From 0c138665cc9ea7b86fccf880173dd666d63128ee Mon Sep 17 00:00:00 2001 From: HansMarcus01 Date: Tue, 18 Aug 2026 20:26:20 -0600 Subject: [PATCH 01/12] Fix: Implementation of a double-verification process to prevent vulnerabilities in the code of potential pul --- .../beam_Infrastructure_UsersPermissions.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index b188e5ff875b..d3ccefa1ee61 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -44,11 +44,24 @@ jobs: runs-on: [self-hosted, ubuntu-24.04, main] timeout-minutes: 30 steps: - - name: Checkout code + - name: Checkout secure master code uses: actions/checkout@v7 with: - ref: ${{ github.event.pull_request.merged == true && github.base_ref || github.event.pull_request.head.sha }} + ref: ${{ github.base_ref || github.ref }} persist-credentials: false + - name : Checkout only users.yml from the Pull Request + uses: actions/checkout@v7 + with: + sparse-checkout: 'infra/iam/users.yml' + sparse-checkout-cone-mode: false + ref: ${{ github.event.pull_request.head.sha }} + path : './pr_users' + persist-credentials: false + - name: Overwrite users.yml with PR changes + run: | + echo "[DevSecOps] Safely overwriting users.yml with data from the Pull Request..." + cp ./pr_users/infra/iam/users.yml ./infra/iam/users.yml + - name: Setup gcloud uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db - name: Install Terraform From bd362a944b6ec12c117c040fce5bf04c0b0bd5bd Mon Sep 17 00:00:00 2001 From: HansMarcus01 Date: Tue, 18 Aug 2026 21:00:23 -0600 Subject: [PATCH 02/12] fixrefactor: Use secure curl to fetch users.yml and fix CodeQL alert --- .github/workflows/beam_Infrastructure_UsersPermissions.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index d3ccefa1ee61..0532f26f8c74 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -61,7 +61,12 @@ jobs: run: | echo "[DevSecOps] Safely overwriting users.yml with data from the Pull Request..." cp ./pr_users/infra/iam/users.yml ./infra/iam/users.yml - + - name: Download users.yml directly from PR fork + run: | + echo "[DevSecOps] Descargando de forma segura users.yml desde el Pull Request..." + curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \ + "https://api.github.com/repos/${{ github.repository }}/contents/infra/iam/users.yml?ref=${{ github.event.pull_request.head.ref }}" \ + | jq -r '.content' | base64 --decode > ./infra/iam/users.yml - name: Setup gcloud uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db - name: Install Terraform From a10a098ffdcf60317dcb4daabd3e7d2ba81e2667 Mon Sep 17 00:00:00 2001 From: HansMarcus01 Date: Tue, 18 Aug 2026 21:27:04 -0600 Subject: [PATCH 03/12] Fix: Injected code removed. --- .../beam_Infrastructure_UsersPermissions.yml | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index 0532f26f8c74..18569d4984b8 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -49,23 +49,14 @@ jobs: with: ref: ${{ github.base_ref || github.ref }} persist-credentials: false - - name : Checkout only users.yml from the Pull Request - uses: actions/checkout@v7 - with: - sparse-checkout: 'infra/iam/users.yml' - sparse-checkout-cone-mode: false - ref: ${{ github.event.pull_request.head.sha }} - path : './pr_users' - persist-credentials: false - - name: Overwrite users.yml with PR changes - run: | - echo "[DevSecOps] Safely overwriting users.yml with data from the Pull Request..." - cp ./pr_users/infra/iam/users.yml ./infra/iam/users.yml - name: Download users.yml directly from PR fork + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR_BRANCH_REF: ${{ github.event.pull_request.head.ref }} run: | echo "[DevSecOps] Descargando de forma segura users.yml desde el Pull Request..