PAS/nitter

Fix possible this workflow uses `secrets: inherit` to pass all of the calling workflow's s… in build-docker.ym #1438

Open

begininvoke wants to merge 1 commit from begininvoke/redgem/security-fix-fc09bab2 into master

begininvoke commented

2026-08-19 03:33:14 -04:00

(Migrated from github.com)

Small change to .github/workflows/build-docker.yml — a scan flagged the code below and it looked genuine. It is around line 20.

The workflow forwards all repository secrets to a reusable workflow using secrets: inherit. This grants the called workflow unnecessary privileged access; if the reusable workflow is compromised or originates from an untrusted source, an attacker could exfiltrate any secret (CWE‑250). Because secrets often include deployment tokens, API keys, and credentials, the impact can be full repository compromise. The risk is classified as high due to the broad exposure and difficulty in revoking after leakage.

Removed secrets: inherit to enforce least privilege; the tests workflow will receive no secrets unless explicitly added.

For reference: rule yaml.github-actions.security.secrets-inherit.secrets-inherit, CWE-250 (Execution with Unnecessary Privileges). Rated high.

I do not know the codebase, so please check the change fits how the rest of it works. Happy to adjust it or close this if the reasoning is off.

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.

Small change to `.github/workflows/build-docker.yml` — a scan flagged the code below and it looked genuine. It is around line 20. The workflow forwards all repository secrets to a reusable workflow using `secrets: inherit`. This grants the called workflow unnecessary privileged access; if the reusable workflow is compromised or originates from an untrusted source, an attacker could exfiltrate any secret (CWE‑250). Because secrets often include deployment tokens, API keys, and credentials, the impact can be full repository compromise. The risk is classified as **high** due to the broad exposure and difficulty in revoking after leakage. Removed secrets: inherit to enforce least privilege; the tests workflow will receive no secrets unless explicitly added. For reference: rule `yaml.github-actions.security.secrets-inherit.secrets-inherit`, [CWE-250 (Execution with Unnecessary Privileges)](https://cwe.mitre.org/data/definitions/250.html). Rated high. I do not know the codebase, so please check the change fits how the rest of it works. Happy to adjust it or close this if the reasoning is off. --- *Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin begininvoke/redgem/security-fix-fc09bab2:begininvoke/redgem/security-fix-fc09bab2

git switch begininvoke/redgem/security-fix-fc09bab2

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master

git merge --no-ff begininvoke/redgem/security-fix-fc09bab2

git switch begininvoke/redgem/security-fix-fc09bab2

git rebase master

git switch master

git merge --ff-only begininvoke/redgem/security-fix-fc09bab2

git switch begininvoke/redgem/security-fix-fc09bab2

git rebase master

git switch master

git merge --no-ff begininvoke/redgem/security-fix-fc09bab2

git switch master

git merge --squash begininvoke/redgem/security-fix-fc09bab2