chore(Workflows): pin commit SHA to prevent TOCTOU attack on fork deployments - #1682
Open
Marcosld wants to merge 4 commits into
Open
chore(Workflows): pin commit SHA to prevent TOCTOU attack on fork deployments#1682Marcosld wants to merge 4 commits into
Marcosld wants to merge 4 commits into
Conversation
…loyments Pass pr.head.sha at label-time from label-trigger-deploy and validate it against the live PR head in deploy-fork-pr-preview before any checkout, so a fork author cannot sneak in malicious code after safe-to-deploy is added. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Size stats
|
|
Deploy preview for mistica-web ready!
Deployed with vercel-action |
Marcosld
force-pushed
the
commit-sha-input-for-fork-deployments
branch
from
August 3, 2026 11:54
1a36c5b to
24f5ca5
Compare
Document the safe-to-deploy label flow, the CI approval gate, and the SHA-pinning behaviour so contributors know what to expect and what to do when they push new commits after the label is applied. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
tsotnikov
approved these changes
Aug 3, 2026
|
Accessibility report ℹ️ You can run this locally by executing |
Marcosld
enabled auto-merge
August 3, 2026 15:26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
label-trigger-deploynow passespr.head.shaascommitShawhen dispatching the fork preview workflow, capturing the reviewed commit at the exact moment thesafe-to-deploylabel fires.deploy-fork-pr-previewacceptscommitShaas a required input, validates its format, and compares it against the livepr.head.shabefore any checkout — failing immediately if the fork branch has been updated since the label was added.Test plan
safe-to-deployto a fork PR and verify the workflow dispatches and deploys successfully.commitSha(e.g. wrong length); verify it fails validation.🤖 Generated with Claude Code