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \ - "https://api.github.com/repos/${{ github.repository }}/contents/infra/iam/users.yml?ref=${{ github.event.pull_request.head.ref }}" \ + curl -s --retry 3 --retry-delay 5 -H "Authorization: token $GH_TOKEN" \ + "https://api.github.com/repos/${{ github.repository }}/contents/infra/iam/users.yml?ref=$PR_BRANCH_REF" \ | jq -r '.content' | base64 --decode > ./infra/iam/users.yml - name: Setup gcloud uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db From 855c23c689dfed3680f523acb3458b3bbd1eaaad Mon Sep 17 00:00:00 2001 From: HansMarcus01 Date: Wed, 19 Aug 2026 09:32:45 -0600 Subject: [PATCH 04/12] Translate spanish message into english --- .github/workflows/beam_Infrastructure_UsersPermissions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index 18569d4984b8..7f758eb2d66d 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -54,7 +54,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} PR_BRANCH_REF: ${{ github.event.pull_request.head.ref }} run: | - echo "[DevSecOps] Descargando de forma segura users.yml desde el Pull Request..." + echo "[DevSecOps] Downloading users.yml directly from the Pull Request fork..." curl -s --retry 3 --retry-delay 5 -H "Authorization: token $GH_TOKEN" \ "https://api.github.com/repos/${{ github.repository }}/contents/infra/iam/users.yml?ref=$PR_BRANCH_REF" \ | jq -r '.content' | base64 --decode > ./infra/iam/users.yml From e57686e1e1ef4ac8ffb3c6bf1a03b1f38eb6da7c Mon Sep 17 00:00:00 2001 From: HansMarcus01 Date: Wed, 19 Aug 2026 09:41:11 -0600 Subject: [PATCH 05/12] test: Add synthetic test user in users.yml to verify secure workflow" -m "Adds a dummy test user 'finops_test_user' to trigger and validate the new secure dual-checkout GitHub Actions workflow in the PR plan. --- infra/iam/users.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/infra/iam/users.yml b/infra/iam/users.yml index 6c37b4c1fef0..495a831e73cf 100644 --- a/infra/iam/users.yml +++ b/infra/iam/users.yml @@ -448,6 +448,11 @@ - role: roles/eventarc.eventReceiver - role: roles/pubsub.publisher - role: roles/workflows.invoker +- username: finops_test_user + email: finops.test.user@gmail.com + member_type: user + permissions: + - role: roles/beam_viewer - username: firebase-adminsdk-dpfsw email: firebase-adminsdk-dpfsw@apache-beam-testing.iam.gserviceaccount.com member_type: serviceAccount From b00e24b22d3d821609c07f7e662515da5c6345cd Mon Sep 17 00:00:00 2001 From: HansMarcus01 Date: Wed, 19 Aug 2026 10:47:51 -0600 Subject: [PATCH 06/12] Change runner to ubuntu-latest for user roles job, only to test the action --- .github/workflows/beam_Infrastructure_UsersPermissions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index 7f758eb2d66d..6535f2aea2dd 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -41,7 +41,7 @@ permissions: jobs: beam_UserRoles: name: Apply user roles changes - runs-on: [self-hosted, ubuntu-24.04, main] + runs-on: [ubuntu-latest] timeout-minutes: 30 steps: - name: Checkout secure master code From 16f86e89d7575a22964fa0402f4e94ae1f5df6e5 Mon Sep 17 00:00:00 2001 From: HansMarcus01 Date: Wed, 19 Aug 2026 11:18:04 -0600 Subject: [PATCH 07/12] Change runner to self-hosted and ubuntu-24.04 --- .github/workflows/beam_Infrastructure_UsersPermissions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index 6535f2aea2dd..7f758eb2d66d 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -41,7 +41,7 @@ permissions: jobs: beam_UserRoles: name: Apply user roles changes - runs-on: [ubuntu-latest] + runs-on: [self-hosted, ubuntu-24.04, main] timeout-minutes: 30 steps: - name: Checkout secure master code From 546cc3e81569797669ac22fad3b129afd3a1dcbf Mon Sep 17 00:00:00 2001 From: HansMarcus01 Date: Wed, 19 Aug 2026 19:11:57 -0600 Subject: [PATCH 08/12] Change runner to ubuntu-latest for user roles job, for a quick test --- .github/workflows/beam_Infrastructure_UsersPermissions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index 7f758eb2d66d..6535f2aea2dd 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -41,7 +41,7 @@ permissions: jobs: beam_UserRoles: name: Apply user roles changes - runs-on: [self-hosted, ubuntu-24.04, main] + runs-on: [ubuntu-latest] timeout-minutes: 30 steps: - name: Checkout secure master code From 8d934ea95bb5ac8390dcd130b451ea9e6b70209a Mon Sep 17 00:00:00 2001 From: HansMarcus01 Date: Wed, 19 Aug 2026 20:23:54 -0600 Subject: [PATCH 09/12] Change runner to self-hosted and ubuntu-24.04 Returning the script to a production state after completing testing. --- .github/workflows/beam_Infrastructure_UsersPermissions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index 6535f2aea2dd..7f758eb2d66d 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -41,7 +41,7 @@ permissions: jobs: beam_UserRoles: name: Apply user roles changes - runs-on: [ubuntu-latest] + runs-on: [self-hosted, ubuntu-24.04, main] timeout-minutes: 30 steps: - name: Checkout secure master code From 5380f63d2c6f6dfe7b92717d6d9a7ea9f4fd5f2d Mon Sep 17 00:00:00 2001 From: HansMarcus01 Date: Thu, 20 Aug 2026 19:47:50 -0600 Subject: [PATCH 10/12] [Infra] Fix Terraform plan action failing on fork PRs (pwn request prevention) The beam_Infrastructure_UsersPermissions workflow was failing on PRs from forks due to the 'actions/checkout' step blocking untrusted code execution in a 'pull_request_target' context. This commit resolves the security warning without exposing the runner to malicious code: 1. Checked out the trusted base repository code (`github.base_ref`) instead of the untrusted PR head. 2. Added a specific step to fetch ONLY the untrusted data file (`users.yml`) from the PR if it's not yet merged. 3. This allows `terraform plan` to safely evaluate the user's requested changes using trusted Terraform files (`.tf`). --- .../beam_Infrastructure_UsersPermissions.yml | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index 7f758eb2d66d..1fc1dc8f6a1a 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -44,20 +44,16 @@ jobs: runs-on: [self-hosted, ubuntu-24.04, main] timeout-minutes: 30 steps: - - name: Checkout secure master code + - name: Checkout trusted based repository uses: actions/checkout@v7 with: - ref: ${{ github.base_ref || github.ref }} + ref: ${{ github.base_ref}} persist-credentials: false - - name: Download users.yml directly from PR fork - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - PR_BRANCH_REF: ${{ github.event.pull_request.head.ref }} + - name: Fetch untrusted users.yml from PR + if: github.event.pull_request.merged != true run: | - echo "[DevSecOps] Downloading users.yml directly from the Pull Request fork..." - curl -s --retry 3 --retry-delay 5 -H "Authorization: token $GH_TOKEN" \ - "https://api.github.com/repos/${{ github.repository }}/contents/infra/iam/users.yml?ref=$PR_BRANCH_REF" \ - | jq -r '.content' | base64 --decode > ./infra/iam/users.yml + git fetch origin pull/${{ github.event.pull_request.number }}/head:pr-branch + git checkout pr-branch -- infra/iam/users.yml - name: Setup gcloud uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db - name: Install Terraform From cc0d57b7ca313ce99dfc8cb49859f67924f36304 Mon Sep 17 00:00:00 2001 From: HansMarcus01 Date: Thu, 20 Aug 2026 19:59:18 -0600 Subject: [PATCH 11/12] Fix: forcing the GitHub Action to use the master branch of the secure repository. --- .github/workflows/beam_Infrastructure_UsersPermissions.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index 1fc1dc8f6a1a..64d3c0759c69 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -47,9 +47,8 @@ jobs: - name: Checkout trusted based repository uses: actions/checkout@v7 with: - ref: ${{ github.base_ref}} persist-credentials: false - - name: Fetch untrusted users.yml from PR + - name: Fetch updated users.yml from PR if: github.event.pull_request.merged != true run: | git fetch origin pull/${{ github.event.pull_request.number }}/head:pr-branch From eda7348846f572ae3465c97b6a1068750415c634 Mon Sep 17 00:00:00 2001 From: HansMarcus01 Date: Fri, 21 Aug 2026 12:30:41 -0600 Subject: [PATCH 12/12] [Infra] Secure IAM workflow using two-tier artifact model - Resolves `actions/checkout` blockage on `pull_request_target` by isolating untrusted fork data. - Adds `extract_users.yml` to safely run on `pull_request` and upload `users.yml` as a GitHub Artifact. - Refactors `beam_Infrastructure_UsersPermissions.yml` to trigger via `workflow_run`, downloading the artifact and executing `terraform plan` in a fully trusted context. - Prevents RCE and "pwn request" vulnerabilities while restoring automated Terraform plan comments on PRs. --- .../beam_Infrastructure_UsersPermissions.yml | 52 ++++++++++--------- .../beam_infraestructure_extract_users.yml | 47 +++++++++++++++++ 2 files changed, 74 insertions(+), 25 deletions(-) create mode 100644 .github/workflows/beam_infraestructure_extract_users.yml diff --git a/.github/workflows/beam_Infrastructure_UsersPermissions.yml b/.github/workflows/beam_Infrastructure_UsersPermissions.yml index 64d3c0759c69..fb2fb67fba8d 100644 --- a/.github/workflows/beam_Infrastructure_UsersPermissions.yml +++ b/.github/workflows/beam_Infrastructure_UsersPermissions.yml @@ -23,16 +23,9 @@ name: Modify the GCP User Roles according to the infra/users.yml file on: - workflow_dispatch: - pull_request_target: - types: [opened, synchronize, reopened, closed] - paths: - - 'infra/iam/users.yml' - -# This allows a subsequently queued workflow run to interrupt previous runs -concurrency: - group: '${{ github.workflow }} @ ${{ github.event.pull_request.