all of the calling workflow's s… in build-docker.ym #1437

Open

begininvoke wants to merge 1 commit from begininvoke/redgem/security-fix-ccad0361 into master

begininvoke commented

2026-08-19 03:31:21 -04:00

(Migrated from github.com)

Small change to .github/workflows/build-docker.yml — a scan flagged the code below and it looked genuine. It is around line 20.

The workflow forwards all repository secrets to a reusable workflow using secrets: inherit. This grants the called workflow unnecessary privileged access; if the reusable workflow is compromised or originates from an untrusted source, an attacker could exfiltrate any secret (CWE‑250). Because secrets often include deployment tokens, API keys, and credentials, the impact can be full repository compromise. The risk is classified as high due to the broad exposure and difficulty in revoking after leakage.

Replace secrets: inherit with explicit mapping of only the DockerHub credentials needed for the reusable workflow to prevent over‑privileging.

For reference: rule yaml.github-actions.security.secrets-inherit.secrets-inherit, CWE-250 (Execution with Unnecessary Privileges). Rated high.

I do not know the codebase, so please check the change fits how the rest of it works. Happy to adjust it or close this if the reasoning is off.

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.

Small change to `.github/workflows/build-docker.yml` — a scan flagged the code below and it looked genuine. It is around line 20. The workflow forwards all repository secrets to a reusable workflow using `secrets: inherit`. This grants the called workflow unnecessary privileged access; if the reusable workflow is compromised or originates from an untrusted source, an attacker could exfiltrate any secret (CWE‑250). Because secrets often include deployment tokens, API keys, and credentials, the impact can be full repository compromise. The risk is classified as **high** due to the broad exposure and difficulty in revoking after leakage. Replace `secrets: inherit` with explicit mapping of only the DockerHub credentials needed for the reusable workflow to prevent over‑privileging. For reference: rule `yaml.github-actions.security.secrets-inherit.secrets-inherit`, [CWE-250 (Execution with Unnecessary Privileges)](https://cwe.mitre.org/data/definitions/250.html). Rated high. I do not know the codebase, so please check the change fits how the rest of it works. Happy to adjust it or close this if the reasoning is off. --- *Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin begininvoke/redgem/security-fix-ccad0361:begininvoke/redgem/security-fix-ccad0361

git switch begininvoke/redgem/security-fix-ccad0361

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master

git merge --no-ff begininvoke/redgem/security-fix-ccad0361

git switch begininvoke/redgem/security-fix-ccad0361

git rebase master

git switch master

git merge --ff-only begininvoke/redgem/security-fix-ccad0361

git switch begininvoke/redgem/security-fix-ccad0361

git rebase master

git switch master

git merge --no-ff begininvoke/redgem/security-fix-ccad0361

git switch master

git merge --squash begininvoke/redgem/security-fix-ccad0361