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}' - cancel-in-progress: true + workflow_run: + workflows: ["Extract users.yml from PR"] + types: [completed] permissions: contents: read @@ -43,36 +36,50 @@ jobs: name: Apply user roles changes runs-on: [self-hosted, ubuntu-24.04, main] timeout-minutes: 30 + if: ${{ github.event.workflow_run.conclusion == 'success' }} steps: - - name: Checkout trusted based repository + - name: Checkout trusted base repository uses: actions/checkout@v7 with: persist-credentials: false - - name: Fetch updated users.yml from PR - if: github.event.pull_request.merged != true + + - name: Download Artifacts + uses: actions/download-artifact@v4 + with: + name: pr-data + github-token: ${{ secrets.GITHUB_TOKEN }} + run-id: ${{ github.event.workflow_run.id }} + + # Move the users.yml file to the correct location for Terraform to process it + - name: Prepare users.yml + run: mv users.yml infra/iam/users.yml + + - name: Load PR Number run: | - git fetch origin pull/${{ github.event.pull_request.number }}/head:pr-branch - git checkout pr-branch -- infra/iam/users.yml + PR_NUM=$(cat pr_number.txt) + echo "PR_NUMBER=$PR_NUM" >> $GITHUB_ENV + - name: Setup gcloud uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db + - name: Install Terraform - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e with: terraform_version: 1.12.2 + - name: Initialize Terraform working-directory: ./infra/iam run: terraform init + - name: Terraform Plan working-directory: ./infra/iam run: terraform plan -out=tfplan - name: Convert plan to plaintext - if: github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened' working-directory: ./infra/iam run: terraform show -no-color tfplan > tfplan.txt - name: Create comment body - if: github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened' run: | PLAN_SIZE=$(wc -c < ./infra/iam/tfplan.txt) if [ "$PLAN_SIZE" -gt 60000 ]; then @@ -85,14 +92,9 @@ jobs: echo '```' >> comment_body.txt fi + # Use the environment variable PR_NUMBER that we read from the file - name: Upload plan as a comment to PR - if: github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened' env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} GH_REPO: ${{ github.repository }} - run: gh pr comment ${{ github.event.pull_request.number }} --body-file comment_body.txt - - - name: Terraform Apply - if: github.event.pull_request.merged == true - working-directory: ./infra/iam - run: terraform apply -auto-approve tfplan + run: gh pr comment "$PR_NUMBER" --body-file comment_body.txt diff --git a/.github/workflows/beam_infraestructure_extract_users.yml b/.github/workflows/beam_infraestructure_extract_users.yml new file mode 100644 index 000000000000..630993047252 --- /dev/null +++ b/.github/workflows/beam_infraestructure_extract_users.yml @@ -0,0 +1,47 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# This workflow is used to extract the users.yml file from a pull request and upload it +# as an artifact for further processing. +# It is triggered when the users.yml file is modified in a pull request. + + +name: Extract users.yml from PR + +on: + pull_request: + paths: + - 'infra/iam/users.yml' + +jobs: + extract_data: + runs-on: ubuntu-latest + steps: + - name: Checkout PR code + uses: actions/checkout@v7 + + # Save the PR number to a file for later use + - name: Save PR number + run: echo ${{ github.event.pull_request.number }} > pr_number.txt + + - name: Upload Artifacts + uses: actions/upload-artifact@v4 + with: + name: pr-data + path: | + infra/iam/users.yml + pr_number.txt \ No newline at end of file